- 75
- 143 011
Medusa
Приєднався 27 жов 2021
Learning and Sharing stuff on API Hacking!
Testing for Password Reset Poisoning in APIs – A Bug Hunter’s Guide
This video covers multiple methods to identify and exploit password reset poisoning vulnerabilities in web applications and APIs with deep analysis.
.
.
.
.
.
My Blog: medusa0xf.medium.com/
.
.
.
Social media:
Twitter: medusa_0xf
.
.
.
Discord: discord.com/invite/2PUPD3RHHs
.
.
.
Links in the Video:
github.com/projectdiscovery/interactsh
hackerone.com/reports/1108874
hackerone.com/reports/342693
shahjerry33.medium.com/http-parameter-pollution-its-contaminated-85edc0805654
hackerone.com/reports/106024
.
.
.
.
Introduction: 0:00
HTTP Host Header Injection: 0:13
Flow Analysis: 2:03
Method 1: 4:11
Method 2: 6:40
Method 3: 9:32
Final Thoughts: 11:31
.
.
.
Music by Karl Casey @ White Bat Audio
.
.
#owasp #jwt #api #subdomain #portswigger #bugbounty #bola #postman #podcast #pentesting #api #hack #bola #tryhackme #hackerone #apihacking #computerscience #javascript #python #postman #ctf #bughunting #pentesting #hacking #hackingtools #burpsuite #portswigger #ethicalhacking #OAuth #webhacking #programming #websecurity #technology #practical #artificialintelligence #web #recon #bypass
.
.
.
.
.
My Blog: medusa0xf.medium.com/
.
.
.
Social media:
Twitter: medusa_0xf
.
.
.
Discord: discord.com/invite/2PUPD3RHHs
.
.
.
Links in the Video:
github.com/projectdiscovery/interactsh
hackerone.com/reports/1108874
hackerone.com/reports/342693
shahjerry33.medium.com/http-parameter-pollution-its-contaminated-85edc0805654
hackerone.com/reports/106024
.
.
.
.
Introduction: 0:00
HTTP Host Header Injection: 0:13
Flow Analysis: 2:03
Method 1: 4:11
Method 2: 6:40
Method 3: 9:32
Final Thoughts: 11:31
.
.
.
Music by Karl Casey @ White Bat Audio
.
.
#owasp #jwt #api #subdomain #portswigger #bugbounty #bola #postman #podcast #pentesting #api #hack #bola #tryhackme #hackerone #apihacking #computerscience #javascript #python #postman #ctf #bughunting #pentesting #hacking #hackingtools #burpsuite #portswigger #ethicalhacking #OAuth #webhacking #programming #websecurity #technology #practical #artificialintelligence #web #recon #bypass
Переглядів: 1 315
Відео
OWASP API Top 10 Breakdown | Study Session with CTF Challenges (DVAPI)
Переглядів 1,3 тис.28 днів тому
In this video, we explore the OWASP API Top 10 in a fun way through a CTF, with each challenge addressing a specific vulnerability. We'll submit flags, try different tools, and have a fun study session. . . . . . My Blog: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord: discord.com/invite/2PUPD3RHHs . . . Links in the Video: github.com/payatu/DVAPI github...
Authentication Bypass Via JKU Header Injection | JWT Hacking
Переглядів 365Місяць тому
In this video, we explore the JKU Header Injection vulnerability and how it can be used to bypass authentication. You'll learn how attackers exploit this JSON Web Tokens (JWTs) flaw by creating their signing key, potentially gaining unauthorized access. . . . . . My Blog: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord: discord.com/invite/2PUPD3RHHs . . ....
Authentication Bypass Via JWK Header Injection | JWT Hacking
Переглядів 1 тис.2 місяці тому
In this video, we explore the JWK Header Injection vulnerability and how it can be used to bypass authentication. You'll learn how attackers exploit this JSON Web Tokens (JWTs) flaw by creating their signing key, potentially gaining unauthorized access. . . . . . My Blog: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord: discord.com/invite/2PUPD3RHHs . . ....
Subdomain Enumeration ALL KINDS!
Переглядів 1 тис.2 місяці тому
In this video, we dive deep into subdomain enumeration, exploring ALL KINDS of techniques and tools to uncover hidden subdomains. Whether you're a beginner or a seasoned cybersecurity professional, this video will help you understand how to efficiently gather subdomain information and identify potential security risks. . . . . . My Blog: medusa0xf.medium.com/ . . . Social media: Twitter: twitte...
Hunting Open Redirects: A Pathway to Chaining XSS
Переглядів 1,3 тис.3 місяці тому
This video explores open redirect vulnerabilities and how they can be exploited to chain XSS (Cross-Site Scripting) attacks. Learn how attackers can manipulate open redirects to bypass security filters and inject malicious scripts, creating serious security risks. Whether you're a penetration tester, developer, or security enthusiast, this video provides practical examples and demonstrations on...
Unmasking the Ghost: The CWE-352 Dilemma🎙 Snake Bytes Ep. 4: Web Ghosts
Переглядів 3153 місяці тому
In this episode of "Web Ghosts," we explore Cross-Site Request Forgery (CSRF) and how to find it. We’ll discuss how CSRF attacks work, share real-life examples, and their impact on websites. You’ll learn practical methods to spot these vulnerabilities and protect against them. Join us as we dive into the world of cybersecurity! . . HackerOne Report: hackerone.com/reports/204703 . . . Blogs: med...
Web Cache Poisoning: Hunting Methodology & Real-World Examples
Переглядів 6 тис.3 місяці тому
This video explores the Web Cache Poisoning vulnerability in detail. We'll cover essential concepts such as web caching, cache keys, cache hits, cache misses, and cache busters. You’ll also learn how to identify this vulnerability in web applications, complete with practical examples. By the end of the video, you’ll have a comprehensive understanding of all the key concepts related to web cache...
The Danger of CWE-922 🎙 Snake Bytes Ep. 3: Data Dumpster
Переглядів 4534 місяці тому
In this episode, we’re talking about CWE-922: Insecure Storage of Sensitive Information is a vulnerability where sensitive data (such as passwords, API keys, or personal information) is stored without proper security measures. This can include using weak or no encryption, hardcoding sensitive information in files or source code, or storing such data in unprotected locations (like browser storag...
Loose Locks: A Podcast with _smile_hacker_ 🎙 : Snake Bytes Ep. 2
Переглядів 3555 місяців тому
In this episode of 'Loose Locks,' we dive into improper access control - a common security flaw where systems fail to restrict access to sensitive data or actions. Join us as we explore real-world examples, discuss why these vulnerabilities occur and how you can hunt for it. . . . Blogs: medusa0xf.medium.com/ . . . Social media of host: smilehaker.in/ x.com/_smile_hacker_ . . . Social Media: Tw...
How Missing Keys Leave Your Castle Open🎙 Snake Bytes Ep. 1: Barrier Bypass
Переглядів 3645 місяців тому
In this episode, we’re talking about CWE-862: Missing Authorization. This is when apps forget to check who’s allowed in, leaving doors wide open for attackers. We’ll cover how these gaps happen, how hackers take advantage, and what you can do to close them. Whether you’re securing your own apps or testing others, learn how to spot these mistakes and keep your systems locked tight. . . . Blogs: ...
How To Exploit SSRF To Fetch AWS Credentials
Переглядів 1,8 тис.6 місяців тому
This video covers SSRF vulnerability and how you can exploit it to fetch AWS meta data and credentials. . . . Blogs: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord: discord.com/invite/2PUPD3RHHs . . Links in the video: sirleeroyjenkins.medium.com/bypassing-ssrf-protection-to-exfiltrate-aws-metadata-from-larksuite-bf99a3599462 medium.com/@Parag_Bagul/ssrf...
OWASP API Top 10 - Broken Authentication
Переглядів 2,3 тис.6 місяців тому
This video covers OWASP API Top 10 Broken Authentication category with multiple cases and examples. . . . Blogs: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord: discord.com/invite/2PUPD3RHHs . . Links in the video: hackerone.com/reports/17474 hackerone.com/reports/284 hackerone.com/reports/341372#:~:text=URL: https://hackerone,100 www.akto.io/blog/twilio...
XSS Using Indirect Prompt Injection | PART 5
Переглядів 4466 місяців тому
In this video, we'll see how to perform an XSS attack using indirect prompt injection in LLM. It also contains a walkthrough of "PortSwigger Lab: Exploiting Insecure Output Handling in LLMs." . . . If you're interested in reading: medusa0xf.com/posts/exploiting-insecure-output-handling-in-llms/ . . . Blogs: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord:...
LLM API Hacking | Indirect Prompt Injection in LLM APIs | PART 4
Переглядів 6986 місяців тому
This video discusses Indirect Prompt Injection in LLM APIs. We'll explore how it happens and perform a practical lab to understand this vulnerability better. . . . If you're interested in reading: medusa0xf.com/posts/indirect-prompt-injection/ . . . Blogs: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord: discord.com/invite/2PUPD3RHHs . . Like and Subscrib...
LLM API Hacking | OS Command Injection in LLM APIs | PART 3
Переглядів 7117 місяців тому
LLM API Hacking | OS Command Injection in LLM APIs | PART 3
LLM API Hacking | Excessive Agency | PART 2
Переглядів 5977 місяців тому
LLM API Hacking | Excessive Agency | PART 2
LLM API Hacking | Introduction | PART 1
Переглядів 3,2 тис.7 місяців тому
LLM API Hacking | Introduction | PART 1
HTTP Parameter Pollution VS Mass Assignment
Переглядів 5498 місяців тому
HTTP Parameter Pollution VS Mass Assignment
IDOR In Shopify GraphQL API | Report Explained
Переглядів 9939 місяців тому
IDOR In Shopify GraphQL API | Report Explained
Server-Side Parameter Pollution in REST APIs
Переглядів 1,4 тис.11 місяців тому
Server-Side Parameter Pollution in REST APIs
Exploring Server-Side Parameter Pollution: Real Case Scenario, Parameter Precedence, and More!
Переглядів 77811 місяців тому
Exploring Server-Side Parameter Pollution: Real Case Scenario, Parameter Precedence, and More!
Bypassing GraphQL Brute-Force Protections
Переглядів 530Рік тому
Bypassing GraphQL Brute-Force Protections
Accidental Exposure of Private GraphQL Fields
Переглядів 368Рік тому
Accidental Exposure of Private GraphQL Fields
Exploiting Mass Assignment Vulnerability in API | PortSwigger
Переглядів 853Рік тому
Exploiting Mass Assignment Vulnerability in API | PortSwigger
How Can Fuzzing Help You Find Hidden API Endpoints?
Переглядів 7 тис.Рік тому
How Can Fuzzing Help You Find Hidden API Endpoints?
How Hackers Exploit API Endpoints Using Documentation?
Переглядів 6 тис.Рік тому
How Hackers Exploit API Endpoints Using Documentation?
beautifully explained
Great explanation but pls no music
If you don't mind, could you lower the volume of the background music, please? It's loud enough to distract me from the content 😊. BTW, great content. Well worth the time.
That's crazy cause i kept the volume 4%. And thank you!
@@Medusa0xf Probably because I had to pay more attention to the content. This vulnerability is a bad one
Queen 🫡❤️
Aw thank you!
Hi can you please tell which Software you use for making this voice its so realistic
Hello dear welcome back i always waiting for your videos
Thanks for being here!
thanks for the explanation i really enjoyed keep making videos
I'm glad you liked it, more videos coming soon!
study is boring, but because of your voice i always watch till end
simp
@@0xhakeem Bros trynna get foreign Cat
Awesome explanation 😍
Thank you!
Too good explanation ❤
Thank you!!
Love u
First! Love your material. Your explanations are so easy to understand.
Thank you so much, I appreciate it!
Do you prefer Postman over Burp Suite? Postman was kind of confusing for me at first. It took me while to get used to the platform.
do you ever use cURL in the terminal instead of Burp or Postman?
what's the anime name themed here? :)
Solo leveling and jujutsu Kaisan
🎉🎉🎉🎉
That’s amazing 🎉🎉🎉🎉
Thank you!
can you please make a video GraphQL series also
There's already a GraphQL Pentesting Playlist, Check here ua-cam.com/play/PL4wZd4YK_64HipHEe9XjOKadwJ773f2Jw.html
Thank you for uploading this video. I appreciate your willingness to share your knowledge. This video is an excellent resource for anyone interested in learning more about API security.
Glad to help!
1. flickering animations can cause epileptic episodes in some people. they are also kinda annoying (imo). 2. anime scenes are very distracting when learning something. but content & coverage is good! I know you are experimenting but I just wanted to leave some feedback since this seems like a nice channel to learn stuff.
Thanks for the feedback
love ur style plz stay consitent w uploads and ur voice is fyer
Thank you, I'll try my best to keep things consistent!
you a my hero!
Умничка, молодец, спасибо!
Согласен, один из лучших каналов по эксплуатации уязвимостей
<3 Thank You for making this
I'm glad you liked it!
Damm Good explanation, clear and loud ......... so underrated youtube channel
Thank you, I appreciate your support!
Thank you for this .
You're welcome!
Welcome back sister
Great 🎉
Thanks!
I'm from Angola and I love your videos. They help me to be more creative and give me a lot of knowledge. But you can also disable automatic dubbing.
Hey smooth explaintion, literally love your voicee❤️
Appreciate it, it took a lot of effort to put together!
smooth explanation with proper demonstration, amazing as always !!!
Thanks a lot!
Thank you
You're welcome!
Hiii🤗🤗♥️🌹
great explanation
I'm glad you liked it.
Medusa how about live hunting?
Not yet
I want AI AGENT to create an AI agent specifically for physical testing and load it into my KALI. This AI agent can load different local models and APIs to complete the penetration work together. I use natural language to give the purpose or select the AI agent to automatically help me complete the physical work. If I want to achieve such a function, what tools or models do I need to prepare? At the same time, I learned that there is a mature AI agent tool, autogen studio, which can be used to complete my connection with various AI modules. I hope you can make a video of AI agent or autogen studio building a penetration test AI module.
your voice is soo good,nice teaching...
Thank you! I'm glad you enjoyed it.
VERY GOOD EXPLANATION VIDEO . thanks for explaining it so nicely and so patiently and with example . thank you . i love your videos .
Thanks a lot, it took effort!
awesome video Great job.
Thank you! Glad you liked it.
What are you using the tool to find that at extension
Ffuf
What is Lucky13 vulnerability and side channel attack=>bit flip
Hi, great job, but you forgot to close the file. I use the 'with' context manager, so I don't need to worry about opening or closing the file.
Oh thank you, i missed
You managed to finish recording right before the battery dies
lol yes
Hey Medusa I’ve been following your content for a while now, and it’s seriously some of the best out there for ethical hacking. The depth and quality are unmatched. That said, I feel like a lot of it is geared towards people who already have a good understanding of the field. It would be awesome if you could do a video or series that breaks down the basics-like an introduction to ethical hacking, understanding cybersecurity, and Linux fundamentals. I think it’d really help beginners (like me) get a solid footing before jumping into the advanced stuff you do so well.
Hey, thank you, and you're right. My content is targeted towards people who are not complete beginners, but that's because there are already thousands of videos on beginner-level content and introductions to ethical hacking, which I didn't want to duplicate. However, if you have any questions, you can join my Discord server, where like-minded people and I will be happy to help.
Hope you are keeping well, great vid as awlays!
Thanks buddy!
best vedio appppi
hi, It was a great explanation. From where we can find these postman APIs? Can you please share the link?
Thank you, you can find the API collection here: github.com/erev0s/VAmPI
Instead of brupsuite can this be done with postman?
No, the features i should you is of BurpSuite extension itself and trust me it's way more easier.
how can i get your pc wallpaper
Screenshot it and do image search on google
It's from Wallpaper Engine
@@Medusa0xf Hi, can you do a video on discovering csrf in web app
Learning new things😊
Hi Medusa Can you upload a video on CSRF attack on a web application