![Avosh security](/img/default-banner.jpg)
- 28
- 32 702
Avosh security
United States
Приєднався 5 сер 2023
Authentication OTP bypass AND XSS ,Open Redirect || Bug Bounty POC 2023 | XSS Attack
Hello friends
In this video, we want to check that vulnerabilities can be in different parts of a site resource
For example, the authentication part of this website has a bug and it can be easily bypassed
Also, there is an xss vulnerability in the online chat section, which can create Open Redirect vulnerability with the help of xss
In this video, we want to check that vulnerabilities can be in different parts of a site resource
For example, the authentication part of this website has a bug and it can be easily bypassed
Also, there is an xss vulnerability in the online chat section, which can create Open Redirect vulnerability with the help of xss
Переглядів: 2 133
Відео
ssrf vulnerability exploit || ssrf || bug bounty poc 2023 || site hack || ssrf in cloud servis
Переглядів 3,4 тис.9 місяців тому
Hello friends today I want to work on a target that has a SSRF vulnerability and we will test this vulnerability by uploading an svg file.
Authentication OTP bypass AND Information Disclosure (SSRF) || bug bounty poc 2023 || site hack
Переглядів 3,2 тис.10 місяців тому
Hello friends Today I want to work on a target that easily bypasses the site's authentication system and then tests an SSRF vulnerability.
XSS and Open Redirect vulnerable | Bug Bounty POC 2023 | XSS Attack
Переглядів 85010 місяців тому
Please turn on the video subtitles Hello friends In this video, we want to check that vulnerabilities can be in different parts of a site resource For example, in this website, the programmer had not properly filtered the tags of the site
Sensitive Session Token Vulnerability|| Bug Bounty 2023 || website hack
Переглядів 1,1 тис.10 місяців тому
Please turn on the video subtitles Hi my friends In this video, we are working on a target that has the vulnerability of not checking tokens and session, and this vulnerability can endanger the security of user data.
XSS and Open Redirect vulnerable | Bug Bounty POC 2023 | XSS Attack
Переглядів 1,3 тис.11 місяців тому
Please turn on the video subtitles Hello friends In this video, we want to check that vulnerabilities can be in different parts of the same source of the site For example, in this website, the programmer had filtered the inputs received from input, but unfortunately he had not done these filters in the (script) part.
Sql injection attack|| bug bounty poc 2023 || SQL Injection attack With Sqlmap
Переглядів 1,8 тис.11 місяців тому
Please enable video subtitles to better understand the instructions Hello friends I found a sql injection vulnerability in this target and got a lot of information (almost 5600 users) of course I reported this bug to the site admin. In this video with two methods We perform the test using the sqlmap program in the Linux environment and by injecting via url Be careful, always try to help keep th...
HTML Injection, XSS and Open Redirect | Bug Bounty POC 2023
Переглядів 1,9 тис.11 місяців тому
Hello friends Please turn on the subtitles of the video to understand the explanation In this video, we want to check that the vulnerabilities can be in different scripts, for example, in this site, there are HTML injection, xss and open redirect vulnerabilities in the online chat script, which we will check with everyone.
Blind Sql injection and SQl injection Vulnerability | Bug Bounty Poc 2023
Переглядів 1,5 тис.Рік тому
Hello dear friends Today I want to show you a program that works on a target that has a blind sql injection vulnerability. Step 1 I extract and display the tables and data from the sql injection vulnerability method (only to see the data and compare with the data that our software extracts) Please note that this target is vulnerable to both blind sql injection and sql injection, but targets tha...
idor misconfiguration vulnerability poc|| bug bounty 2023
Переглядів 1,3 тис.Рік тому
attacker can email address sauce fully charged without any password this is a security misconfiguration vulnerability
SQL Injection Attack In 7 Minutes bug bounty poc | hackerone | Bugcrowd | SQL Injection
Переглядів 1,2 тис.Рік тому
sql injection bug-sql injection vulnerability-website hack- database hacke
$100 Bounty for Xpath injection using EXTRACTVALUE in WordPress| BUG BOUNTY | WordPress Hack
Переглядів 2,4 тис.Рік тому
In this channel,you can find POC's videos of our bug hunters & bug bounty community who disclosed their findings with POC videos of publically disclosed reports from BUGCROWD , HACKERONE WordPress Hack
Directory traversal AND XSS Poc bug bounty || bug 2023 live attack | wordpress hack
Переглядів 2,3 тис.Рік тому
What is directory traversal? Directory traversal (also known as file path traversal) is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files. In some cases, an attacker might be able to write to arbitrary files...
Authentication OTP bypass | Bug Bounty POC 2023 | OTP bypass 2023
Переглядів 1,7 тис.Рік тому
Authentication OTP bypass | POC Bug Hunting | OTP bypass
HTML Injection AND XSS | HTML Injection Vulnerabilit| Bug Bounty POC
Переглядів 233Рік тому
HTML Injection AND XSS | HTML Injection Vulnerabilit| Bug Bounty POC | 2023 CSRF SQL SSRF BUG BOUNTY Bug Bounty tutorial Hackerone Bugcrowd
CRLF injection POC || Rate limit bypass || bug bounty poc disclosure
Переглядів 775Рік тому
CRLF injection POC || Rate limit bypass || bug bounty poc disclosure
Directory traversal Poc bug bounty || bug 2023 live attack
Переглядів 1,2 тис.Рік тому
Directory traversal Poc bug bounty || bug 2023 live attack
HTML,XSS Injection Via URL Parameters | Bug Bounty Poc
Переглядів 247Рік тому
HTML,XSS Injection Via URL Parameters | Bug Bounty Poc
SQL Injection Attack In 6 Minutes bug bounty poc | hackerone | Bugcrowd | SQL Injection
Переглядів 862Рік тому
SQL Injection Attack In 6 Minutes bug bounty poc | hackerone | Bugcrowd | SQL Injection
OTP Verification Bypass | Bug Bounty | Poc 2023
Переглядів 177Рік тому
OTP Verification Bypass | Bug Bounty | Poc 2023
SQL Injection Attack || SQL Injection vulnerability || bug bounty poc 2023
Переглядів 120Рік тому
SQL Injection Attack || SQL Injection vulnerability || bug bounty poc 2023
$50 sql injection bug || bug bounty poc || sql injection vulnerability
Переглядів 208Рік тому
$50 sql injection bug || bug bounty poc || sql injection vulnerability
Bypass Admin + Upload Shell Bug Bounty POC || Hackerone || Ethical Hacking || live
Переглядів 565Рік тому
Bypass Admin Upload Shell Bug Bounty POC || Hackerone || Ethical Hacking || live
$150 sql injection bug || bug bounty poc || sql injection vulnerability
Переглядів 968Рік тому
$150 sql injection bug || bug bounty poc || sql injection vulnerability
brother where is crlf injection, i can only see rate limit bypass
i heard about otp leaked in response but first time seeing otp leak in request body🤣🤣🤣
amazing bro amazing
nice music haha
nice
طب قطاع ببطاقة فيزا يا شاطر
Can you reset my gmail password for me?
this is crazy❤🔥❤🔥
Nice
Any bounty you got ??????
It's not ssrf , Why ? because you are click in "my name " so you enter the page not the server of website !!!! You can do better than of this bro
Yeah it's not ssrf, the image is not opened under the domain. Instead it's open it using the protocol which is browser specific.
Verification bypass is fine, but it's not a SSRF
ولی اهنگایی بی کلامی ک میزاری خیلی خوبن❤
this is not a SSRF
its not a bug
Good job, did the website developer respond to your report🤔?
😂
It is not vulnerable at SSRF =)) When you remove `tel` and your browser call to the Burp-collab → the IP got recorded is yours not from the Slack. For the second SSRF it could be because I saw 2 different IP as well as DNS. 1 is belonging to you, and the rest could be from Slack
why you are using this || (Or) to bypass the waf or what and after using the final payload the data reflected on the URL itself?
Source ip addresses are the IP address of origin serves right?
bugcrowd or hackerone plateform
I'm a new to this can somebody say where did he get the data?
Hello my friend This data was obtained by SQL Injection vulnerability
@@Avoshsecurity okay but where is the data displaying?
Wow didn't knew slack would have that OTP verify😂.
You're welcome
Great find. Could someone please explain the last part?
Where exactly did you not understand?
After watching this POC i am able to do SSRF on every website.
You're welcome
If you follow this step for ssrf, you won't get any bounty for sure 😂 because it's not a valid way of finding ssrf
😮
gokilllllll jir❤🔥❤🔥❤🔥🔥🔥🔥🔥🔥🔥🔥🧯
Why you put invalid email than in burp you remove the invalid so weird this is not bug, you are not hacker
Saya pikir itu tidak valid
Oh begitu ya@@0xaexon
Is it solved , do you got bounty
Still I don't believe if it's the website open bug bounty program coz from the UI it looks old and I just visisited that the website last updated is 2006 so it's normal if there is SQL Injection in the age but if u all try in the real websites nowadays it's so seldom coz I've learned and practice to hunt SQL Injenction bugs on BBP I never found them I can just found it like this video but it's not BBP
Ssrf 😂
Boss, could you please create a comprehensive video series covering advanced topics such as advanced time based blind SQL injection injection, XSS, LFI, RFI, and RCE, including the process of uploading web shells on Apache and IIS web servers in live website scenarios? Traditional platforms like test.vulner, DVWA, bWapp, PortSwigger, etc., fail to address real-world challenges like identifying origin IPs, DNS brute force attacks, reverse IP lookups, WAF/IDS/IPS circumvention, AWS/CDN/Tor, reverse proxies, and CMS security 🤙. Your unique content would be invaluable in educating the bug bounty hunting community about genuine issues and solutions. Thanks in advance for your contributions to the community.
I suggest using Burp Suite with request.txt and SQLMAP to accomplish all of this. Please share more videos on WebSocket SQL Injection and time-based blind SQL Injection using HTTP request/response headers. Thanks.
biunty,?
bro you got any bounty
hey bro can i talk to yu?
The SSRF was next level. 😂
OTP is serious finding but in the ssrf the calling came from your own network not the server IP. the important think in ssrf is the calling and its hould came from the original website server
very good
But you opened the link in your browser so the http request recieved is of your own not the server’s
payment system how? is it paid works?
Keep it Up!
Nice
🎉🎉🎉🎉
good🌹
tanks
Awesome 👍
any bounty bro ?
its openredirect bro :X
haha
not understannd bro can anyone please explain me
Great finding 👌😏