Intro To Hacked & Secured: Pentest Exploits & Mitigations – What To Expect! Hacked & Secured: Pentest Exploits & Mitigations podcast

Player FM - Internet Radio Done Right

اضافه شده در twenty-seven هفته پیش

محتوای ارائه شده توسط Amin Malekpour. تمام محتوای پادکست شامل قسمت‌ها، گرافیک‌ها و توضیحات پادکست مستقیماً توسط Amin Malekpour یا شریک پلتفرم پادکست آن‌ها آپلود و ارائه می‌شوند. اگر فکر می‌کنید شخصی بدون اجازه شما از اثر دارای حق نسخه‌برداری شما استفاده می‌کند، می‌توانید روندی که در اینجا شرح داده شده است را دنبال کنید.https://fa.player.fm/legal

Untold Stories: Life with a Severe Autoimmune Condition

1
Finding Your Voice In the Healthcare System 30:52

14 روز پیش30:52

پخش در آینده

لیست ها

پسندیدن

دوست داشته شد

30:52

Jasmine is a career coach, wife, and mother who is newly diagnosed with CIDP but no stranger to fighting for her health. After years of navigating lupus and rheumatoid arthritis, Jasmine learned how to push back, speak up, and keep going. Join Martine for the season 4 premiere as Jasmine shares what it’s like to face a new diagnosis mid-journey, and why she refuses to stay silent. See omnystudio.com/listener for privacy information.…

Hacked & Secured: Pentest Exploits & Mitigations «
Intro to Hacked & Secured: Pentest Exploits & Mitigations – What to Expect!

حدود یک سال پیش 2:28

اشتراک گذاری

MP3•خانه قسمت

If you know how attacks work, you’ll know exactly where to look—whether you’re breaking in as an ethical hacker or defending as a blue teamer.

Welcome to Hacked & Secured: Pentest Exploits & Mitigations—the podcast that breaks down real-world pentest findings and exposes critical security flaws before attackers do.

Red team tactics – How vulnerabilities are found and exploited.
Blue team defenses – How to detect, mitigate, and prevent attacks.
Real pentest insights – Lessons from bug bounty reports, security blogs, and private pentests.

New episodes every two weeks. Follow to stay ahead of evolving threats.

Let’s make security knowledge accessible to all!

Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description, and we might showcase your finding in an upcoming episode!
🌍 Follow & Connect → LinkedIn, YouTube, Twitter, Instagram
📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A
📧 Feedback? Email Us → podcast@quailu.com.au
🔗 Podcast Website → Website Link

12 قسمت

#Tech #Careers #Business #Penetration Testing #Bug Bounty #Ethical Hacking #Web Security #Application Security #Offensive Security #Podcasting Education #Amin Malekpour #DevSecOps #Secure Coding #Security Hardening #Secure Software Development #Security Best Practices #Red Team

Intro to Hacked & Secured: Pentest Exploits & Mitigations – What to Expect!

Hacked & Secured: Pentest Exploits & Mitigations

published حدود یک سال پیش

اشتراک گذاری

MP3•خانه قسمت

If you know how attacks work, you’ll know exactly where to look—whether you’re breaking in as an ethical hacker or defending as a blue teamer.

Welcome to Hacked & Secured: Pentest Exploits & Mitigations—the podcast that breaks down real-world pentest findings and exposes critical security flaws before attackers do.

Red team tactics – How vulnerabilities are found and exploited.
Blue team defenses – How to detect, mitigate, and prevent attacks.
Real pentest insights – Lessons from bug bounty reports, security blogs, and private pentests.

New episodes every two weeks. Follow to stay ahead of evolving threats.

Let’s make security knowledge accessible to all!

12 قسمت

همه قسمت ها

1
Ep. 11 – Account Takeover, Token Misuse, and Deserialization RCE: When Trust Goes Wrong 17:15

12 روز پیش17:15

17:15

One flawed password reset. One shared session token. One dangerous object. In Episode 11 of Hacked & Secured: Pentest Exploits & Mitigations , we break down three real-world vulnerabilities where trust between systems and users broke down—with serious consequences. Account Takeover via Forgot Password – A predictable ID and exposed tokens let attackers reset passwords without access to email. Session Hijack in OTP Login – A logic flaw in how login tokens were handled allowed full account access with just a user ID. Remote Code Execution via Java Deserialization – A community-contributed finding where an exposed service deserialized untrusted input, leading to code execution. These aren’t complex chains. They’re common mistakes with big impact—and important lessons for developers, security teams, and testers. Chapters: 00:00 - INTRO 00:59 - FINDING #1 - Account Takeover via Forgot Password 06:26 - FINDING #2 - Shared Session Token in SMS Login Flow 10:39 - FINDING #3 - Java Deserialisation to Remote Code Execution 16:13 - OUTRO Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description , and we might showcase your finding in an upcoming episode! 🌍 Follow & Connect → LinkedIn , YouTube , Twitter , Instagram 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au 🔗 Podcast Website → Website Link…

1
Ep. 10 – Cookie XSS & Image Upload RCE: One Cookie, One File, Full Control 20:12

۶ weeks پیش20:12

20:12

One cookie set on a subdomain triggered XSS and stole session tokens. One fake image upload gave the attacker a reverse shell. This episode breaks down two powerful exploits—a cookie-based XSS that bypassed frontend protections, and an RCE through Ghostscript triggered by a disguised PostScript file. Learn how subtle misconfigurations turned everyday features into full account and server compromise. Chapters: 00:00 - INTRO 01:08 - FINDING #1 - Cookie-Controlled XSS 12:19 - FINDING #2 - Image Upload to RCE via Ghostscript 19:03 - OUTRO Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description , and we might showcase your finding in an upcoming episode! 🌍 Follow & Connect → LinkedIn , YouTube , Twitter , Instagram 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au 🔗 Podcast Website → Website Link…

1
Ep. 9 – Directory Traversal & LFI: From File Leaks to Full Server Crash 25:05

10 weeks پیش25:05

25:05

One markdown link copied server files. One poisoned log triggered remote code execution. One LFI crashed the entire server. In this episode, we unpack three real-world exploits—directory traversal and local file inclusion flaws that went far beyond file reads. From silent data leaks to full server compromise, these attacks all started with a single trusted path. Chapters: 00:00 - INTRO 01:07 - FINDING #1 - Server File Theft with Directory Traversal 09:23 - FINDING #2 - From File Inclusion to RCE via Log Poisoning 16:20 - FINDING #3 - LFI to Server Crash 24:09 - OUTRO Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description , and we might showcase your finding in an upcoming episode! 🌍 Follow & Connect → LinkedIn , YouTube , Twitter , Instagram 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au 🔗 Podcast Website → Website Link…

1
Ep. 8 – OTP Flaw & Remote Code Execution: When Small Flaws Go Critical 15:45

15 weeks پیش15:45

15:45

A broken logout flow let attackers hijack accounts using just a user ID. A self-XSS and an IDOR exposed stored data. And a forgotten internal tool—running outdated software—ended in full Remote Code Execution. This episode is all about how small bugs, missed checks, and overlooked services can lead to serious consequences. Chapters: 00:00 - INTRO 01:22 - FINDING #1 - The Logout That Logged You In 07:12 - FINDING #2 - From Signature Field to Shell Access 14:40 - OUTRO Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description , and we might showcase your finding in an upcoming episode! 🌍 Follow & Connect → LinkedIn , YouTube , Twitter , Instagram 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au 🔗 Podcast Website → Website Link…

1
Ep. 7 – IDOR & SSTI: From File Theft to Server-Side Secrets 19:35

17 weeks پیش19:35

19:35

A predictable ID exposed private documents. A crafted name leaked backend files. In this episode, we break down two high-impact flaws—an IDOR that let attackers clone confidential attachments, and an SSTI hidden in an email template that revealed server-side files. Simple inputs, big consequences. Learn how they worked, why they were missed, and how to stop them. Chapters: 00:00 - INTRO 01:28 - FINDING #1 – IDOR to Steal Confidential Files with Just an Attachment ID 09:05 - FINDING #2 – Server-Side Template Injection That Leaked Local Files 18:41 - OUTRO Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description , and we might showcase your finding in an upcoming episode! 🌍 Follow & Connect → LinkedIn , YouTube , Twitter , Instagram 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au 🔗 Podcast Website → Website Link…

1
Ep. 6 – 403 Bypass & Request Smuggling: Tiny Tricks, Total Takeover 17:14

19 weeks پیش17:14

17:14

A single uppercase letter unlocked an admin panel. One malformed request hijacked user sessions. In this episode, we break down two real-world exploits—a 403 bypass and a request smuggling attack—that turned small oversights into full system compromise. Learn how they worked, why they were missed, and what should have been done differently. Chapters: 00:00 - INTRO 01:18 - FINDING #1 – The 403 Bypass That Led to Full Admin Control 08:17 - FINDING #2 – Smuggling Requests, Hijacking Responses 16:35 - OUTRO Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description , and we might showcase your finding in an upcoming episode! 🌍 Follow & Connect → LinkedIn , YouTube , Twitter , Instagram 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au 🔗 Podcast Website → Website Link…

1
Ep. 5 – Stored XSS & SQL Injection: Small Flaws, Big Breaches 16:08

21 weeks پیش16:08

16:08

A simple filename triggered stored XSS, hijacking accounts and stealing API keys. A SQL injection bypassed a web firewall, dumping an entire database in one request. Both attacks exploited basic security flaws—flaws that should have been caught. Learn how these exploits worked, why they were missed, and what should have been done differently. Chapters: 0:00 - INTRO 01:39 - FINDING #1 – Stored XSS That Took Over User Accounts 07:14 - FINDING #2 – The SQL Injection That Bypassed a Firewall and Dumped the Entire Database 15:22 - OUTRO Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description , and we might showcase your finding in an upcoming episode! 🌍 Follow & Connect → LinkedIn , YouTube , Twitter , Instagram 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au 🔗 Podcast Website → Website Link…

1
Ep. 4 – Exposed Secrets & Silent Takeovers: How Misconfigurations Open the Door to Attackers 21:15

23 weeks پیش21:15

21:15

Exposed secrets, overlooked permissions, and credentials hiding in plain sight—each one leading to a critical breach. In this episode, we break down three real-world pentest findings where a forgotten file, a misconfigured setting, and a leaked credential gave attackers full control. How did they happen? How can you find similar issues? And what can be done to stop them? Listen now to learn how attackers exploit these mistakes—and how you can prevent them. Chapters: 00:00 - INTRO 01:00 - FINDING #1 - How a Forgotten File Exposed Private Repositories 06:37 - FINDING #2 - How Misconfigured Permissions Led to Full System Takeover 14:35 - FINDING #3 - The Credentials That Gave Access to a Network Switch 20:31 - OUTRO Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description , and we might showcase your finding in an upcoming episode! 🌍 Follow & Connect → LinkedIn , YouTube , Twitter , Instagram 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au 🔗 Podcast Website → Website Link…

1
Ep. 3 – One Request, One URL, One Bluetooth Hack: Three Takeovers That Shouldn’t Have Happened 21:30

25 weeks پیش21:30

21:30

How can attackers take over accounts, networks, and devices—without credentials? In this episode, we break down three real-world security flaws that prove authentication alone isn’t enough: Account Takeover – A single request bypassed email verification, locking out store owners. Internal Network Compromise – A hidden admin URL and hardcoded access key gave attackers full control. Smart Device Hijack – A community-submitted finding reveals how Bluetooth vulnerabilities allowed remote command execution— without WiFi, passwords, or internet access. These findings expose critical weaknesses in application security, network defense, and IoT device protection—problems that pentesters, developers, and security teams must identify before attackers do. Chapters: 00:00 - INTRO 01:30 - FINDING #1 - How a Security Researcher Took Over an Entire Shopping Platform with Just One Request 07:25 - FINDING #2 - How a Security Researcher Hacked an Entire Internal Network with Just One URL 13:46 - FINDING #3 - How a Security Researcher Took Over a Smart Switch Using Just Bluetooth 20:47 - OUTRO Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description , and we might showcase your finding in an upcoming episode! 🌍 Follow & Connect → LinkedIn , YouTube , Twitter , Instagram 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au 🔗 Podcast Website → Website Link…

1
Ep. 2 – Chaining IDORs, CSRF Account Takeovers & Token Manipulation for Privilege Escalation 19:16

27 weeks پیش19:16

19:16

What if you could take over an account—not by cracking a password, but by chaining two overlooked vulnerabilities? What if a single CSRF exploit let attackers reset security questions and hijack accounts? And what if manipulating an authorization token could escalate privileges? In this episode of Hacked & Secured: Pentest Exploits & Mitigations , we break down three real-world pentest findings that prove creative exploitation turns small flaws into critical security risks: Chaining IDORs for account takeover – Exploiting weak access controls. CSRF bypass to reset security questions – Turning one click into total compromise. Privilege escalation via token manipulation – How a simple change led to admin access. Learn how these vulnerabilities were discovered, exploited, and mitigated. Chapters: 00:00 - INTRO 01:02 - FINDING #1 - Account Takeover by Chaining Two IDORs 07:19 - FINDING #2 - Account Takeover Through CSRF Vulnerability in Security Questions 12:18 - FINDING #3 - Privilege Escalation Through Authorization Token Manipulation 17:05 - OUTRO Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description , and we might showcase your finding in an upcoming episode! 🌍 Follow & Connect → LinkedIn , YouTube , Twitter , Instagram 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au 🔗 Podcast Website → Website Link…

1
Ep. 1 – Breaking OTP Security, Exploiting Static Domains & Privilege Escalation via Role Misconfigurations 19:12

27 weeks پیش19:12

19:12

What if your OTP security wasn’t secure at all? What if a static domain—something most people ignore—could lead to full account takeover? And what if flawed role management allowed admins to escalate privileges? In this episode of Hacked & Secured: Pentest Exploits & Mitigations , we break down three real-world security failures that turned minor oversights into critical exploits: Leaking OTPs in API responses – Breaking authentication at the source. Static domain to account takeover – When persistence turns into a full exploit. Privilege escalation via role mismanagement – How attackers bypass access controls. Learn how these vulnerabilities were discovered, exploited, and mitigated. Chapters: 00:00 - INTRO 01:00 - FINDING #1 - The Vulnerability That Defeats OTP Security: Leaking OTP Codes in API Responses 05:20 - FINDING #2 - From Static Domain to Account Takeover: The Power of Persistence 12:05 - FINDING #3 - Privilege Escalation via User Invitations and Role Assignment 16:49 - OUTRO Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description , and we might showcase your finding in an upcoming episode! 🌍 Follow & Connect → LinkedIn , YouTube , Twitter , Instagram 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au 🔗 Podcast Website → Website Link…

1
Intro to Hacked & Secured: Pentest Exploits & Mitigations – What to Expect! 2:28

27 weeks پیش2:28

2:28

If you know how attacks work, you’ll know exactly where to look—whether you’re breaking in as an ethical hacker or defending as a blue teamer. Welcome to Hacked & Secured: Pentest Exploits & Mitigations —the podcast that breaks down real-world pentest findings and exposes critical security flaws before attackers do. Red team tactics – How vulnerabilities are found and exploited. Blue team defenses – How to detect, mitigate, and prevent attacks. Real pentest insights – Lessons from bug bounty reports, security blogs, and private pentests. New episodes every two weeks. Follow to stay ahead of evolving threats. Let’s make security knowledge accessible to all! Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description , and we might showcase your finding in an upcoming episode! 🌍 Follow & Connect → LinkedIn , YouTube , Twitter , Instagram 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au 🔗 Podcast Website → Website Link…

به Player FM خوش آمدید!

Player FM در سراسر وب را برای یافتن پادکست های با کیفیت اسکن می کند تا همین الان لذت ببرید. این بهترین برنامه ی پادکست است که در اندروید، آیفون و وب کار می کند. ثبت نام کنید تا اشتراک های شما در بین دستگاه های مختلف همگام سازی شود.

به بیش از 500 موضوع گوش کنید

Bounty Paper Towels Quick Size, White, 16 Family Rolls = 40 Regular Rolls

Apple 2025 MacBook Air 13-inch Laptop with M4 chip: Built for Apple Intelligence, 13.6-inch Liquid Retina Display, 16GB Unified Memory, 256GB SSD Storage, 12MP Center Stage Camera, Touch ID; Midnight

Amazon eGift Card - Bright Balloons (Animated)

Tubi: Watch Free Movies & TV Shows

Minecraft

Bounty Quick Size Paper Towels, White, 8 Family Rolls = 20 Regular Rolls

Mini Mic Pro (Latest Model) - Professional Wireless Microphone for iPhone, iPad, Android, Lavalier Microphone for Video Recording - iPhone Mic Crystal Clear Recording with USB-C for Content Creators

Crayola Colored Pencils (36ct), Kids Pencil Set, Back to School Essentials, Must Have Classroom Supplies for Kids, Pre-Sharpened Coloring Book Pencils, 3+

Microsoft Office Home 2024 | Classic Apps: Word, Excel, PowerPoint | One-Time Purchase for 1 PC/MAC | Instant Download | Formerly Home & Student 2021 [PC/Mac Online Code]

پادکست هایی که ارزش شنیدن دارند

1
Finding Your Voice In the Healthcare System 30:52

Hacked & Secured: Pentest Exploits & Mitigations «
Intro to Hacked & Secured: Pentest Exploits & Mitigations – What to Expect!

Intro to Hacked & Secured: Pentest Exploits & Mitigations – What to Expect!

پادکست هایی که ارزش شنیدن دارند

همه قسمت ها

1
Ep. 11 – Account Takeover, Token Misuse, and Deserialization RCE: When Trust Goes Wrong 17:15

1
Ep. 10 – Cookie XSS & Image Upload RCE: One Cookie, One File, Full Control 20:12

1
Ep. 9 – Directory Traversal & LFI: From File Leaks to Full Server Crash 25:05

1
Ep. 8 – OTP Flaw & Remote Code Execution: When Small Flaws Go Critical 15:45

1
Ep. 7 – IDOR & SSTI: From File Theft to Server-Side Secrets 19:35

1
Ep. 6 – 403 Bypass & Request Smuggling: Tiny Tricks, Total Takeover 17:14

1
Ep. 5 – Stored XSS & SQL Injection: Small Flaws, Big Breaches 16:08

1
Ep. 4 – Exposed Secrets & Silent Takeovers: How Misconfigurations Open the Door to Attackers 21:15

1
Ep. 3 – One Request, One URL, One Bluetooth Hack: Three Takeovers That Shouldn’t Have Happened 21:30

1
Ep. 2 – Chaining IDORs, CSRF Account Takeovers & Token Manipulation for Privilege Escalation 19:16

1
Ep. 1 – Breaking OTP Security, Exploiting Static Domains & Privilege Escalation via Role Misconfigurations 19:12

1
Intro to Hacked & Secured: Pentest Exploits & Mitigations – What to Expect! 2:28

به Player FM خوش آمدید!

Elmer's Disappearing Purple School Glue Sticks Washable 6 Grams 12 Count

My Friends: A Novel

KPop Demon Hunters (Soundtrack from the Netflix Film)

Zevo Flying Insect Trap & Cartridge - Plug in Fly Trap & Indoor Bug Catcher for Gnats, House & Fruit Flies - Mess-Free - Use in Any Room - Uses Blue & UV Light (1 Plug in Device & 1 Cartridge)

Peacock TV

Crayola Broad Line Markers (12 Count), Washable Markers for Kids, Assorted, Back to School Essentials, Teacher Classrooms Must Have, School Supplies, 3+

Norton 360 Premium 2025, Antivirus software for 10 Devices with Auto-Renewal – Includes Advanced AI Scam Protection, VPN, Dark Web Monitoring & PC Cloud Backup [Download]

Amazon Fire TV Stick 4K (newest model) with AI-powered Fire TV Search, Wi-Fi 6, stream over 1.8 million movies and shows, free & live TV

Elmer's Disappearing Purple School Glue Sticks Washable 22 Grams 3 Count

Alpha Grillers Meat Thermometer Digital - Instant Read Food Thermometer for Cooking Grilling Air Fryer Griddle Probe Kitchen Gadgets Essentials BBQ Accessories Grill Gifts for Men Him Dad Birthday

Ernie Ball Regular Slinky Nickel Wound Electric Guitar Strings, 10-46 Gauge (P02221)

Bounty Paper Towels Quick Size, White, 16 Family Rolls = 40 Regular Rolls

Apple 2025 MacBook Air 13-inch Laptop with M4 chip: Built for Apple Intelligence, 13.6-inch Liquid Retina Display, 16GB Unified Memory, 256GB SSD Storage, 12MP Center Stage Camera, Touch ID; Midnight

Amazon eGift Card - Bright Balloons (Animated)

پادکست هایی که ارزش شنیدن دارند

Hacked & Secured: Pentest Exploits & Mitigations « Intro to Hacked & Secured: Pentest Exploits & Mitigations – What to Expect!

Intro to Hacked & Secured: Pentest Exploits & Mitigations – What to Expect!

پادکست هایی که ارزش شنیدن دارند

به Player FM خوش آمدید!

Elmer's Disappearing Purple School Glue Sticks Washable 6 Grams 12 Count

Norton 360 Premium 2025, Antivirus software for 10 Devices with Auto-Renewal – Includes Advanced AI Scam Protection, VPN, Dark Web Monitoring & PC Cloud Backup [Download]

Amazon Fire TV Stick 4K (newest model) with AI-powered Fire TV Search, Wi-Fi 6, stream over 1.8 million movies and shows, free & live TV

Elmer's Disappearing Purple School Glue Sticks Washable 22 Grams 3 Count

راهنمای مرجع سریع

Hacked & Secured: Pentest Exploits & Mitigations «
Intro to Hacked & Secured: Pentest Exploits & Mitigations – What to Expect!