『Hacked & Secured: Pentest Exploits & Mitigations』のカバーアート

Hacked & Secured: Pentest Exploits & Mitigations

Hacked & Secured: Pentest Exploits & Mitigations

著者： Amin Malekpour
無料で聴く

このコンテンツについて

If you know how attacks work, you’ll know exactly where to look—whether you’re breaking in as an ethical hacker or defending as a blue teamer.

Hacked & Secured: Pentest Exploits & Mitigations breaks down real-world pentest findings, exposing how vulnerabilities were discovered, exploited, and mitigated.

Each episode dives into practical security lessons, covering attack chains and creative exploitation techniques used by ethical hackers. Whether you're a pentester, security engineer, developer, or blue teamer, you'll gain actionable insights to apply in your work.


🎧 New episodes every month.


🌍 Follow & Connect → LinkedIn, YouTube, Twitter, Instagram, Website Link


📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A

📧 Feedback? Email Us → podcast@quailu.com.au

© 2025 Hacked & Secured: Pentest Exploits & Mitigations 出世 就職活動 経済学
エピソード
  • Ep. 11 – Account Takeover, Token Misuse, and Deserialization RCE: When Trust Goes Wrong

    Ep. 11 – Account Takeover, Token Misuse, and Deserialization RCE: When Trust Goes Wrong
    2025/07/24

    One flawed password reset. One shared session token. One dangerous object.

    In Episode 11 of Hacked & Secured: Pentest Exploits & Mitigations, we break down three real-world vulnerabilities where trust between systems and users broke down—with serious consequences.

    • Account Takeover via Forgot Password – A predictable ID and exposed tokens let attackers reset passwords without access to email.
    • Session Hijack in OTP Login – A logic flaw in how login tokens were handled allowed full account access with just a user ID.
    • Remote Code Execution via Java Deserialization – A community-contributed finding where an exposed service deserialized untrusted input, leading to code execution.

    These aren’t complex chains. They’re common mistakes with big impact—and important lessons for developers, security teams, and testers.

    Chapters:

    00:00 - INTRO

    00:59 - FINDING #1 - Account Takeover via Forgot Password

    06:26 - FINDING #2 - Shared Session Token in SMS Login Flow

    10:39 - FINDING #3 - Java Deserialisation to Remote Code Execution

    16:13 - OUTRO

    Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description, and we might showcase your finding in an upcoming episode!

    🌍 Follow & Connect → LinkedIn, YouTube, Twitter, Instagram
    📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A
    📧 Feedback? Email Us → podcast@quailu.com.au
    🔗 Podcast Website → Website Link

    続きを読む 一部表示
    17 分
  • Ep. 10 – Cookie XSS & Image Upload RCE: One Cookie, One File, Full Control

    Ep. 10 – Cookie XSS & Image Upload RCE: One Cookie, One File, Full Control
    2025/06/26

    One cookie set on a subdomain triggered XSS and stole session tokens. One fake image upload gave the attacker a reverse shell.

    This episode breaks down two powerful exploits—a cookie-based XSS that bypassed frontend protections, and an RCE through Ghostscript triggered by a disguised PostScript file.

    Learn how subtle misconfigurations turned everyday features into full account and server compromise.

    Chapters:

    00:00 - INTRO

    01:08 - FINDING #1 - Cookie-Controlled XSS

    12:19 - FINDING #2 - Image Upload to RCE via Ghostscript

    19:03 - OUTRO

    Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description, and we might showcase your finding in an upcoming episode!

    🌍 Follow & Connect → LinkedIn, YouTube, Twitter, Instagram
    📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A
    📧 Feedback? Email Us → podcast@quailu.com.au
    🔗 Podcast Website → Website Link

    続きを読む 一部表示
    20 分
  • Ep. 9 – Directory Traversal & LFI: From File Leaks to Full Server Crash

    Ep. 9 – Directory Traversal & LFI: From File Leaks to Full Server Crash
    2025/05/29

    One markdown link copied server files. One poisoned log triggered remote code execution. One LFI crashed the entire server.
    In this episode, we unpack three real-world exploits—directory traversal and local file inclusion flaws that went far beyond file reads. From silent data leaks to full server compromise, these attacks all started with a single trusted path.

    Chapters:

    00:00 - INTRO

    01:07 - FINDING #1 - Server File Theft with Directory Traversal

    09:23 - FINDING #2 - From File Inclusion to RCE via Log Poisoning

    16:20 - FINDING #3 - LFI to Server Crash

    24:09 - OUTRO

    Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description, and we might showcase your finding in an upcoming episode!

    🌍 Follow & Connect → LinkedIn, YouTube, Twitter, Instagram
    📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A
    📧 Feedback? Email Us → podcast@quailu.com.au
    🔗 Podcast Website → Website Link

    続きを読む 一部表示
    25 分
まだレビューはありません