he hacked my websites

About this video

Chuck pen-tests the 24 websites he built in 24 hours, first himself and then handing off to ethical hacker Tyler Ramsey, stressing that pen-testing requires explicit permission and scope. He starts with Nikto against commentoftheday.tech — it fingerprints IPs, DNS and the certificate, but terminates with 20 errors and he notes Nikto struggles with TLS; he feeds results to Claude, which rates issues low severity and flags that he and Alex hardcoded API keys in site code. He then runs OWASP ZAP as a proxy with its HUD, spidering and active scanning, finding only medium alerts like anti-clickjacking. With Burp Suite Pro he runs a deep crawl-and-audit scan; it flags XML injection he attributes to the host, and a Retire.js extension finds a vulnerable Axios version — a high-severity issue he fixes by updating the script source and rescanning. He also tries WPScan, moves an API key behind a PHP backend script, runs a Snyk SAST scan that finds hardcoded secrets and XSS from unsanitized input, and deliberately builds an insecure LAMP site — root login allowed, database bound to any address, SQL injection, exposed admin panel, insecure uploads, plaintext passwords — for Tyler. Tyler screenshots all hosts with GoWitness, scans with Nuclei, then works in the Caido proxy after switching VPN IPs to bypass an IP block. His findings include possible reflected XSS via an SVG upload, WordPress username enumeration plus version disclosure (PHP 8.2.16), an API key passed in a URL that he spams with 40 requests and no rate limiting to show quota-exhaustion denial of service, an exposed .env revealing a database password found via directory enumeration, an admin panel logged into with admin/admin, a client-side countdown bypassed by changing system time, and an open redirect escalable toward XSS. Tyler says he enumerated the sites in an hour and 40 minutes, finding serious misconfigurations.

Key takeaways

• Only pen-test sites in explicit scope with permission — Chuck tests only his own 24 sites
• Nikto, OWASP ZAP and Burp Suite automated scans found mostly low/medium server-side issues on the simple sites
• Burp’s Retire.js extension found a high-severity vulnerable Axios version; updating the library and rescanning confirmed the fix
• Hardcoded and URL-passed API keys are the recurring flaw — hide keys behind a backend script and add rate limiting
• Tyler’s manual work found SVG XSS, WordPress username enumeration, an exposed .env with a DB password, admin/admin login and an open redirect

Episode details: published September 18, 2024 · 34:24 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: Hide your files like a hacker (5 Ways) · Next: 18 Weird and Wonderful ways I use Docker →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube