Let’s play a game: what is the deadly bug here?

Channel:
United States LiveOverflow
Subscribers:
921,000
Published on ● Video Link: https://www.youtube.com/watch?v=MpeaSNERwQA


Duration: 12:54
485,932 views
15,394

This short php code contains a critical vulnerability. In this video I will explain in detail what I think while analysing it.

Original source of challenge: https://www.securify.nl/en/blog/SFY20180101/spot-the-bug-challenge-2018-warm-up.html
Link to tweet: https://twitter.com/xxByte/status/951499972582703104

-=[ ❤️ Support ]=-

→ per Video: https://www.patreon.com/join/liveoverflow
→ per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join

-=[ 🐕 Social ]=-

→ Twitter: https://twitter.com/LiveOverflow/
→ Website: https://liveoverflow.com/
→ Subreddit: https://www.reddit.com/r/LiveOverflow/
→ Facebook: https://www.facebook.com/LiveOverflow/

-=[ 📄 P.S. ]=-

All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

#CodeAudit #WebSecurity



Other Videos By LiveOverflow


2018-03-30ey! Look for patterns
2018-03-23Fuzzing with radamsa - Short
2018-03-16Linear independence and GF(2) - 34C3 CTF software_update (crypto) part 2/2
2018-03-09Python code audit of a firmware update - 34C3 CTF software_update (crypto) part 1/2
2018-03-02Global variable Buffer Overflow to leak memory - 34C3 CTF readme_revenge (pwn)
2018-02-23CSS Keylogger - old is new again
2018-02-16STOP WASTING YOUR TIME AND LEARN MORE HACKING!
2018-02-10MMORPG Bot part 2 - Some thoughts on the data
2018-02-09MMORPG Bot Reverse Engineering and Tracking
2018-02-02heap0 exploit speedrun & weird ASCII string on the Heap - bin 0x28
2018-01-26Let’s play a game: what is the deadly bug here?
2018-01-19TROOPERS 17 Badge ft. BadgeWizard
2018-01-12Identifying UART and main() in an AVR firmware (ft. Zeta Two) part 1 - rhme2
2018-01-05Regular expression as Finite-state machine - Short
2017-12-29TROOPERS 17 - PacketWars solved with an iPhone
2017-12-22Searching for Bitcoins in GitHub repositories with Google BigQuery
2017-12-15Adapting the 32bit exploit to 64bit for format4 - bin 0x27
2017-12-08Some thoughts on Mobile App Security - is it FUD?
2017-12-01format2 on a modern Ubuntu - bin 0x26
2017-11-27Looking for Feedback - Link to Survey in the Description
2017-11-24Stack grooming and 100% reliable exploit for format0 - bin 0x25


Tags:
Live Overflow
liveoverflow
hacking tutorial
how to hack
exploit tutorial
php
php hmac
hmac
vulnerability
bug
critical
severe
fail
php bug
php exploit
web hacking
php hacking
php website
php challenge
ctf
game hacking
hacking process
step by step
tutorial
hacks
hack
php reversing
nonce
sha256
hash_hmac
exec
system
code exec
remote exploit