Viewers got to see some interesting vulnerabilities and coding practices that made her demo app pretty open to exploits.
A friend of mine published a book about it over 25 years ago, called The Happy Hacker.
If you're hacking without permission, no matter what your motives, you could get arrested.
Don't try to nuke your target, crash it, or delete production data to prove your hack.
Remember, if you're hacking ethically, you're a guest in the systems you breach, so be respectful.
The Sakura Samurai ethical hacking group exposed a security hole that provided access to sensitive United Nations data.
Sonya's demo went through hacking an app called Patch, which is a deliberately vulnerable demo application, written in Node.js.
One of the first steps in hacking is reconnaissance.
She found her way to the top level of the app directory, giving her the ability to view and exfiltrate the entire source code.
She got access to all the code, not just that file.
She scrolled further down to find the code associated with the chat endpoint and that's when I almost.
DO NOT PUSH TO PRODUCTION. For those of you who aren't programmers, that's a comment in the code.
It's a reminder to anyone who reads the code, but has absolutely zero impact on whether the code will actually get pushed to production.
This is why I almost covered my monitor in Coke Zero Sugar, because it's the coding equivalent of a slapstick gag.
She went back through the code, found something interesting, traced it to another outdated package with a Prototype Pollution vulnerability, and was able to use it to inject code that gave her the ability to delete chat messages.
Wrapping Up. When I did a demonstration of how to code a simple WebSockets chat at a developer meetup over 10 years ago, my app was so simple that it didn't sanitize the messages.
It's easier than you think to write vulnerable code and ethical hacking can help you find it when you have.
If you ignore any of those, your hacking is not ethical and you could get in trouble.
If you want to learn more about ethical hacking, our friends at Snyk have a great set of ethical hacking resources for you to explore.
Remember, an important bit of hacker recon is to go through public repositories, looking for plaintext secrets in your public code.
This Cyber News was published on securityboulevard.com. Publication date: Tue, 05 Dec 2023 11:43:05 +0000