Uploaded February 2025 | Updated September 2026, 2 weeks ago

---

When auditing code it's crucial to know about common issues. In this video we explore a Go issue that I was not aware of.


LEARN ON HEXTREE (ad)
Learn hacking on Hextree: hextree.io
Join the Hextree Discord: discord.gg/xgQpCQCpvy

38c3 CTF - Fajny Jagazyn Wartości Kluczy:
2024.ctf.link/internal/challenge/fb03748d-7e94-4ca2-8998-a5e0ffcbd761

Unintended solution: https://msanft.foo/blog/hxp-38c3-web-fajny-jagazyn/
Challenge author writeup: hxp.io/blog/114/hxp-38C3-CTF-Fajny-Jagazyn-Wartoci-Kluczy

VSCode Go debugger client code: github.com/golang/vscode-go/blob/39786ea90f18ab98f75d091b9a04367d1b1df82c/extension/src/debugAdapter/goDebug.ts#L1557

CHAPTERS
00:00 - Intro
00:20 - Go gjson vs json behavior
01:33 - Overview CTF challenge "Fajny Jagazyn Wartości Kluczy"
04:33 - Weird server setup?
05:55 - Arbitrary file read
07:00 - /proc filesystem trick
08:01 - Unintended solution
09:14 - What was the intended solution?
12:58 - Exploiting Go race condition
13:58 - Outro

SUPPORT
Per video: patreon.com/join/liveoverflow
Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): shop.liveoverflow.com

WATCH, FOLLOW & READ
Second channel: youtube.com/LiveUnderflow
Twitch: twitch.tv/LiveOverflow
Twitter: twitter.com/LiveOverflow
Instagram: instagram.com/LiveOverflow
TikTok: tiktok.com/@liveoverflow_
LiveOverflow blog: liveoverflow.com
Hextree blog (ad): hextree.io/blog

#CTF #SecurityResearch #LiveOverflow

(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.