The Smörgåsbord of web app hacking
summary
Starts with finding a PayPal XSS that nets $750 then escalates to sending 22 validated bugs from an iPhone for $4,000, demonstrates a chained privilege escalation into Oculus that yields remote code execution and a $25,000 payout, uses Flask Werkzeug debugger fingerprints found via Shodan search to expose a Patreon debug host linked to the 2.2M-member breach, shows Swagger UI iframe exploitation, and recounts earning $51,000 in a DefCon suite bounty sprint — all concrete exploits, tools, counts, and payouts.
AI-written summary · about
chapters (10)
- 0:00Web app hacking intro
- 1:29Starting in bug bounty
- 7:28Bug bounty marketplaces
- 9:54Real-world vulnerabilities
- 13:25Creative bug hunting
- 16:53Dangerous dev tools
- 19:44Patreon breach disclosure
- 22:14Uber and Google findings
- 24:45Unexpected rewards
- 27:14Def Con hacking suite
related talks
43mHow The Hack?
55mAttacking Modern Web Technologies
53mOpening Keynote – Dr. Katie Paxton-Fear
58mModern web application bugs
42mHidden Chains: Revealing High-Impact Bugs from Bounty submissions
25mHacker-Powered Data: Why the Most Common Vulnerabilities Aren’t What You Think They Are
46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS Hacking
30mHow to hack a web app?