Uploaded September 2020 | Updated September 2026, 2 weeks ago
All The Little Things was a pretty hard web challenge from the Google CTF 2020. In this video we do some initial recon and research and try to find an angle to attack. Part 1/2.
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: hextree.io
Watch this video and more on Hextree: app.hextree.io/courses/yt-xss/xss-ctf-challenges
Join the Hextree Discord: discord.gg/xgQpCQCpvy
Challenge: capturetheflag.withgoogle.com/challenges/web-littlethings
Pasteurize: youtube.com/watch?v=Tw7ucd2lKBk
CHAPTERS
00:00 - Intro
00:50 - Functionality Overview
01:29 - HTML Injection
02:25 - Making a Plan
02:50 - theme.js Discovering JSONP Endpoint
03:51 - user.js The User Class
04:23 - utils.js Start of Chain
04:44 - No Ideas...
05:07 - DOM Clobbering: window.load_debug
06:05 - Doing Security Research
07:25 - Anything else to clobber?
07:49 - Start from beginning, discover __debug__
08:10 - The load_debug() function
09:20 - window.name is special
09:41 - Try it yourself!
10:00 - Outro
SUPPORT
Per video: patreon.com/join/liveoverflow
Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): shop.liveoverflow.com
WATCH, FOLLOW & READ
Second channel: youtube.com/LiveUnderflow
Twitch: twitch.tv/LiveOverflow
Twitter: twitter.com/LiveOverflow
Instagram: instagram.com/LiveOverflow
TikTok: tiktok.com/@liveoverflow_
LiveOverflow blog: liveoverflow.com
Hextree blog (ad): hextree.io/blog
#WebSecurity #CTF #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.
All The Little Things was a pretty hard web challenge from the Google CTF 2020. In this video we do some initial recon and research and try to find an angle to attack. Part 1/2.
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: hextree.io
Watch this video and more on Hextree: app.hextree.io/courses/yt-xss/xss-ctf-challenges
Join the Hextree Discord: discord.gg/xgQpCQCpvy
Challenge: capturetheflag.withgoogle.com/challenges/web-littlethings
Pasteurize: youtube.com/watch?v=Tw7ucd2lKBk
CHAPTERS
00:00 - Intro
00:50 - Functionality Overview
01:29 - HTML Injection
02:25 - Making a Plan
02:50 - theme.js Discovering JSONP Endpoint
03:51 - user.js The User Class
04:23 - utils.js Start of Chain
04:44 - No Ideas...
05:07 - DOM Clobbering: window.load_debug
06:05 - Doing Security Research
07:25 - Anything else to clobber?
07:49 - Start from beginning, discover __debug__
08:10 - The load_debug() function
09:20 - window.name is special
09:41 - Try it yourself!
10:00 - Outro
SUPPORT
Per video: patreon.com/join/liveoverflow
Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): shop.liveoverflow.com
WATCH, FOLLOW & READ
Second channel: youtube.com/LiveUnderflow
Twitch: twitch.tv/LiveOverflow
Twitter: twitter.com/LiveOverflow
Instagram: instagram.com/LiveOverflow
TikTok: tiktok.com/@liveoverflow_
LiveOverflow blog: liveoverflow.com
Hextree blog (ad): hextree.io/blog
#WebSecurity #CTF #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.
