GISEC Global 2026
Dark Stage
Talk + Tool
The Hacker's Time Machine: Exploiting Systems Through History, Not Bugs
// Dark Stage · GISEC Global 2026 · Dubai · Sep 16, 2026
the talk
Modern attacks rarely begin with a zero-day. They begin with the past: an API generation nobody calls any more, a feature removed from the product but not the server, a build nobody switched off. It never gets patched because it's on no asset list, no WAF rule, no SIEM alert.
A vulnerability doesn't have to be new. It only has to be somewhere nobody looked.
The talk walks the full chain live: from a constant in a frontend bundle, to a superseded API version, to a schema that version still publishes, and into material the site never meant to show.
the method
1
Read the frontend
The SPA names its API in a constant.
const API_BASE = "/api/v3"2
Walk versions backwards
v3 implies v2 and v1. Backwards only, forward invents endpoints that never existed.
3
Subtract
Known minus reachable. What's left is served and referenced nowhere.
4
Read the schema
The old version still publishes its own routes and fields, including ones the product dropped.
5
Pair and compare
Old against new: auth required? which fields return? Five fields against eleven is a finding.
6
Flag, don't filter
Show everything, highlight the suspicious, let the researcher decide.