LiveOverflow
LiveOverflow
  • Видео 419
  • Просмотров 62 876 085
Finding The .webp Vulnerability in 8s (Fuzzing with AFL++)
A guide on how to do fuzzing with AFL++ in an attempt to rediscover the libwebp vulnerability CVE-2023-4863 that was used to hack iPhones.
Want to learn hacking? Signup to hextree.io (ad)
Buy my shitty font: shop.liveoverflow.com/ (ad)
Watch webp Part 1: ruclips.net/video/lAyhKaclsPM/видео.html
Sudo Vulnerability Series: ruclips.net/p/PLhixgUqwRTjy0gMuT4C3bmjeZjuNQyqdx
Docker Video: ruclips.net/video/-YnMr1lj4Z8/видео.html
OSS-Fuzz: github.com/google/oss-fuzz
OSS-Fuzz libwebp coverage: storage.googleapis.com/oss-fuzz-coverage/libwebp/reports/20230901/linux/src/libwebp/src/utils/report.html
AFLplusplus: github.com/AFLplusplus/AFLplusplus/blob/stable/docs/fuzzing_in_depth.md
vanhauser's blog: www.sr...
Просмотров: 54 368

Видео

A Vulnerability to Hack The World - CVE-2023-4863
Просмотров 105 тыс.6 месяцев назад
Citizenlab discovered BLASTPASS, a 0day being actively exploited in the image format WebP. Known as CVE-2023-4863 and CVE-2023-41064, an issue in webp's build huffman table function can lead to a heap buffer overflow. This vulnerability is very interesting and I'm excited to share with you what I learned. Want to learn hacking? Signup to hextree.io (ad) Buy my shitty font: shop.liveoverflow.com...
Reinventing Web Security
Просмотров 38 тыс.7 месяцев назад
Follow me down the rabbit hole into the wonderful world of IT security. Buy my terrible font (ad): shop.liveoverflow.com Learn hacking (ad): hextree.io Related Videos: ruclips.net/video/866olNIzbrk/видео.html ruclips.net/video/lKzsNp4AveY/видео.html Tweets: LiveOverflow/status/1720734431659376995 LiveOverflow/status/1720799912181284864 LiveOverflow/status/172...
The Circle of Unfixable Security Issues
Просмотров 112 тыс.8 месяцев назад
Not every security issues can be fixed. There exist (what I call) "unfixable" bugs, where you can always argue and shift the goal posts. The idea is to only report these kind of issues to create an endless stream of bug bounty money! Buy my terrible font (ad): shop.liveoverflow.com Learn hacking (ad): hextree.io What is a vulnerability? ruclips.net/video/866olNIzbrk/видео.html hackerone reports...
Hacker Tweets Explained
Просмотров 158 тыс.9 месяцев назад
Let me explain to you what you can learn from these tweets. Did you know the name trick? Buy my terrible font (ad): shop.liveoverflow.com Learn hacking (ad): hextree.io Quote Tweet: avlidienbrunn/status/1697869590569582932 Original Tweet: Rhynorater/status/1696862832841916679 Critical Thinking Podcast: www.criticalthinkingpodcast.io/ XSS Origin Series: ruclips.net/p/PLhi...
Zenbleed (CVE-2023-20593)
Просмотров 156 тыс.9 месяцев назад
Let's explore the "most exciting" CPU vulnerability affecting Zen2 CPUs from AMD. Watch part 1 about fuzzing: ruclips.net/video/neWc0H1k2Lc/видео.html buy my font (advertisement): shop.liveoverflow.com/ This video is sponsored by Google: security.googleblog.com/2023/08/downfall-and-zenbleed-googlers-helping.html Original Zenbleed Writeup: lock.cmpxchg8b.com/zenbleed.html Grab the code: github.c...
The Discovery of Zenbleed ft. Tavis Ormandy
Просмотров 61 тыс.10 месяцев назад
How did Tavis Ormandy fuzz CPUs to discover Zenbleed? In this video we learn about the techniques to make this work! Watch part 2: ruclips.net/video/9EY_9KtxyPg/видео.html buy my font (advertisement): shop.liveoverflow.com/ This video is sponsored by Google: security.googleblog.com/2023/08/downfall-and-zenbleed-googlers-helping.html Original Zenbleed Writeup: lock.cmpxchg8b.com/zenbleed.html AM...
Asking Android Developers About Security at Droidcon Berlin
Просмотров 34 тыс.10 месяцев назад
I attended droidcon Berlin 2023 and interviewed some developers about what they know about Android security. Thanks again to everybody who answered my questions, and thanks Egidijus for the dcbln23 ticket. Buy the terrible font (advertisement): shop.liveoverflow.com/ Watch my security conference vlog: ruclips.net/video/E9kz6RQu9Oc/видео.html Egidijus on Twitter: AegisLil droidcon: w...
Local Root Exploit in HospitalRun Software
Просмотров 68 тыс.11 месяцев назад
Let's talk about a "security flaw in hospital software that allows full access to medical devices". This issue was disclosed on LinkedIn and included a full exploit code. Let's use this app as an example on how to find a macOS privilege escalation and learn how local root exploits can work. Print BINGO sheet: liveoverflow/status/1682650394227351552 Sources: Original LinkedIn Post: w...
Android App Bug Bounty Secrets
Просмотров 96 тыс.11 месяцев назад
Sergey Toshin tells us the story of how he became a top Android bug hunter and how he finds critical vulnerabilities. He also shows us a really cool vulnerability found in the Google Android Snapseed app. I didn't know this crazy attack vector exists! Start Android Bug Hunting Here! Google App Scan Results: bughunters.google.com/report/targets/290590452 Google Mobile VRP: bughunters.google.com/...
Generic HTML Sanitizer Bypass Investigation
Просмотров 140 тыс.11 месяцев назад
I stumbled over a weird HTML behavior on Twitter and started to investigate it. Did I just stumble over a generic HTML Sanitizer bypass? Get my handwritten font shop.liveoverflow.com (advertisement) Checkout our courses on hextree.io (advertisement) The Tweet: MRCodedBrain/status/1662701541680136195 Google XSS: ruclips.net/video/lG7U3fuNw3A/видео.html HTML Spec: html.spec.whatwg.org...
Hacking Google Cloud?
Просмотров 123 тыс.Год назад
Every year Google celebrates the best security issues found in Google Cloud. This year we take a look at the 7 winners to see if we could have found these issues too. Will I regret not having hacked Google last year? This video is sponsored by Google VRP: Follow GoogleVRP Twitter: GoogleVRP The GCP Prize Winners of 2022: security.googleblog.com/2023/06/google-cloud-awards-313337-in-...
Trying to Find a Bug in WordPress
Просмотров 91 тыс.Год назад
I stumbled over some WordPress code involving caching. Immediately I had this idea about MD5 collision and how this could affect the implemented logic. I started going down a rabbit hole exploring the feasibility and eventually setting up a PHP debug environment. Only to realize that the idea was flawed from the start. So while this ends up being failed security research, we still learn a lot a...
Authentication Bypass Using Root Array
Просмотров 126 тыс.Год назад
Lots of #bugbountytips get posted on twitter, but some of them are ... weird. Let's explore the technical details of one tweet to understand where this tip came from, why this tip was wrong, and eventually learn about the real underlaying vulnerability. This is a surprising turn of events! advertisement: Get my handwritten font shop.liveoverflow.com Checkout our courses on hextree.io Authentica...
My YouTube Financials - The Future of LiveOverflow
Просмотров 104 тыс.Год назад
My RUclips Financials - The Future of LiveOverflow
Defending LLM - Prompt Injection
Просмотров 49 тыс.Год назад
Defending LLM - Prompt Injection
Accidental LLM Backdoor - Prompt Tricks
Просмотров 142 тыс.Год назад
Accidental LLM Backdoor - Prompt Tricks
Attacking LLM - Prompt Injection
Просмотров 367 тыс.Год назад
Attacking LLM - Prompt Injection
Our Future As Hackers Is At Stake!
Просмотров 66 тыс.Год назад
Our Future As Hackers Is At Stake!
Cyber Security Challenge Germany (2023)
Просмотров 21 тыс.Год назад
Cyber Security Challenge Germany (2023)
Cybercrime is Not Hacking!
Просмотров 78 тыс.Год назад
Cybercrime is Not Hacking!
Attacking Language Server JSON RPC
Просмотров 56 тыс.Год назад
Attacking Language Server JSON RPC
Advanced Teleport Hack (stolen from cheaters)
Просмотров 45 тыс.Год назад
Advanced Teleport Hack (stolen from cheaters)
VPNs, Proxies and Secure Tunnels Explained (Deepdive)
Просмотров 77 тыс.Год назад
VPNs, Proxies and Secure Tunnels Explained (Deepdive)
Velocity Exploit on Paper?
Просмотров 78 тыс.Год назад
Velocity Exploit on Paper?
Computer Networking (Deepdive)
Просмотров 105 тыс.Год назад
Computer Networking (Deepdive)
Revisiting 2b2t Tamed Animal Coordinate Exploit
Просмотров 62 тыс.Год назад
Revisiting 2b2t Tamed Animal Coordinate Exploit
What is a Protocol? (Deepdive)
Просмотров 158 тыс.Год назад
What is a Protocol? (Deepdive)
Can AI Create a Minecraft Hack?
Просмотров 609 тыс.Год назад
Can AI Create a Minecraft Hack?
Minecraft Reach Hack
Просмотров 101 тыс.Год назад
Minecraft Reach Hack

Комментарии

  • @lightingman117
    @lightingman117 День назад

    I don't understand why all the other video's I watched on this topic didn't just say go read RFC 791, RFC 9293, & RFC 9112 and now you know how things work. Thanks for finally clearing up how things actually work!

  • @ragdoll7477
    @ragdoll7477 День назад

    Step 1 watch robot s1and s4

  • @ragdoll7477
    @ragdoll7477 День назад

    The moment he said idk i was like whhhhhhhhhhhjhhaaattt this is most genuine answer lets watch more😂

  • @rcrotorfreak
    @rcrotorfreak 2 дня назад

    What if I send you a free phone sim? And you analyze it of traffic and such and post youtube of finding? These are free phone service called Safelink Wireless. Own by Tracfone which is own Verizon.

  • @sonic_the_hedgehog_channel
    @sonic_the_hedgehog_channel 2 дня назад

    Someone should hack a Minecraft smartwatch from Walmart and run doom because the answer is always yes it can

  • @lightblue254
    @lightblue254 2 дня назад

    Please do reenactments of historic bug discussions :D

  • @TwoThreeFour
    @TwoThreeFour 2 дня назад

    why this video is only available in 360p? 🤔

  • @nanakatz1492
    @nanakatz1492 3 дня назад

    Ok, what is a root? 😅 I am just starting out in IT and this video helped me a lot! I think what confused me the most really is that ‚server‘ is used for software AND hardware. So thanks for clearing that up! 💜

  • @oneloveafrica8860
    @oneloveafrica8860 3 дня назад

    am enjoin watching this but i didn't get it

  • @oneloveafrica8860
    @oneloveafrica8860 3 дня назад

    still am confuse 😪😪

  • @hashmatali9357
    @hashmatali9357 4 дня назад

  • @kooners6961
    @kooners6961 4 дня назад

    How did you get ghidra to recognize a stripped file?

  • @tdyrc
    @tdyrc 4 дня назад

    Cybercrime world is bigger than i thought lol

  • @tdyrc
    @tdyrc 4 дня назад

    Now that is some real Professional Dev Ops / Cybersecurity situation. As an it student i admire your knowledge.

  • @robertdreyfus5436
    @robertdreyfus5436 4 дня назад

    I must say, LiveOverflow demonstrates an uncommon intellect in this video. I've had a very enjoyable session on gdb this afternoon playing around with headers and binning on the heap. For those confused with the HEAP2 puzzle, simply write your own much shorter C program and play with it in gdb.

  • @user-pi2ym3qd7j
    @user-pi2ym3qd7j 4 дня назад

    im still confused

  • @adamdnewman
    @adamdnewman 6 дней назад

    Apple screws everyone

  • @dipannama
    @dipannama 6 дней назад

    At first glance I didn't get the video what was being taught in this video 4-5 years back as this was the first ever binary exploitation video that I had seen but now I can surely say that this is a gem for me as this video have given me the opportunity to deep dive into the world of binary exploitation/ reverse engineering field and now I can properly understand the concepts being taught in this video. Thank you @LiveOverflow :) because of you only I got to know about this field. Special shoutout to @JohnHammond also.

  • @shadowjr2000
    @shadowjr2000 7 дней назад

    I was about to leave this video at the half way point...I'm glad I didn't. Keep working hard👍

  • @kooners6961
    @kooners6961 7 дней назад

    can you share the test_stripped file?

  • @lionhack01
    @lionhack01 7 дней назад

    Some people might say why you promote anonymity over a RUclips video. However, it takes too much work to gain trust and credibility without your Instagram baby face coming to play. Thanks for educating me and others, and please let's focus on skills just as you described. Peace

  • @DanielRumba
    @DanielRumba 7 дней назад

    Can I bypass router login page

  • @gustavorosas-dev
    @gustavorosas-dev 7 дней назад

    Melhor relatório que eu já vi (1:51): "Verificou-se que o site carece de qualquer forma de proteção. Basta enviar 'Por favor, deixe-me entrar' e o site gerará um shell com permissões de root." Ri muito aqui.

  • @JohnFrum-k7g
    @JohnFrum-k7g 8 дней назад

    So you are saying don't use my network password as my displayed router name before my home address publicly visible?? Ok can I write it on my computer with my financial info? Breh not to the memory don't be ridiculous with a sharpie near my keyboard that I keep outside on my porch on top of my social security and birth certificate, I keep it there so my credit cards do not blow away. I'm not stupid guys I got this.

  • @anggorodhanumurti1956
    @anggorodhanumurti1956 8 дней назад

    dude im a radare master

  • @Passwordforgetter69
    @Passwordforgetter69 8 дней назад

    Bro went through the five or what stages of grief 💀

  • @sTL45oUw
    @sTL45oUw 8 дней назад

    The challenge is not hard you are just not very skilled.

  • @a_aronhdtech1328
    @a_aronhdtech1328 9 дней назад

    Off subject. What software do you use to edit your videos? Thanks

  • @thestuffman8783
    @thestuffman8783 9 дней назад

    After 5 years I've finally got the courage to dive into this lol. It still works (with a few easy fixes) on ubuntu 24.04 as well as docker 24.0.5 and docker-compose v2.20.3 Excited to see what I can do with this :D

  • @Capiosus
    @Capiosus 9 дней назад

    theres a command called “fromanticheat” which is weird because the save file is so easy to hack

  • @mohamedshahrul1750
    @mohamedshahrul1750 9 дней назад

    @4:47 the comment says decrypt but the arrow says encryption. its confusing to me.

  • @ivancamiloarandac.2998
    @ivancamiloarandac.2998 9 дней назад

    lateral movement!

  • @alo1236546
    @alo1236546 10 дней назад

    Solder 1 pin and align the header, the go the rest

  • @marios4275
    @marios4275 10 дней назад

  • @oneloveafrica8860
    @oneloveafrica8860 10 дней назад

    in today there is pwndbg for that trick 🤣🤣🤣🤣

  • @oneloveafrica8860
    @oneloveafrica8860 11 дней назад

    I hate the classical

  • @maray97
    @maray97 11 дней назад

    Thank you for the tutorial, clear as always. I am trying to replicate the CVE in a Docker container, however, when I run sudoedit -s 'AAAAAAAAAAAA\' I get vim opened. I cannot understand why. Could you please help me? I am running Ubuntu 18.04 and. sudo1.9.5p1 (the version before the patch)

  • @ramprasadmuppana5002
    @ramprasadmuppana5002 11 дней назад

    Dude, i'm totally confused....😢

  • @ElrondTheGreat
    @ElrondTheGreat 11 дней назад

    Even though my first language is Persian and my English isn't perfect, it's clear how passionate you are about the mechanics. Your teaching is really deep and insightful. As a Minecraft fan and a computer science student who's also into programming and security, I find your content super valuable and enjoyable. Thanks for sharing your knowledge!

  • @ElrondTheGreat
    @ElrondTheGreat 11 дней назад

    Even though my first language is Persian and my English isn't perfect, it's clear how passionate you are about the mechanics. Your teaching is really deep and insightful. As a Minecraft fan and a computer science student who's also into programming and security, I find your content super valuable and enjoyable. Thanks for sharing your knowledge!

  • @anggorodhanumurti1956
    @anggorodhanumurti1956 11 дней назад

    im disapointed that you cant realy patch binnary with ghidra😢

  • @lexikiq
    @lexikiq 12 дней назад

    i miss this series 😭

  • @flrn84791
    @flrn84791 12 дней назад

    zero day exploit 😂

  • @LiEnby
    @LiEnby 12 дней назад

    Ik there was some myspace worm that used an XSS issue ..

  • @leocapuano2176
    @leocapuano2176 12 дней назад

    great explanation! Anyway I would make another call to the LLM asking it to detect a possibile injection before proceding with the main question

  • @mikaay4269
    @mikaay4269 13 дней назад

    square bear

  • @mikaay4269
    @mikaay4269 13 дней назад

    jalapenos :)

  • @mikaay4269
    @mikaay4269 13 дней назад

    Anyone else find it funny how his hostname is redstar-os?

  • @joeblowme
    @joeblowme 14 дней назад

    "and hack the planet"

  • @ruinedbectorem2254
    @ruinedbectorem2254 14 дней назад

    Still a classic.