Freek.dev

Recently Taylor Otwell held a blogging competition. Entries could be submitted on a GitHub repo, the post with the highest amount of ? would win. My colleague Alex wrote a blogpost on how you could easily win the competition by hacking a bit. It's pretty awesome that Alex, without using any of the hacks described in the post, wound up winning the competition.

I feel like programmers are often as good at breaking things as they are at fixing things. Part of the thought process of programming anything new is figuring out its flaws, weaknesses and possible exploitations. As a web developer, I often find myself applying the same thought process to everything I see and read about online. Including Laravel's May Mayhem blog contest.

Read more [alexvanderbist.com]

Aaron Saray recently found some rogue code on a hacked website and investigated what it actually does.

It’s hard to come up with a title for this - but - basically I found some rogue code the other day that I thought was pretty interesting. I was fixing a “hacked” website when I came across the source of the symptoms of the hack.

This obfuscated code is doing something bad, but we don’t know what at first glance. Obviously, the solution is to remove it - but - aren’t you a little curious what it was doing? Let’s take a look.

https://aaronsaray.com/2017/anatomy-of-a-php-hack.html

Read more

In the beginning of the summer the Belgian company PHPro held a cool hacking contest. The persons the could hack a special site that they had set up could win a prize. Yesterday they published an interesting article on how that site could be hacked. The site was also hacked in ways that the developers of the company did not anticipate.

Since this contest started out as an internal project, we've put a lot of focus on the flow on how to hack the website. It was just a little side project to inform our colleagues that some small mistakes can end up in a big catastrophe. By focussing on the flow of the hackme contest, we forgot to secure the application for malicious contestants. Off course, this was something that fired back to us on the first days of the competition. Here is a little write-up of the problems we've encountered and how we fixed them.

http://phpro.be/news/hackme-results

Read more