Attacking Language Server JSON RPC
2,980While auditing a VSCode Extension + Language Server I noticed something interesting. This turned into the research question "can we attack the extension from the browser?". After a bit of preliminary research I decided to do it again on stream, and eventually made this video. This is how security research can look like.
What is a Server? https://www.youtube.com/watch?v=VXmvM2QtuMU
What is a Protocol? https://www.youtube.com/watch?v=d-zn-wv4Di8
GitLab 11.4.7 RCE https://www.youtube.com/watch?v=LrLJuyAdoAg
Live Stream: https://www.youtube.com/watch?v=jc7S6TtLK_c
My Font (advertisement): https://shop.liveoverflow.com/
Interested in more videos like this? https://www.youtube.com/playlist?list=PLhixgUqwRTjzSTVPNZduVzMY1yebFrA9m
Chapters:
00:00 - Why Security Research?
01:23 - What is a Language Server?
02:53 - Setup Example Code
04:00 - RCE in VSCode Extension?
05:25 - The Language Server Code
06:29 - Researching Communication
11:13 - Can a Browser Attack the VSCode Extension?
13:54 - Research Results
15:40 - Ad n' Outro
=[ ❤️ Support ]=
→ per Video: https://www.patreon.com/join/liveoverflow
→ per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
2nd Channel: https://www.youtube.com/LiveUnderflow
=[ 🐕 Social ]=
→ Twitter: https://twitter.com/LiveOverflow/
→ Streaming: https://twitch.tvLiveOverflow/
→ TikTok: https://www.tiktok.com/@liveoverflow_
→ Instagram: https://instagram.com/LiveOverflow/
→ Blog: https://liveoverflow.com/
→ Subreddit: https://www.reddit.com/r/LiveOverflow/
→ Facebook: https://www.facebook.com/LiveOverflow/
Other Videos By LiveOverflow
| 2023-06-22 | Hacking Google Cloud? |
| 2023-06-11 | Trying to Find a Bug in WordPress |
| 2023-05-31 | Authentication Bypass Using Root Array |
| 2023-05-22 | My YouTube Financials - The Future of LiveOverflow |
| 2023-05-11 | Defending LLM - Prompt Injection |
| 2023-04-27 | Accidental LLM Backdoor - Prompt Tricks |
| 2023-04-14 | Attacking LLM - Prompt Injection |
| 2023-04-01 | Our Future As Hackers Is At Stake! |
| 2023-03-29 | Cyber Security Challenge Germany (2023) |
| 2023-03-20 | Cybercrime is Not Hacking! |
| 2023-03-11 | Attacking Language Server JSON RPC |
| 2023-03-03 | Advanced Teleport Hack (stolen from cheaters) |
| 2023-02-17 | VPNs, Proxies and Secure Tunnels Explained (Deepdive) |
| 2023-01-31 | Velocity Exploit on Paper? |
| 2023-01-12 | I’m moving, no videos sorry |
| 2023-01-01 | Computer Networking (Deepdive) |
| 2022-12-23 | Revisiting 2b2t Tamed Animal Coordinate Exploit |
| 2022-12-18 | Pain in your Hand (RSI)? |
| 2022-12-13 | What is a Protocol? (Deepdive) |
| 2022-12-09 | The Future Of Hacking #shorts |
| 2022-12-06 | Google vs. ChatGPT for Hackers #shorts |