Medusa
Medusa
  • 75
  • 143 011
Testing for Password Reset Poisoning in APIs – A Bug Hunter’s Guide
This video covers multiple methods to identify and exploit password reset poisoning vulnerabilities in web applications and APIs with deep analysis.
.
.
.
.
.
My Blog: medusa0xf.medium.com/
.
.
.
Social media:
Twitter: medusa_0xf
.
.
.
Discord: discord.com/invite/2PUPD3RHHs
.
.
.
Links in the Video:
github.com/projectdiscovery/interactsh
hackerone.com/reports/1108874
hackerone.com/reports/342693
shahjerry33.medium.com/http-parameter-pollution-its-contaminated-85edc0805654
hackerone.com/reports/106024
.
.
.
.
Introduction: 0:00
HTTP Host Header Injection: 0:13
Flow Analysis: 2:03
Method 1: 4:11
Method 2: 6:40
Method 3: 9:32
Final Thoughts: 11:31
.
.
.
Music by Karl Casey @ White Bat Audio
.
.
#owasp #jwt #api #subdomain #portswigger #bugbounty #bola #postman #podcast #pentesting #api #hack #bola #tryhackme #hackerone #apihacking #computerscience #javascript #python #postman #ctf #bughunting #pentesting #hacking #hackingtools #burpsuite #portswigger #ethicalhacking #OAuth #webhacking #programming #websecurity #technology #practical #artificialintelligence #web #recon #bypass
Переглядів: 1 315

Відео

OWASP API Top 10 Breakdown | Study Session with CTF Challenges (DVAPI)
Переглядів 1,3 тис.28 днів тому
In this video, we explore the OWASP API Top 10 in a fun way through a CTF, with each challenge addressing a specific vulnerability. We'll submit flags, try different tools, and have a fun study session. . . . . . My Blog: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord: discord.com/invite/2PUPD3RHHs . . . Links in the Video: github.com/payatu/DVAPI github...
Authentication Bypass Via JKU Header Injection | JWT Hacking
Переглядів 365Місяць тому
In this video, we explore the JKU Header Injection vulnerability and how it can be used to bypass authentication. You'll learn how attackers exploit this JSON Web Tokens (JWTs) flaw by creating their signing key, potentially gaining unauthorized access. . . . . . My Blog: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord: discord.com/invite/2PUPD3RHHs . . ....
Authentication Bypass Via JWK Header Injection | JWT Hacking
Переглядів 1 тис.2 місяці тому
In this video, we explore the JWK Header Injection vulnerability and how it can be used to bypass authentication. You'll learn how attackers exploit this JSON Web Tokens (JWTs) flaw by creating their signing key, potentially gaining unauthorized access. . . . . . My Blog: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord: discord.com/invite/2PUPD3RHHs . . ....
Subdomain Enumeration ALL KINDS!
Переглядів 1 тис.2 місяці тому
In this video, we dive deep into subdomain enumeration, exploring ALL KINDS of techniques and tools to uncover hidden subdomains. Whether you're a beginner or a seasoned cybersecurity professional, this video will help you understand how to efficiently gather subdomain information and identify potential security risks. . . . . . My Blog: medusa0xf.medium.com/ . . . Social media: Twitter: twitte...
Hunting Open Redirects: A Pathway to Chaining XSS
Переглядів 1,3 тис.3 місяці тому
This video explores open redirect vulnerabilities and how they can be exploited to chain XSS (Cross-Site Scripting) attacks. Learn how attackers can manipulate open redirects to bypass security filters and inject malicious scripts, creating serious security risks. Whether you're a penetration tester, developer, or security enthusiast, this video provides practical examples and demonstrations on...
Unmasking the Ghost: The CWE-352 Dilemma🎙 Snake Bytes Ep. 4: Web Ghosts
Переглядів 3153 місяці тому
In this episode of "Web Ghosts," we explore Cross-Site Request Forgery (CSRF) and how to find it. We’ll discuss how CSRF attacks work, share real-life examples, and their impact on websites. You’ll learn practical methods to spot these vulnerabilities and protect against them. Join us as we dive into the world of cybersecurity! . . HackerOne Report: hackerone.com/reports/204703 . . . Blogs: med...
Web Cache Poisoning: Hunting Methodology & Real-World Examples
Переглядів 6 тис.3 місяці тому
This video explores the Web Cache Poisoning vulnerability in detail. We'll cover essential concepts such as web caching, cache keys, cache hits, cache misses, and cache busters. You’ll also learn how to identify this vulnerability in web applications, complete with practical examples. By the end of the video, you’ll have a comprehensive understanding of all the key concepts related to web cache...
The Danger of CWE-922 🎙 Snake Bytes Ep. 3: Data Dumpster
Переглядів 4534 місяці тому
In this episode, we’re talking about CWE-922: Insecure Storage of Sensitive Information is a vulnerability where sensitive data (such as passwords, API keys, or personal information) is stored without proper security measures. This can include using weak or no encryption, hardcoding sensitive information in files or source code, or storing such data in unprotected locations (like browser storag...
Loose Locks: A Podcast with _smile_hacker_ 🎙 : Snake Bytes Ep. 2
Переглядів 3555 місяців тому
In this episode of 'Loose Locks,' we dive into improper access control - a common security flaw where systems fail to restrict access to sensitive data or actions. Join us as we explore real-world examples, discuss why these vulnerabilities occur and how you can hunt for it. . . . Blogs: medusa0xf.medium.com/ . . . Social media of host: smilehaker.in/ x.com/_smile_hacker_ . . . Social Media: Tw...
How Missing Keys Leave Your Castle Open🎙 Snake Bytes Ep. 1: Barrier Bypass
Переглядів 3645 місяців тому
In this episode, we’re talking about CWE-862: Missing Authorization. This is when apps forget to check who’s allowed in, leaving doors wide open for attackers. We’ll cover how these gaps happen, how hackers take advantage, and what you can do to close them. Whether you’re securing your own apps or testing others, learn how to spot these mistakes and keep your systems locked tight. . . . Blogs: ...
How To Exploit SSRF To Fetch AWS Credentials
Переглядів 1,8 тис.6 місяців тому
This video covers SSRF vulnerability and how you can exploit it to fetch AWS meta data and credentials. . . . Blogs: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord: discord.com/invite/2PUPD3RHHs . . Links in the video: sirleeroyjenkins.medium.com/bypassing-ssrf-protection-to-exfiltrate-aws-metadata-from-larksuite-bf99a3599462 medium.com/@Parag_Bagul/ssrf...
OWASP API Top 10 - Broken Authentication
Переглядів 2,3 тис.6 місяців тому
This video covers OWASP API Top 10 Broken Authentication category with multiple cases and examples. . . . Blogs: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord: discord.com/invite/2PUPD3RHHs . . Links in the video: hackerone.com/reports/17474 hackerone.com/reports/284 hackerone.com/reports/341372#:~:text=URL: https://hackerone,100 www.akto.io/blog/twilio...
XSS Using Indirect Prompt Injection | PART 5
Переглядів 4466 місяців тому
In this video, we'll see how to perform an XSS attack using indirect prompt injection in LLM. It also contains a walkthrough of "PortSwigger Lab: Exploiting Insecure Output Handling in LLMs." . . . If you're interested in reading: medusa0xf.com/posts/exploiting-insecure-output-handling-in-llms/ . . . Blogs: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord:...
LLM API Hacking | Indirect Prompt Injection in LLM APIs | PART 4
Переглядів 6986 місяців тому
This video discusses Indirect Prompt Injection in LLM APIs. We'll explore how it happens and perform a practical lab to understand this vulnerability better. . . . If you're interested in reading: medusa0xf.com/posts/indirect-prompt-injection/ . . . Blogs: medusa0xf.medium.com/ . . . Social media: Twitter: medusa_0xf . . . Discord: discord.com/invite/2PUPD3RHHs . . Like and Subscrib...
LLM API Hacking | OS Command Injection in LLM APIs | PART 3
Переглядів 7117 місяців тому
LLM API Hacking | OS Command Injection in LLM APIs | PART 3
LLM API Hacking | Excessive Agency | PART 2
Переглядів 5977 місяців тому
LLM API Hacking | Excessive Agency | PART 2
LLM API Hacking | Introduction | PART 1
Переглядів 3,2 тис.7 місяців тому
LLM API Hacking | Introduction | PART 1
HTTP Parameter Pollution VS Mass Assignment
Переглядів 5498 місяців тому
HTTP Parameter Pollution VS Mass Assignment
IDOR In Shopify GraphQL API | Report Explained
Переглядів 9939 місяців тому
IDOR In Shopify GraphQL API | Report Explained
Server-Side Parameter Pollution in REST APIs
Переглядів 1,4 тис.11 місяців тому
Server-Side Parameter Pollution in REST APIs
Exploring Server-Side Parameter Pollution: Real Case Scenario, Parameter Precedence, and More!
Переглядів 77811 місяців тому
Exploring Server-Side Parameter Pollution: Real Case Scenario, Parameter Precedence, and More!
Performing CSRF exploits over GraphQL
Переглядів 799Рік тому
Performing CSRF exploits over GraphQL
Bypassing GraphQL Brute-Force Protections
Переглядів 530Рік тому
Bypassing GraphQL Brute-Force Protections
Finding a Hidden GraphQL Endpoint
Переглядів 697Рік тому
Finding a Hidden GraphQL Endpoint
Accidental Exposure of Private GraphQL Fields
Переглядів 368Рік тому
Accidental Exposure of Private GraphQL Fields
Accessing Private GraphQL Fields
Переглядів 467Рік тому
Accessing Private GraphQL Fields
Exploiting Mass Assignment Vulnerability in API | PortSwigger
Переглядів 853Рік тому
Exploiting Mass Assignment Vulnerability in API | PortSwigger
How Can Fuzzing Help You Find Hidden API Endpoints?
Переглядів 7 тис.Рік тому
How Can Fuzzing Help You Find Hidden API Endpoints?
How Hackers Exploit API Endpoints Using Documentation?
Переглядів 6 тис.Рік тому
How Hackers Exploit API Endpoints Using Documentation?

КОМЕНТАРІ

  • @mamuli01
    @mamuli01 День тому

    beautifully explained

  • @michaelnieves8087
    @michaelnieves8087 2 дні тому

    Great explanation but pls no music

  • @5s4l1p1fcw
    @5s4l1p1fcw 3 дні тому

    If you don't mind, could you lower the volume of the background music, please? It's loud enough to distract me from the content 😊. BTW, great content. Well worth the time.

    • @Medusa0xf
      @Medusa0xf 2 дні тому

      That's crazy cause i kept the volume 4%. And thank you!

    • @5s4l1p1fcw
      @5s4l1p1fcw День тому

      @@Medusa0xf Probably because I had to pay more attention to the content. This vulnerability is a bad one

  • @0xEsso
    @0xEsso 8 днів тому

    Queen 🫡❤️

  • @om3726
    @om3726 8 днів тому

    Hi can you please tell which Software you use for making this voice its so realistic

  • @aechapark4299
    @aechapark4299 9 днів тому

    Hello dear welcome back i always waiting for your videos

    • @Medusa0xf
      @Medusa0xf 2 дні тому

      Thanks for being here!

  • @youcefjoseph674
    @youcefjoseph674 9 днів тому

    thanks for the explanation i really enjoyed keep making videos

    • @Medusa0xf
      @Medusa0xf 2 дні тому

      I'm glad you liked it, more videos coming soon!

  • @0xanupam
    @0xanupam 9 днів тому

    study is boring, but because of your voice i always watch till end

    • @0xhakeem
      @0xhakeem 9 днів тому

      simp

    • @om3726
      @om3726 8 днів тому

      @@0xhakeem Bros trynna get foreign Cat

  • @jogendraprasadsabar3706
    @jogendraprasadsabar3706 9 днів тому

    Awesome explanation 😍

  • @smilehackermax
    @smilehackermax 9 днів тому

    Too good explanation ❤

  • @Shintowel
    @Shintowel 9 днів тому

    Love u

  • @MichaelCooter
    @MichaelCooter 9 днів тому

    First! Love your material. Your explanations are so easy to understand.

    • @Medusa0xf
      @Medusa0xf 2 дні тому

      Thank you so much, I appreciate it!

  • @didyouknowamazingfacts2790
    @didyouknowamazingfacts2790 10 днів тому

    Do you prefer Postman over Burp Suite? Postman was kind of confusing for me at first. It took me while to get used to the platform.

    • @MNaeem5
      @MNaeem5 3 дні тому

      do you ever use cURL in the terminal instead of Burp or Postman?

  • @b4dboy_17
    @b4dboy_17 10 днів тому

    what's the anime name themed here? :)

    • @Medusa0xf
      @Medusa0xf 2 дні тому

      Solo leveling and jujutsu Kaisan

  • @razmjumehdi9069
    @razmjumehdi9069 15 днів тому

    🎉🎉🎉🎉

  • @razmjumehdi9069
    @razmjumehdi9069 15 днів тому

    That’s amazing 🎉🎉🎉🎉

  • @sabyasachisahoo8975
    @sabyasachisahoo8975 20 днів тому

    can you please make a video GraphQL series also

    • @Medusa0xf
      @Medusa0xf 13 днів тому

      There's already a GraphQL Pentesting Playlist, Check here ua-cam.com/play/PL4wZd4YK_64HipHEe9XjOKadwJ773f2Jw.html

  • @sabyasachisahoo8975
    @sabyasachisahoo8975 20 днів тому

    Thank you for uploading this video. I appreciate your willingness to share your knowledge. This video is an excellent resource for anyone interested in learning more about API security.

  • @abhishek_k7
    @abhishek_k7 21 день тому

    1. flickering animations can cause epileptic episodes in some people. they are also kinda annoying (imo). 2. anime scenes are very distracting when learning something. but content & coverage is good! I know you are experimenting but I just wanted to leave some feedback since this seems like a nice channel to learn stuff.

    • @Medusa0xf
      @Medusa0xf 12 днів тому

      Thanks for the feedback

  • @GreatAllen-p4m
    @GreatAllen-p4m 24 дні тому

    love ur style plz stay consitent w uploads and ur voice is fyer

    • @Medusa0xf
      @Medusa0xf 12 днів тому

      Thank you, I'll try my best to keep things consistent!

  • @starwin1159
    @starwin1159 25 днів тому

    you a my hero!

  • @ЛеонидГалянов-п6д
    @ЛеонидГалянов-п6д 26 днів тому

    Умничка, молодец, спасибо!

    • @alekseiperov6932
      @alekseiperov6932 25 днів тому

      Согласен, один из лучших каналов по эксплуатации уязвимостей

  • @haanrey
    @haanrey 28 днів тому

    <3 Thank You for making this

    • @Medusa0xf
      @Medusa0xf 12 днів тому

      I'm glad you liked it!

  • @HiteshSharma-e9w
    @HiteshSharma-e9w 29 днів тому

    Damm Good explanation, clear and loud ......... so underrated youtube channel

    • @Medusa0xf
      @Medusa0xf 12 днів тому

      Thank you, I appreciate your support!

  • @SundayRodr
    @SundayRodr 29 днів тому

    Thank you for this .

  • @aechapark4299
    @aechapark4299 29 днів тому

    Welcome back sister

  • @codingislife5189
    @codingislife5189 29 днів тому

    Great 🎉

  • @SrRoot00
    @SrRoot00 29 днів тому

    I'm from Angola and I love your videos. They help me to be more creative and give me a lot of knowledge. But you can also disable automatic dubbing.

  • @Massthamizhan
    @Massthamizhan Місяць тому

    Hey smooth explaintion, literally love your voicee❤️

    • @Medusa0xf
      @Medusa0xf 12 днів тому

      Appreciate it, it took a lot of effort to put together!

  • @remonsec
    @remonsec Місяць тому

    smooth explanation with proper demonstration, amazing as always !!!

  • @0xbeven462
    @0xbeven462 Місяць тому

    Thank you

  • @serverroot8361
    @serverroot8361 Місяць тому

    Hiii🤗🤗♥️🌹

  • @rlsn-kali
    @rlsn-kali Місяць тому

    great explanation

    • @Medusa0xf
      @Medusa0xf 12 днів тому

      I'm glad you liked it.

  • @unknown9860
    @unknown9860 Місяць тому

    Medusa how about live hunting?

  • @jingdongli2573
    @jingdongli2573 Місяць тому

    I want AI AGENT to create an AI agent specifically for physical testing and load it into my KALI. This AI agent can load different local models and APIs to complete the penetration work together. I use natural language to give the purpose or select the AI ​​agent to automatically help me complete the physical work. If I want to achieve such a function, what tools or models do I need to prepare? At the same time, I learned that there is a mature AI agent tool, autogen studio, which can be used to complete my connection with various AI modules. I hope you can make a video of AI agent or autogen studio building a penetration test AI module.

  • @Massthamizhan
    @Massthamizhan Місяць тому

    your voice is soo good,nice teaching...

    • @Medusa0xf
      @Medusa0xf Місяць тому

      Thank you! I'm glad you enjoyed it.

  • @haanrey
    @haanrey Місяць тому

    VERY GOOD EXPLANATION VIDEO . thanks for explaining it so nicely and so patiently and with example . thank you . i love your videos .

    • @Medusa0xf
      @Medusa0xf Місяць тому

      Thanks a lot, it took effort!

  • @AlisonBurger-l7j
    @AlisonBurger-l7j Місяць тому

    awesome video Great job.

    • @Medusa0xf
      @Medusa0xf Місяць тому

      Thank you! Glad you liked it.

  • @FUTURE-SMART
    @FUTURE-SMART Місяць тому

    What are you using the tool to find that at extension

  • @Hreem298
    @Hreem298 Місяць тому

    What is Lucky13 vulnerability and side channel attack=>bit flip

  • @code_way_ua
    @code_way_ua Місяць тому

    Hi, great job, but you forgot to close the file. I use the 'with' context manager, so I don't need to worry about opening or closing the file.

    • @Medusa0xf
      @Medusa0xf Місяць тому

      Oh thank you, i missed

  • @vuufke4327
    @vuufke4327 Місяць тому

    You managed to finish recording right before the battery dies

  • @Ibn_fazeel
    @Ibn_fazeel Місяць тому

    Hey Medusa I’ve been following your content for a while now, and it’s seriously some of the best out there for ethical hacking. The depth and quality are unmatched. That said, I feel like a lot of it is geared towards people who already have a good understanding of the field. It would be awesome if you could do a video or series that breaks down the basics-like an introduction to ethical hacking, understanding cybersecurity, and Linux fundamentals. I think it’d really help beginners (like me) get a solid footing before jumping into the advanced stuff you do so well.

    • @Medusa0xf
      @Medusa0xf Місяць тому

      Hey, thank you, and you're right. My content is targeted towards people who are not complete beginners, but that's because there are already thousands of videos on beginner-level content and introductions to ethical hacking, which I didn't want to duplicate. However, if you have any questions, you can join my Discord server, where like-minded people and I will be happy to help.

  • @alfonzo7822
    @alfonzo7822 Місяць тому

    Hope you are keeping well, great vid as awlays!

  • @asfdfuck
    @asfdfuck 2 місяці тому

    best vedio appppi

  • @vidhijain3362
    @vidhijain3362 2 місяці тому

    hi, It was a great explanation. From where we can find these postman APIs? Can you please share the link?

    • @Medusa0xf
      @Medusa0xf Місяць тому

      Thank you, you can find the API collection here: github.com/erev0s/VAmPI

  • @pokiri4747
    @pokiri4747 2 місяці тому

    Instead of brupsuite can this be done with postman?

    • @Medusa0xf
      @Medusa0xf Місяць тому

      No, the features i should you is of BurpSuite extension itself and trust me it's way more easier.

  • @0xanupam
    @0xanupam 2 місяці тому

    how can i get your pc wallpaper

    • @c_war
      @c_war 2 місяці тому

      Screenshot it and do image search on google

    • @Medusa0xf
      @Medusa0xf 2 місяці тому

      It's from Wallpaper Engine

    • @laxmivempati2250
      @laxmivempati2250 Місяць тому

      @@Medusa0xf Hi, can you do a video on discovering csrf in web app

  • @superman1337H
    @superman1337H 2 місяці тому

    Learning new things😊

  • @laxmivempati2250
    @laxmivempati2250 2 місяці тому

    Hi Medusa Can you upload a video on CSRF attack on a web application