Why Hacking Isn’t Rocket Science
summary
Claim: hackers exploit simple system behaviors, not arcane genius. Demonstrations include a race condition that redeems a $500 gift card multiple times by firing three near-simultaneous requests, an IDOR that exposes other users by changing a numeric ID, brute‑forcing a four‑digit reset code (10,000 combos) by automating retries, and uploading a PHP web shell to run commands and steal /etc/shadow hashes then crack them locally with John the Ripper. Examples use raw HTTP GET/POST traces, real request counts (25 total requests; 24 background), and live exploit chains that lead to persistent server access.
AI-written summary · about
chapters (13)
- 0:00Introduction to hacking
- 10:14Web communication basics
- 12:38Insecure direct references
- 15:14Real world vs cyber security
- 18:54HTTP request mechanics
- 21:43Web shop manipulation
- 25:08Negative quantity exploits
- 26:57Authorization bypass
- 29:45Password reset hacking
- 32:38Server side code execution
- 34:33Uploading malware
- 37:30Cracking passwords
- 40:19Conclusion and resources
