Th1nk Lik3 a H4cker
summary
Live demo breaks a Laravel app end-to-end: crowdsourced brute force shows IP rate limits are trivial to bypass, a signed verification URL is accepted when the signature check was left for backward compatibility, an IDOR to admin (id=13) lets attackers edit the admin bio, CommonMark rendering enables a CommonMark XSS in admin bio that runs JS in the admin browser to escalate roles, and an encoded path traversal lets attackers read .env via encoded path traversal to steal APP_KEY and decrypt session cookies for full site takeover — the demo works live.
AI-written summary · about
chapters (7)
- 0:00Introduction and setup
- 2:13Password brute-forcing
- 5:31Unauthorized privilege escalation
- 8:43Exploiting insecure objects
- 10:38Cross-site scripting attacks
- 13:53Environment file exposure
- 19:17Conclusion and security advice
