​@LiveOverflow Talks About the Importance of CTFs, Hacking, Creating Content for Hackers, and more!

### Overview In this livestream interview, host NahamSec interviews Fabian, the security researcher and educator known as LiveOverflow. They explore Fabian's background in computer science, how he transitioned from developer to web application penetration tester, his views on Capture the Flag (CTF) competitions versus bug bounties, and his journey into content creation on Twitch and YouTube.

### Key Topics - **Entry into Security & Education:** Fabian began programming as a teenager and encountered SQL injection early on, but his formal pursuit of cybersecurity began during his dual-study bachelor's degree after playing the Stripe CTF. He later earned a master's degree in computer science and obtained the OSCP certification (under the BackTrack era). - **CTFs vs. Real-World Assessment:** Fabian explains why he creates content highlighting both the positives and negatives of CTFs. While CTF challenges can occasionally be unrealistic or reliant on guessing, high-weight competitions (found via ctftime.org) foster transferable foundational problem-solving skills, especially when studying write-ups. - **Approach to Web Application Security:** As a freelance pentester, Fabian specializes in code-assisted web application assessments, relying heavily on source code review rather than automated reconnaissance or brute-forcing. - **Bug Bounties vs. Pentesting:** Fabian discusses why he has avoided bug bounties, contrasting the unpaid, duplicative subdomain and TLS enumeration of external bug hunting with structured penetration testing where clients provide source code and routes. - **Content Creation & Workflow:** Inspired initially by watching GeoHot stream CTF challenges on Twitch, Fabian launched LiveOverflow to give others the experience of looking over a professional's shoulder. He later shifted from live streaming to scripted, edited YouTube videos.

### Technical Details - **Tooling:** Fabian primarily relies on Burp Suite for web testing alongside custom Python scripts to test endpoints and parameters. He seldom relies on scanners like Nmap, masscan, DirBuster, or Wfuzz because his engagements are source-code assisted. - **Languages:** Fluent in Python and C, Fabian also uses C# (from game development in Unity) and reads many languages during white-box code reviews. - **Vulnerabilities & CTF Highlights:** Fabian notes memory corruptions as his favorite vulnerability class. Memorable CTFs mentioned include Stripe CTF, Real World CTF in China, and CCC (C3) on-site CTFs, alongside CTF teams like Sauercloud and ALLES!.

### Takeaways - **Understand Underlying Systems:** Rather than memorizing bug labels like IDOR, security practitioners should understand fundamental application design and access control models. - **Learn by Observing:** Watching experienced practitioners work—including their editor choice, terminal habits, and thought processes—accelerates technical learning. - **Embrace Curiosity and Balance:** Turning casual activities (such as analyzing mobile game APIs or exploring game engines) into technical learning projects helps sustain interest without succumbing to external pressure or burnout.