Trying to Find a Bug in WordPress
4,668I stumbled over some WordPress code involving caching. Immediately I had this idea about MD5 collision and how this could affect the implemented logic. I started going down a rabbit hole exploring the feasibility and eventually setting up a PHP debug environment. Only to realize that the idea was flawed from the start. So while this ends up being failed security research, we still learn a lot along the process.
Get my handwritten font https://shop.liveoverflow.com (advertisement)
Checkout our courses on https://hextree.io (advertisement)
Support these videos: https://liveoverflow.com/support/
---
get_page_by_path: https://developer.wordpress.org/reference/functions/get_page_by_path/
Hash Collision Overview: https://github.com/corkami/collisions#fastcoll-md5
MD5 Collision Demo: https://www.mscs.dal.ca/~selinger/md5collision/
Is there an ASCII only MD5 hash collision? https://twitter.com/LiveOverflow/status/1664280653519810563
Wordpress docker image with xdebug: https://github.com/wpdiaries/wordpress-xdebug
Debugging wordpress with xdebug: https://www.wpdiaries.com/wordpress-with-xdebug-for-docker/
What is a Server? https://www.youtube.com/watch?v=VXmvM2QtuMU
---
Chapters:
00:00 - Intro
00:36 - Finding the Research Topic
03:03 - Dumb Ideas Are NOT a Problem
03:40 - "What happens with a MD5 Hash Collision?"
04:38 - MD5 Hash Collision Feasibility
09:25 - WordPress Development Environment
11:18 - Debugging PHP
12:57 - Configuring xdebug
14:42 - Realizing the Research Idea was Flawed
15:58 - What we learned from the failed research
17:10 - hextree.io
17:47 - Outro
=[ β€οΈ Support ]=
β per Video: https://www.patreon.com/join/liveoverflow
β per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
2nd Channel: https://www.youtube.com/LiveUnderflow
=[ π Social ]=
β Twitter: https://twitter.com/LiveOverflow/
β Streaming: https://twitch.tvLiveOverflow/
β TikTok: https://www.tiktok.com/@liveoverflow_
β Instagram: https://instagram.com/LiveOverflow/
β Blog: https://liveoverflow.com/
β Subreddit: https://www.reddit.com/r/LiveOverflow/
β Facebook: https://www.facebook.com/LiveOverflow/
Other Videos By LiveOverflow
| 2023-10-17 | The Circle of Unfixable Security Issues |
| 2023-10-05 | Binary Exploitation vs. Web Security |
| 2023-09-19 | Hacker Tweets Explained |
| 2023-08-29 | Zenbleed (CVE-2023-20593) |
| 2023-08-18 | The Discovery of Zenbleed ft. Tavis Ormandy |
| 2023-08-01 | Asking Android Developers About Security at Droidcon Berlin |
| 2023-07-22 | Local Root Exploit in HospitalRun Software |
| 2023-07-13 | Android App Bug Bounty Secrets |
| 2023-07-03 | Generic HTML Sanitizer Bypass Investigation |
| 2023-06-22 | Hacking Google Cloud? |
| 2023-06-11 | Trying to Find a Bug in WordPress |
| 2023-05-31 | Authentication Bypass Using Root Array |
| 2023-05-22 | My YouTube Financials - The Future of LiveOverflow |
| 2023-05-11 | Defending LLM - Prompt Injection |
| 2023-04-27 | Accidental LLM Backdoor - Prompt Tricks |
| 2023-04-14 | Attacking LLM - Prompt Injection |
| 2023-04-01 | Our Future As Hackers Is At Stake! |
| 2023-03-29 | Cyber Security Challenge Germany (2023) |
| 2023-03-20 | Cybercrime is Not Hacking! |
| 2023-03-11 | Attacking Language Server JSON RPC |
| 2023-03-03 | Advanced Teleport Hack (stolen from cheaters) |