Solving a Hard Google CTF challenge - "Paste-tastic!"

[@TinyMeatPete]

as a British man, hearing somone say "heres a nonce" in an excited voice is funny to me. Other than that, the video was great

[@sk8erman069]

It’s great to see members of the info sec community work together to solve these complex problems. I’m excited to see more videos like this and can’t wait to see more on your new series on your binary exploitation journey!

[@Owen-bk5fc]

When you described how the XSS Auditor worked, I couldn't for the life of me figure out how someone thought that was a good idea. It seems so obviously exploitable.

[@cat-.-]

This really reminds me how web is a congo line of crazy features (XSS auditor) followed by lunatic legacy behaviours (clobbering) melting each other down lol

[@nikkiofthevalley]

Sounds like my code

[@fsacer]

I like the idea of the required concepts section 👌

[@Omikoshi78]

Knowing dom clobbering, xss auditor tricks, cross domain vectors, etc I could have solved this relatively quickly but I’ve also been in this field for a loong time. Since before there even were classes at uni teaching computer security. This was a insane challenge for anyone that didn’t encounter these techniques before.

[@leftyyyyyyyy]

why does this channel have so little subscribers? This content deserves much more appreciation and recognition

[@FennecTECH]

It just proves that security is **HARD**

[@justadam3536]

I love how your videos are so chill and nice to watch

[@vic2734]

This content is amazing man! Keep it coming

[@KngSovereign]

1:20 - I am totally that one guy that just stumbled upon your videos randomly 😅

[@王越卿]

I am curious more about how you made this awesome style of this tutor

[@vistimalik2879]

Very good video keep up the good work 👌😊

[@nitzan917]

Very well made. Great job!

[@hupa1a]

Great video! So well explained!

[@RickKotlarz]

Greate explanation and video demo. You may want to update the video description to highlight these various attack techniques.

[@Faraz9023]

Please upload more often! Love your videos!

[@harshjaiswal1245]

Awesome stuff as always! :D

[@Joe_Payne]

I'm that one person who doesn't know who live overflow is who stumbled apon one of your videos

[@PwnFunction]

You are a rare one.

[@johnswanson217]

I'm really enjoying your content! But your audio is kind of confusing on headsets. Your voiceover volume is shifting Left and Right continuously. I highly recommend using mono audio for your voiceovers.

[@FluffyFoxUwU]

I love this penguin guy

[@yes-or1md]

It sounds like you are planning a heist or something

[@FajarAmanullah]

Very good, easy to understanding

[@thehonestabe]

Underrated video!

[@MechanicalMooCow]

Your accents makes me want to throttle a small puppy until it begins squeaking

[@DivijHere]

98.9K? 100K SOON!!!!

[@HimitsuYami]

Hi, random person who just stumbled upon your video here so I have no clue what's going on but it sure is interesting to me lol

[@imlautaro123]

just amazing!

[@clientdns1747]

this accent is like a german dude

[@REBL0X3RSCREW]

Lmao first I thought you were liveoverflow cause of the Video Styling and Voice🤣

[@ark3r745]

hey bro hope you are doing right, can you do more tutorials on the other vulnerabilities and explain them like you use to do ? pls

[@wolfrust0]

17:21 recapcha and recapcha

[@mthaha2735]

very deep stuff. nice hoping for more videos like this

[@asafcohen3562]

Fantastic video

[@expandingsalad786]

Can you please turn your handwriting into a font?

[@PwnFunction]

✅Added to my TodoList.

[@ZephyrysBaum]

@@PwnFunction Is it done?

[@vasiovasio]

Good luck with HTTP Only Cookies!

[@greedyxy]

Good Job! man.

[@vaibhavgavas4691]

#request SSRF (bypass filters and firewall)

[@crawbug8932]

4:26 bruh, use the "fold all" command

[@GnomeEU]

This looks like another example where a strong typed language would solve all problems. Dynamic typed language (eg JS) = bad?

[@Cookieukw]

muito bom

[@BlueFalconHD]

hey @PwnFunction, what paint/drawing software do you use, and what editing software?

[@madghostek3026]

Hm I don't quite get it, first the url removes the CONFIG variable, and then the stepone() is called, what called it?

[@PwnFunction]

You mean the `stageOne()`? It's called right after the is loaded, you can see the last line of code @ 20:11 , `onload=stageOne(this)`

[@madghostek3026]

@@PwnFunction Ah I didn't notice the onload in the , now it makes sense thanks

[@KogiSyl]

Nice thinking ;)

[@АлексейАлексеевич-ш7ю]

Great videos! Do you planning to make more?

[@PwnFunction]

Yes, I'll get back in a week.

[@DarkSet112]

Which program you use to make a drawing during the video?

[@youtuber-tc8yk]

Excellent content. To get subscribers over million, you should try to make video every 1 month, at least. BTW please let me know what theme do you use in vscode? It looks crazy!

[@fred-youtube]

Why did your voice change at 2:54

[@mikolajkozakiewicz1070]

: wow

[@slendi9623]

F xss auditor

[@LoganLatios]

8:53 in robloc

[@_livep]

Who else saw the stream?

[@notinsane]

NOOOO ME COOKIES!!!!!1!1

[@supershadowevil]

i am that one person hello

[@mukto2004]

whats the name of the editor liveoverflow using ?

[@therealgamingcroc]

Visual Studio Code

[@Jowanoofy_ZO]

My brain: watching dis nonsense. My other brain thinking: *thinking of if i take interest in codes by watching all if dis guy video codes i can become agenius familliar with codes in years later before going bankrupt and going genius*

[@EnitinEnitin]

This video made me hate the letter "P".

[@gruanger]

And B...

[@asafcohen3562]

I love ya shit

[@matthewrease2376]

Still not entirely sure how this lets you get *someone else's* cookie...?

[@nikkiofthevalley]

If someone else accesses a public page with an XSS on it, they will also trigger the XSS. You can then access the cookies through some method, and then send those off to a website you control that logs the cookies somewhere. I haven't watched the full video, so this probably won't be the exact method used, but this is the general principle of how you do that.