Think Like a Hacker
summary
An intentionally vulnerable Laravel app gets compromised end to end: user enumeration via registration and password reset, credential stuffing using leaked creds, and weak passwords (the passwords database lists 613 million passwords, “password” appears ~4 million times, “dragon123” ~40k). The demo uses the Have I Been Pwned password API, forces XSS through Blade tag attributes (fixed by update to 7.12), abuses cookie-session deserialization with phpggc to achieve remote code execution, exploits debug mode leak, and extracts data via sqlmap; fixes shown: enforce policies, disable debug, apply security updates, and validate/escape input.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:09Think like a Hacker
- 1:10Thinking like a Hacker
- 2:08Human Vulnerability
- 4:20Brute Force
- 10:13Cross-Site Scripting Vulnerability
- 18:37Share Feature
- 19:47Debug Mode
- 21:13Disabling Debug Mode
- 22:53Remote Code Execution
- 24:51Php Generic Gadget Chains Tool
- 27:24Sql Injection
- 27:39Sqlmap
related talks
22mTh1nk Lik3 a H4cker
31mHow your Laravel application can get hacked, and how to prevent that from happening
52mHow to get properly hacked!
47mLive Hacking: Breaking into Your Web App
22mIntegrating Security Measures Throughout Development
40mHow to hack a node app?
30mHow to hack a web app?
59m50 Shades of AppSec