0:00 / 0:00

Let’s play a game: what is the deadly bug here?

Name: Let’s play a game: what is the deadly bug here?
Uploaded: 2018-01-27T02:47:18Z
Duration: 12 min 54 s
Channel: LiveOverflow
Description: LiveOverflow walks through a PHP code-review puzzle to find and explain a critical vulnerability involving HMAC and type comparison.

LiveOverflow

949K subscribers • 11 videos on Hallway

YouTube

Recommended by 1 person: 1 on Lobsters.
Presented by LiveOverflow
May be out of date. Uploaded 8 years ago, in an area where tools change fast.

Intermediate. Assumes working knowledge.

503K views8 years ago1 recommendation

Security Web development PHP Web and application security Exploits and vulnerabilities

LiveOverflow walks through a PHP code-review puzzle to find and explain a critical vulnerability involving HMAC and type comparison.

This short php code contains a critical vulnerability. In this video I will explain in detail what I think while analysing it. LEARN ON HEXTREE (ad) Learn hacking on Hextree: hextree.io/ Watch this video and more on Hextree: app.hextree.io/courses/yt-websecurity/web-security-introduct… Join the Hextree Discord: discord.gg/xgQpCQCpvy Original source of challenge: securify.nl/en/blog/SFY20180101/spot-the-bug-challenge-2018-… Link to tweet: twitter.com/xxByte/status/951499972582703104 CHAPTERS - The PHP Code-Review Puzzle - Mapping User Input and the Code-Execution Sink - Treating HMAC as Strong and Tracing Backward - Exploring and Rejecting PHP Type Juggling - Following the Secret and Nonce Data Flow - Recognizing a Code Smell and Checking PHP Pitfalls - Controlling the PHP Input Type With an Array - hash_hmac Returns null for the Wrong Input Type - Predicting the HMAC and Building the Command Injection - Constructing the POST Body and Reviewing a Missed Check SUPPORT Per video: patreon.com/join/liveoverflow Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join Buy my handwriting font (ad): shop.liveoverflow.com/ WATCH, FOLLOW & READ Second channel: youtube.com/LiveUnderflow Twitch: twitch.tv/LiveOverflow/ Twitter: twitter.com/LiveOverflow/ Instagram: instagram.com/LiveOverflow/ TikTok: tiktok.com/@liveoverflow_ LiveOverflow blog: liveoverflow.com/ Hextree blog (ad): hextree.io/blog #CodeAudit #WebSecurity (ad) LiveOverflow YouTube channel is supported by advertisement and product placement.

Why it's here

1 person recommends this

What people say. Recommended as an excellent walkthrough of a PHP security vulnerability and the mindset needed for code review.