Check out application.security for a great interactive demo of the capital one breach