How we broke PHP, hacked Pornhub and earned $20k
1–10 of 107 posts
Re: How we broke PHP, hacked Pornhub and earned $20k
#2This is an elaborate hack and a very detailed writeup. Thanks for sharing.
Re: How we broke PHP, hacked Pornhub and earned $20k
#3Appears to be experiencing the hug of death. May be quite slow
Re: How we broke PHP, hacked Pornhub and earned $20k
#4OT: Is there a site that curates these kinds of interestingly detailed hacks? Like Dan Luu does for debugging stories? (https://github.com/danluu/debugging-stories)
Re: How we broke PHP, hacked Pornhub and earned $20k
#5Appears to be experiencing the hug of death. May be quite slow
Yes, thats sad.
There is more discussion about this here:
https://www.reddit.com/r/netsec/comments/4u86a4/how_we_broke...
Re: How we broke PHP, hacked Pornhub and earned $20k
#6wow
From a legal perspective how do companies and hackerone create a binding exemption from laws used to prosecute hackers?
Re: How we broke PHP, hacked Pornhub and earned $20k
#7Appears to be experiencing the hug of death. May be quite slow
I guess the site is served using PHP.
Re: How we broke PHP, hacked Pornhub and earned $20k
#8The takeway:
You should never use user input on unserialize. Assuming that
using an up-to-date PHP version is enough to protect
unserialize in such scenarios is a bad idea. Avoid it or use
less complex serialization methods like JSON.Re: How we broke PHP, hacked Pornhub and earned $20k
#9wow From a legal perspective how do companies and hackerone create a binding exemption from laws used to prosecute hackers?
> binding exception
Two words -- honor code. Rock the boat and you will find yourself in an unpleasant situation, so instead everybody does good work and nobody asks too many questions.
Re: How we broke PHP, hacked Pornhub and earned $20k
#10Appears to be experiencing the hug of death. May be quite slow