Live Hacking Session Part 1

on YouTube ↗19m

" summary

Finds a 2014 ISP router web‑interface flaw while proxying traffic with Fiddler, reports it responsibly, then faces legal threats and media attention; the bug leads to a security career offer. Rebuilds a demo app, uses Mailinator for throwaway accounts, and proves both persistent cross-site scripting (stored script alert) and reflected XSS by injecting payloads into comments and URLs. Shows fixes: context‑sensitive output encoding and a backup content security policy header via securityheaders.io to block inline scripts.

AI-written summary · about

" chapters (14)

1. 0:00Start
2. 1:53Fiddler
3. 4:35Penetration Testing
4. 9:31Owasp Top 10
5. 10:37Cross-Site Scripting
6. 10:48Cross-Site Scripting
7. 12:16Cross Site Scripting
8. 12:32Persistent Cross-Site Scripting
9. 13:12Reflected Cross-Site Scripting Attack
10. 13:28Reflected Attack
11. 14:09Output Encoding
12. 15:48Content Security
13. 16:38Security Headers
14. 16:49Http Response Header

" related talks

• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019
• 01h 01mSomething Something CyberTroy Hunt · NDC Oslo 2017
• 42mHack Me If You CanKonstantin Haase · Ancient City Ruby 2014
• 43mAttacking Modern Web TechnologiesFrans Rosén · OWASP AppSec Europe 2018
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 59mHack Yourself FirstTroy Hunt · Web Directions South 2013