"How we broke PHP, hacked Pornhub and earned $20,000"

This is a very interesting read on how Dario Weißer (@haxonaut), cutz and Ruslan Habalov (@evonide) were able to find a PHP unserialize bug to exploit and gain remote code execution on Pornhub. Pornhub’s bug bounty program is at Hackerone. Instead of actively attacking Pornhub, they took another road and attacked what Pornhub is built upon: PHP.

Read on at evonide.com: How we broke PHP, hacked Pornhub and earned $20,000.

Exploit PHP's mail() to get remote code execution Web application security
Grep for forensic log parsing and analysis on Windows Server… Web application security
Disallow direct access to PHP files in wp-content/uploads/ Web application security
Custom PHP version on IIS Express and WebMatrix 3 Windows Server
Huge increase in WordPress xmlrpc.php POST requests WordPress
Convert PHP ext/mysql to MySQLi Code base

Share this post

Twitter Facebook LinkedIn Email Reddit

“How we broke PHP, hacked Pornhub and earned $20,000”

Related Posts

Share this post