YouTube transcript (XDaohGikIrk) — Transcript

Full transcript

1. 0:00As soon as you publish a project on the
2. 0:02internet, it becomes a potential target
3. 0:04for hacking. Large banks, social
4. 0:06networks, and IT companies maintain
5. 0:08entire security departments, hire
6. 0:10pentesters, and pay for discovered
7. 0:11vulnerabilities. And they still get
8. 0:13hacked regularly. You have surely seen
9. 0:16such news. If even companies with such
10. 0:18resources regularly miss
11. 0:19vulnerabilities, what chance does a
12. 0:21service you built over the weekend in
13. 0:23Cursor or Claude Code have? Therefore,
14. 0:26the question is not whether your
15. 0:27project will be hacked or not, but when
16. 0:29it will happen. And the good news is
17. 0:31that small projects are broken not by
18. 0:32complex attacks, but by the most banal
19. 0:34mistakes. That is what we will talk
20. 0:36about today. Your real adversaries are
21. 0:39automatic scanners looking for known
22. 0:40vulnerabilities on sites, as well as
23. 0:42script kiddies and slightly more
24. 0:44experienced enthusiasts testing tricks
25. 0:46they read about in a hacker magazine.
26. 0:48And today we will break down the 12
27. 0:50most frequent ways services written via
28. 0:53AI coding are broken. I will show you
29. 0:55how to close each one, and at the end,
30. 0:57I will provide a prompt for Claude Code
31. 0:58that will check your project for most
32. 1:00of these errors, and I will tell you
33. 1:02how my own project was hacked and what
34. 1:03I did so that my user database did not
35. 1:05leak. My name is Evgeny. I have been
36. 1:07developing for over 20 years, and here
37. 1:09I help launch your SaaS projects and
38. 1:11automate tasks using AI coding. Like
39. 1:13this video in advance, subscribe, and
40. 1:15let's get started. This is the final
41. 1:16lesson of my free course on AI coding
42. 1:18for launching your own micro-SaaS
43. 1:20project. The link to the playlist with
44. 1:21all lessons and the course is in the
45. 1:22description. And let's start with
46. 1:24authorization. Brute force, or password
47. 1:26guessing, is a login form without rate
48. 1:28limiting, without CAPTCHA, and without
49. 1:30timeouts on request frequency. And a
50. 1:32scanner can cycle through tens of
51. 1:34thousands of username and password
52. 1:35combinations in an hour. One matches,
53. 1:36and the attacker is already inside your
54. 1:38admin panel. Next is credential
55. 1:40stuffing, an attack using ready-made
56. 1:42username and password pairs. Your
57. 1:43client registered an email and password
58. 1:45on a fishing forum in 2019, and that
59. 1:47forum was leaked online. Now anyone can
60. 1:50take that ready-made pair and simply
61. 1:51plug it into your service. There is no
62. 1:53need to guess anything. The password
63. 1:55works on the first try because many
64. 1:56people use the same password on
65. 1:57different sites. But even perfect
66. 1:59authorization does not save you from
67. 2:01the next error, because it happens
68. 2:03after logging in. This is credential
69. 2:04leakage. A database key, a Telegram bot
70. 2:07token, or a payment system password is
71. 2:08right in the frontend and accessible
72. 2:10via "View Source" in a regular browser.
73. 2:12Or a file with such passwords and keys
74. 2:14was accidentally pushed to a public
75. 2:16repository on GitHub. Special scanners
76. 2:18comb through the entire GitHub
77. 2:19specifically looking for such files and
78. 2:21find the key within minutes of
79. 2:22publication. And then, an outsider is
80. 2:24the first to start profiting from your
81. 2:26product. IDOR, or Insecure Direct
82. 2:29Object References, occurs when an
83. 2:30online store checks that a user is
84. 2:32logged in, but fails to check if order
85. 2:34number 4521 actually belongs to them.
86. 2:37You change the number in the address
87. 2:39bar to 452 and see someone else’s
88. 2:40entire order: their name, delivery
89. 2:42address, and the last digits of their
90. 2:43card. Then you just iterate through the
91. 2:45numbers and download the profiles and
92. 2:47card data of customers, even without
93. 2:49being a developer. Improper access
94. 2:51control is when you hide the delete
95. 2:53user button on the front-end for
96. 2:54regular clients and decide that’s
97. 2:56enough. In the browser, it’s easy to
98. 2:58see what request is sent to the server
99. 3:00when an admin clicks that button and
100. 3:01send the exact same request directly,
101. 3:03without the button itself. The server
102. 3:05doesn’t check the role on its end and
103. 3:06simply executes the command, deleting
104. 3:08the user, even if you aren't an
105. 3:09administrator. SQL injection is one of
106. 3:11the oldest ways to hack databases.
107. 3:13Instead of regular text, a special
108. 3:15construction is entered into a search
109. 3:16field, for example. And if the database
110. 3:18query is constructed incorrectly, the
111. 3:20database executes it as a command
112. 3:21rather than as text, giving up
113. 3:22everything from user lists to passwords
114. 3:24. And notice one thing here: none of
115. 3:26these methods require a genius hacker.
116. 3:28Almost all of this is automated. No one
117. 3:30is looking for you specifically. They
118. 3:31just run a scanner across thousands of
119. 3:33websites in a row and look for where a
120. 3:35door for hacking has been left open.
121. 3:37And now, a story about how my own
122. 3:38project was hacked. In 2008, I launched
123. 3:41OPA. It was a blog platform. At its
124. 3:43peak, it was getting 1,000 posts a day.
125. 3:45It was the largest platform of its kind
126. 3:46in the country at the time. "Vibe
127. 3:48coding" didn’t even exist back then.
128. 3:50I had only been developing for a couple
129. 3:51of years myself; I was that classic "
130. 3:53mom’s startup" kid, practically a
131. 3:54schoolboy. And I was hacked using the
132. 3:56exact method I’ll talk about a bit
133. 3:58later. Through a file upload, a PHP
134. 3:59script was uploaded to the server
135. 4:01instead of an avatar. The hacker
136. 4:03himself messaged me on ICQ to say that
137. 4:04my project was hacked and that he was
138. 4:05already downloading the database. I
139. 4:07logged into the server and saw that a
140. 4:08database dump file was indeed being
141. 4:10created in the system folder. But it
142. 4:12wouldn’t open via a direct link from
143. 4:13the browser yet, which meant they
144. 4:14hadn’t managed to download it yet. I
145. 4:16asked how he pulled it off, and he
146. 4:17answered, honestly explaining that he
147. 4:19had uploaded the script disguised as an
148. 4:20avatar. It turned out he wasn’t an
149. 4:22extortionist; he was just practicing on
150. 4:24a popular project. He was just curious
151. 4:26if he could hack it. While we were
152. 4:27messaging, I deleted his file, patched
153. 4:29the hole in the avatar upload, and
154. 4:31erased the incomplete dump. The
155. 4:32database never leaked. By the way, if
156. 4:35you’re as old as I am and know what
157. 4:36ICQ is, give this video a like. And for
158. 4:39those who don’t, check the comments,
159. 4:40and someone will fill you in. And the
160. 4:41conclusion I drew for myself was this.
161. 4:43Not everyone who finds a vulnerability
162. 4:44in your project wants to harm you. Some
163. 4:46do it out of curiosity or for practice
164. 4:48without any malicious intent. I was
165. 4:50lucky back then; the person turned out
166. 4:51not to be a blackmailer, but someone
167. 4:53who just wanted to test their skills.
168. 4:54If someone makes contact and is willing
169. 4:56to talk, it sometimes helps to
170. 4:58understand the cause of the hack much
171. 4:59faster. But of course, you shouldn't
172. 5:01rely on this happening every time. The
173. 5:02main thing that conversation gave me
174. 5:04wasn't that I was hacked, but exactly
175. 5:05how I was hacked. Without that, I would
176. 5:07have only addressed the symptom, not
177. 5:08the vulnerability itself. Therefore,
178. 5:09security isn't a list of scary terms,
179. 5:11but an understanding of specific attack
180. 5:13methods. When you understand the method
181. 5:15, you close the hole forever, not just
182. 5:16until the next hack. Moving on. And now
183. 5:18about money. It's webhook spoofing. The
184. 5:21system receives a notification about a
185. 5:22successful payment, but it doesn't
186. 5:24verify that it truly came from the
187. 5:25payment provider, rather than someone
188. 5:26else. That's why such a notification is
189. 5:28easy to send directly to the server
190. 5:30yourself, bypassing the payment itself.
191. 5:32The server sees a familiar format and
192. 5:33grants access to paid content for free.
193. 5:36If your service relies on credit
194. 5:37payments and token-based billing via a
195. 5:39third-party provider, such a trick can
196. 5:40cost you a lot of money. And next,
197. 5:42about third-party code inside your own.
198. 5:44Unverified libraries; when working on a
199. 5:46project, there are almost always
200. 5:47third-party packages, and AI installs
201. 5:49them indiscriminately. It doesn't look
202. 5:51at who the author is or when the last
203. 5:52update was. A library might be
204. 5:53malicious from the start and steal
205. 5:55server data, or it might be legitimate
206. 5:57but have a vulnerability for which an
207. 5:58update was released long ago. It's just
208. 6:00that you haven't updated yet because
209. 6:02something broke after the last update.
210. 6:04In both cases, the hack happens through
211. 6:06code you didn't write, but you were the
212. 6:08one who failed to control what you use
213. 6:10in your project. And there are two
214. 6:11popular ways to enter someone else's
215. 6:13account without a password through a
216. 6:14browser. The first is XSS. Instead of
217. 6:16text, code is pasted into a review or
218. 6:18comment field. It then appears for
219. 6:20everyone who opens that page, stealing
220. 6:22access to their actual accounts. The
221. 6:25second is a leaky CORS policy, where
222. 6:26your site accepts requests from any
223. 6:28external site because it was easier to
224. 6:29set up the frontend that way. The user
225. 6:32is sent a link to a third-party page,
226. 6:34and while they are on it, data is
227. 6:35quietly stolen from their open account
228. 6:37on your site, without them clicking
229. 6:39anything. Uploading a malicious file is
230. 6:41that very method from my story. Avatar
231. 6:43uploads were allowed, but they only
232. 6:45checked the extension in the file name.
233. 6:47The malicious script is named "
234. 6:48avatar.php". The server saves it to a
235. 6:50folder from which it is ready to
236. 6:52execute code itself. Inside such a file
237. 6:53, they usually hide not an image, but a
238. 6:56file manager or editor code that opens
239. 6:57access to all files on the server and
240. 6:59the database. Then the "image" is
241. 7:01opened directly via a link, granting
242. 7:03this access. A race condition is when
243. 7:05it isn’t anticipated that several
244. 7:07requests from one user might arrive at
245. 7:10the exact same millisecond. And when
246. 7:12100 identical requests fly to the
247. 7:13server at once, for example to apply a
248. 7:15promo code, it doesn't have time to
249. 7:17check the balance between the first and
250. 7:18second request and applies multiple
251. 7:20codes at once, thus zeroing out the
252. 7:22price. And the last thing for today is
253. 7:23sensitive data in logs. Passwords,
254. 7:25access tokens, and account recovery
255. 7:27links are written to logs to make
256. 7:28debugging the service easier in the
257. 7:29moment, and then people forget to turn
258. 7:31them off. Access to logs provides a
259. 7:33ready-made set of keys to everything
260. 7:34else, even without hacking the database
261. 7:36itself. There are 12 methods here, but
262. 7:37in total there are over a hundred types
263. 7:39of attacks and vulnerabilities. Combine
264. 7:40them, and a startup could be left with
265. 7:42just a couple of lines of useless code,
266. 7:44an empty database, and zero reputation
267. 7:46with its very first clients. Each of
268. 7:48these twelve methods can be closed with
269. 7:50one or two lines of code. Limit the
270. 7:52number of attempts, verify the record
271. 7:53owner rather than just the login status
272. 7:55, and check that the webhook actually
273. 7:56came from the payment system. Nothing
274. 7:58overly complicated. The problem is that
275. 8:00there are over a hundred such checks,
276. 8:01and they are scattered throughout the
277. 8:02entire project. And every time
278. 8:04artificial intelligence adds a new
279. 8:05piece of code, you need to re-verify
280. 8:07whether it forgot any of them. You
281. 8:09don’t need to be a programmer to do
282. 8:10this. Modern models are already capable
283. 8:12of finding many of these issues
284. 8:13themselves, but they almost never check
285. 8:15for them unless you specifically ask.
286. 8:17And for a hack, all it takes is a
287. 8:18single unpatched vulnerability.
288. 8:20Therefore, instead of "make a login
289. 8:22form," you need to ask specifically: "
290. 8:24Make a login form with a limit on
291. 8:25attempt counts and protection against
292. 8:27brute-force attacks." Remember,
293. 8:28manually reciting all these
294. 8:30formulations is unrealistic, so I
295. 8:31gathered them into a skill. This is a
296. 8:33ready-made instruction for Claude Code
297. 8:34that you connect to your project once.
298. 8:36It forces Claude Code to go through
299. 8:38every vulnerability we discussed today,
300. 8:39rather than just taking its word that
301. 8:41everything is fine. This isn't a
302. 8:43one-time check before launch; it’s
303. 8:45something that must be done regularly,
304. 8:46checking not just the whole application
305. 8:48, but each new module separately as
306. 8:50soon as it's written. The more code you
307. 8:52give it to check at once, the easier it
308. 8:54is for it to miss something. So, if you
309. 8:56wrote a payment form, ask it to check
310. 8:58just that for vulnerabilities and fix
311. 9:00everything it finds, instead of putting
312. 9:02it off until a general project audit.
313. 9:03There is also a nuance here: such an
314. 9:05instruction cannot be identical for
315. 9:07every project. You have your own stack
316. 9:08and your own libraries. That’s why I
317. 9:10take this skill as a base and ask
318. 9:12Claude to analyze my specific project
319. 9:13to assemble separate rules tailored
320. 9:15exactly to my stack. Just like with any
321. 9:17other skill, you take my version as a
322. 9:19base and adapt it for yourself. You can
323. 9:21grab the skill itself on Telegram, as
324. 9:22usual, the link is in the description.
325. 9:24If you are launching your project now
326. 9:26and want to get it to real clients
327. 9:27instead of leaving it sitting in a
328. 9:29drawer, join my club for founders. If
329. 9:31you need personal help with development
330. 9:32and launch, contact information for my
331. 9:34services is also in the description.
332. 9:35Like and subscribe, and I'll see you in
333. 9:37the next video. M.