Training | Demonstrations [Over 50 Movies]
Movie Series - WebGoat - WebScarab - WebPageFingerPrint

Our videos illustrations of various hacking/security processes and tools were tested on our hacking lab environments and intended only for security hardening purpose. Please don't complain if those don't work for you. Watch and forget'em! Submit your desired training requests via the contact form.
Requirement: No more than a web browser with Flash player plugin.

Announcement: We have mirrored our training files at Rapidshare.Since Oct 2009, we no longer host files at sourceforge.net and we rather stick to our site. In case you experience impatient down time, please do let us know by mailing to down [at] yehg.net.

Hacking Rapidshare Account With XSS [View Online | Download]
Description: This movie shows how an attacker exploits an XSS vulnerability in Rapidshare.com and steals current logged in Rapidshare user's cookie which is then sent to his mailbox. Demonstrating with sample vulnerable XSS page seldom enlightens people with the real danger of XSS.We hope using the real site may make people(developers) greater awareness on the XSS threat. No doubt, we have reported this vulnerability to the Rapidshare team and they have fixed it.
Date: August 2009
Exploiting Gmail Weak Password Recovery [View Online | Download]
Description: Password reset/recovery questions shouldn't be too much simplistic. They shouldn't be any kinds that ask users to answer very security-weak answers such as 0-9,red-green-yellow-orange,etc.
Date: June 2009
Why JS Malwares are still prevelent and bypassing AV Scanners [View Online | Download]
Description: Even up to now due to today's AV Scanner's Poor Defense against web worms, we'll never be secure. This movie shows you how JS malwares can easily bypass AV Scanners using stupid string manipulation techniques.
Date: May 2009
HTTP Form Brute Forcing With JHijack [View Online | Download]
Description: The Initial reason for JHijack is to use it in numeric Session Hijacking but its uses depend only on who use it. We've given yet another example in Blind SQL Injection. This time, it can also be used as HTTP Form Cracker like an old school - Brutus.
Date: Nov 2008
Attack Log Analysis with Scalp! [View Online | Download]
Description: Scalp is a very great apache log attacker analyzer using php-ids IDS pattern file. If you scan your web site logs weekly or daily, you will see attacks are coming to your site on a regular basis. People tend to check their logs only after compromise is accomplished. It is too late. Attackers have 0wned their sites and manipulated log files!
Date: Sept 2008
Passive Vulnerability Scanning with RatProxy [View Online | Download]
Description: See how a google security guy's RatProxy is good at Web Application Security Assessment.
Date: August 2008
WebScarab Demonstration Series
Description: See how WebScarab is useful in web application security assessment. - Spidering - Finding Hidden Clues - Session Analysis - XSS Hunting - Dir Enumeration - Backups Enumeration
Date: August 2008
Greasemonkey Script: WebPageFingerprint Series
Description: Six nice video series of how a very little Greasemonkey Script can do - Web Page fingerprinting, JS fingerprinting, Vulnerability/Backup file scanning, XSS/SQL/Command Injection fuzzing ...etc.
Date: July 2008
XSS in phpMyAdmin 2.11.7 [View Online | Download]
Description: A recorded XSS hunting movie in phpMyAdmin 2.11.7.
Date: June 2008
Owning the box via Web Browser Flaw [View Online | Download]
Description: You'll never think of how dangerous a link you've clicked! Generally exploiting browser vulnerabilities to gain remote access may bypass firewalls that are protecting your workstation. Firewalls typically block new, inbound connection attempts but allow users behind the firewall to create outbound connections, which allow both parties of that established connection to communicate freely in both directions over that channel. If an attacker wants to attack your firewall-protected computer, he will normally be blocked by your firewall. However, if the attacker instead hosts the domain evil.com and entices you to browse to www.evil.com, he now has a communication channel to interact with your computer. Ref: GHHB.
Size: 11.3 MB
Date: May 2008
Discovering Browser Plugin Vulnerabilities [View Online | Download]
Description: See how attacker find flaws in web browser plugins to install malware to your computer. For example, if a plugin has vulnerable readFile/loadFile function, then he can read/load any files from your computer and then send them to his sever. Similarly, for saveFile function, he can overwrite any files on your disk with malicious content.
Size: 9.38 MB
Date: May 2008
Checking Weak SSL Ciphers With THCSSLCheck [View Online | Download]
Description: If any weak or obsolete SSL ciphers are being used in particular web sites, then a suitably positioned attacker may be able to perform an attack to downgrade or decipher the SSL communications gaining access to user sensitive data. Ref: WAHH.
Size: 2.05 MB
Date: May 2008
Session Strength Analysis With Stompy [View Online | Download]
Description: Stompy performs NIST FIPS statistical tests on session generation and checks for correlations between arbitrary bits. A truly random token never exhibits correlation between the stage of one bit and the state of another. In this movie, I'll show you how to download, extract, compile, and run Stompy and analyze session tests for failure or pass. Ref: WAHH.
Size: 10 MB
Date: May 2008
Owning the box Via Web Application Flaw [View Online | Download]
Description: See how an attacker can use our recent discovery of File-Upload vulnerability in Gmail-Lite to 0wn the entire box. This is to teach developers how a flaw in web application is evil.In this movie, you should learn: 1) Attacker bypasses Firewall by making victim machine connecting back to him via port 80 2).
Size: 6.39 MB
Date: April 2008
Trusting The Vulnerability Scanner: Danger of False Negative Sign [View Online | Download]
Description: This movie is to educate developers who put their entire trust on security/vulnerability scanners. False Negative means "Scanner says it doesn't find any X vulnerability". But there actually exists X vulnerability. Be sure to read "About Movie.txt" file.

Size: 2.05 MB

Date: April 2008
OWASP WebGoat Web Hacking Simulation Series [over 40 Movies]
Description: A Series of Full-Featured Web Hacking WalkThrough Simulations played in OWASP WebGoat v5.1 environment. General - Code Quality - Concurrency - Unvalidated Parameters - Access Control Flaws - Authentication Flaws - Session Management Flaws - Cross-Site Scripting (XSS) - Buffer Overflows - Injection Flaws - Improper Error Handling - Insecure Storage - Denial of Service - Insecure Configuration - Web Services - AJAX Security - Challenge. New movies will be added whenever WebGoat is updated.
Size: N/A
Date: April 2008
Attacking The Spammers with PhpMySpamFighter [View Online | Download]
Description: Spammers use email collectors programs to grap our site visitors' emails. See our phpMySpamFighter Dos-attacks their programs. We hope there will be less spammers if this technique is used widely. In fact, it fights not only spammers but also your attackers who use the similar tools to probe your web sites.
Size: 3.65 MB
Date: March 2008
Evading Firefox XSS-Warning Addon Filter [View Online | Download]
Description: Just one example of how attackers can easily bypass today's security controls. We shouldn't too much reply on security products which have their own weaknesses.
Size: 169 KB
Date: March 2008
Performing Directory Brute-Force Attack [View Online | Download]
Description: There are dozens of tools that let us brute-forcing directories names for sensitive information digging. In this movie, we illustrated Directory Brute-Forcing with the tool called 'JBroFuzz'. The reason why we like it is that it can brute force a large number of directories. As of this writing,the latest version JBroFuzz 0.8 has 58658 directories names that are commonly used by today's web sites. The only defense is you must not place/protect sensitive information in server-side (.htaccess). Just wanna show you - Security Through Obscurity is broken.
Size: 3.51 MB
Date: March 2008
Exploiting Logic Flaw [View Online | Download]
Description: This demonstration shows you on how a flaw in coding reveals sensitive information!
Size: 2.75 MB
Date: Feb 15, 2008
Desirable Input Validation Baseline Check [View Online | Download]
Description: This demonstration shows you on how you should implement baseline acceptable input filtering on visitors' inputs. Filtering inputs are the most important because 100% injection attacks (XSS,SQL,XPATH,OS CMD ...etc) come from inputs where filtering is weak or none. Developers should always be aware of inputs as well as outputs! You know Garbage In Garbage Out but for attackers, Garbage In Gold Out!
Size: 4.09 MB
Date: Jan 15, 2008
How Bad Guys Steal your Login Info Smartly [View Online | Download]
Description: This demonstration shows you how bad guys or malicious web sites steal your login accounts info of your daily visited sites by exploiting via web browser's autoComplete feature .
Size: 886.98 KB
Date: Jan 11, 2008
Finding XSS with Automated Tool [View Online | Download]
Description: This training shows you how to automate finding xss holes with fuzzers in quick and easy manner.
Size: 1.18 MB
Date: Jan 04, 2008

Interactive Training

Finding XSS with Automated Tool
Description: This training is an interactive version of the above training. It simulates you how to automate finding xss holes with fuzzers in quick and easy manner yourself.
Size: 150 KB
Date: Feb 6, 2008