Thanks for this lecture, I was learning about IDOR from portswigger but your video explainer really has help to understand why IDOR exist in the first place. May be my next bounty would come from IDOR.
Huge thanks for the awesome video walkthrough on bug bounty hunting and access control! It was seriously eye-opening, and I learned so much from your clear explanations and practical example.
Really awesome content! I am currently working on a video explaining IDOR and showing how we can find these types of vulnerabilities using Autorize. Do you use Authorize? I find it really useful.
thank u so much for this great content! does companies paid bug bounties for discoveries like ID database exposure? like the example you have around ID (12) and the UUID as key id to look for data in database.
Does IDOR and BOLA same thing? If not, what's the difference between them? While showing IDOR, the user was accessing another user's document at 5:40, while discussing BOLA at 8:30, it sounded like the same thing. Can anybody explain it further?
Thanks for this lecture, although I had a question. This attack scenario relies on an attacker being able to retrieve the victims "Session Key" value. If we are not able to get the session key, then it is not a vulnerability, right?
Afraid not, your best bet if to see if you can do some cross user interaction (do something on account A when using account Bs session) or generate a session for any user
Hi, I'm new to the world of security administration, and I was hoping to get some guidance from someone with your expertise. Do you have any advice on mapping out a career path in this area?
You don’t: all you’re doing is simulating logging into another account and performing actions on the first account. You don’t need As cookies to affect account A.
@@InsiderPhD then this is not a access control because there is no any security impact on the account without Knowing their credentials how to get their session key
Hello Mam, I don't have laptop or Computer. So how can I hack through phone can you please give me advice. And how we can find secrets leaks in github please give me some suggestions.
GitHub secrets there's a tool called trufflehog which can do it for you. How to use your phone, I am not an expert but a lot of people recommend googledorking, you'll probably get more luck on twitter :)
Yeah sorry about that, videos have to go through my own editing, plus bugcrowd's review and since we're in Australia, the US and UK timezones don't always quite match up for weekend releases!
Hi Kattie! I watch a lot of your videos and I keep watching them and learning! I don't know if i this video, but I came here to tell you that I found my first IDOR and looks quite serious because I can log in other users account too! Thank you so mucho for your content and This course is great!
hi! at 18:22 how changing cookie of another user and get his access! how it is a vulnerability?? i think it is a normal cookie behaviour because it is used to identify user... i was reported that type of report but it was rejected...
Because we are using the cookies of account A to affect account B, it's the ability to change a resource owned by another user. If you're using the cookies of A and affecting resources owned by that user it's not a vulnerability which is why your report was rejected. We change the cookies because it's easier than logging out of one account, logging in to another, every single endpoint
The video is truly awesome! In the 'Account Containers' section, you mentioned that you'll provide a method in the description to match the Burp Suite pad with the Firefox Multi-Account Containers. Could you please share the details? Thanks in advance!
I sincerely hope you know how much your videos are helping me on my journey. Thank you 🙏
Thanks for this lecture, I was learning about IDOR from portswigger but your video explainer really has help to understand why IDOR exist in the first place.
May be my next bounty would come from IDOR.
Hello zafar,
Can we find through mobile phone.
@@SyedImran-qf1eh I am not sure; i only do
bug hunting through my Laptop
which has Kali linux installed.
Okay,
How we find through Kali Linux.
I heard that we need burp suite software to find vulnerabilitys.
@@SyedImran-qf1eh This chennel has already made good videos on how to use burp suite.
ua-cam.com/video/UgbYozI436M/v-deo.html
hello how i can contact you im beginner i have alot of qst if u answer me i'll be happy & thank you brother
Huge thanks for the awesome video walkthrough on bug bounty hunting and access control! It was seriously eye-opening, and I learned so much from your clear explanations and practical example.
Keep the Bug Bounty videos coming!
Wow this took like forever to come out glad it came .
literally you are the best !!
please keep on posting Bug Bounty videos
I can’t thank you enough for these!
Today is a beautiful holiday.And the second thing is the expected video, thank you very much❤❤❤❤❤❤
Really awesome content! I am currently working on a video explaining IDOR and showing how we can find these types of vulnerabilities using Autorize. Do you use Authorize? I find it really useful.
I do! I actually made a video about it, I wish they fixed the bad UI though, it's super confusing for beginners
Great content Thank you for all these videos really helped me through my journey
You are excellent.
Thank you Ma for the update
thank u so much for this great content!
does companies paid bug bounties for discoveries like ID database exposure? like the example you have around ID (12) and the UUID as key id to look for data in database.
Not usually but if you find an IDOR on a app that uses UUID you can boost the severity
thanks for this content i find a bug and reported my job is done
thank you so much for this video!!
Does IDOR and BOLA same thing? If not, what's the difference between them?
While showing IDOR, the user was accessing another user's document at 5:40, while discussing BOLA at 8:30, it sounded like the same thing. Can anybody explain it further?
IDOR and BOLA are the same.
@@chabuhi yeah, I googled about it and found out similar answers. Thanks buddy.
Thanks for this lecture, although I had a question.
This attack scenario relies on an attacker being able to retrieve the victims "Session Key" value.
If we are not able to get the session key, then it is not a vulnerability, right?
Afraid not, your best bet if to see if you can do some cross user interaction (do something on account A when using account Bs session) or generate a session for any user
thank you so much
Hi, I'm new to the world of security administration, and I was hoping to get some guidance from someone with your expertise. Do you have any advice on mapping out a career path in this area?
thank you
You change A's cookie to B's cookie. But how to attacker find victim user cookies? Please reply. Thanks❤
You don’t: all you’re doing is simulating logging into another account and performing actions on the first account. You don’t need As cookies to affect account A.
@@InsiderPhD then this is not a access control because there is no any security impact on the account without Knowing their credentials how to get their session key
I'f the accsses control manufactor is known you can just look up engineer code and your in.
Love from india sister ❤❤❤
Hello Mam,
I don't have laptop or Computer. So how can I hack through phone can you please give me advice.
And how we can find secrets leaks in github please give me some suggestions.
GitHub secrets there's a tool called trufflehog which can do it for you.
How to use your phone, I am not an expert but a lot of people recommend googledorking, you'll probably get more luck on twitter :)
@@InsiderPhD thanks for the replying.
I'm first 😂❤ Love your content 😊
Aww I was just 5 min late
Pokémon! Hehe. #90sKidHere.
Early 🔥🤝
Thank ma'am please share the video early as possible so we follow in certain time because some video are in the more days gap
Yeah sorry about that, videos have to go through my own editing, plus bugcrowd's review and since we're in Australia, the US and UK timezones don't always quite match up for weekend releases!
I like how the database at 7:22 has customer table with characters from Simpsons, Futurama and Family guy.
This video is very useful for me.. 💗 Please complete this bug bounty hunting Crouse.
Hi Kattie! I watch a lot of your videos and I keep watching them and learning! I don't know if i this video, but I came here to tell you that I found my first IDOR and looks quite serious because I can log in other users account too! Thank you so mucho for your content and This course is great!
love your British accent
Busted!!!🔥🔥🔥looking for more videos like this🔥🔥🔥🔥
I just started in this career. Few days ago the magic of the algorithm put me your awesome content. Thanks for share 💚
Saludos
IM Definitly marrying someone with the same accent that you have
hi! at 18:22 how changing cookie of another user and get his access! how it is a vulnerability??
i think it is a normal cookie behaviour because it is used to identify user... i was reported that type of report but it was rejected...
Because we are using the cookies of account A to affect account B, it's the ability to change a resource owned by another user. If you're using the cookies of A and affecting resources owned by that user it's not a vulnerability which is why your report was rejected. We change the cookies because it's easier than logging out of one account, logging in to another, every single endpoint
thanks
The video is truly awesome! In the 'Account Containers' section, you mentioned that you'll provide a method in the description to match the Burp Suite pad with the Firefox Multi-Account Containers. Could you please share the details? Thanks in advance!
“PwnFox” full video should be out in a week or so :)
How user B find user A job request..how it possible??🙄
You create both users :), it simulates you knowing the request + any parameters but being able to affect another account