InsiderPhD
InsiderPhD
  • 102
  • 1 959 835
Should I report this vulnerability? Will I get a bounty?
It’s really exciting to find your first bug BUT it’s crushing when you realise it isn’t reportable or comes back as NA from a client. Here are my top tips for identifying if you’ve found something and double checking before getting caught up in excitement! I still get emails about IDORs being NA because you need a victims cookie and hackers who are angry at bug bounty programs or triagers.
zhlédnutí: 2 548

Video

How to take notes when you suck at it
zhlédnutí 12KPřed 5 měsíci
This episode of the Bug Bounty course we talk about the importance of developing a personal note taking system that supports both hacking and learning. Emphasizing the differentiation between notes taken during hacking activities and those for learning about vulnerabilities. We look at methods for organizing and accessing your notes whether you are into Notion, Obsidian or Vim or even mind maps...
Approaching Large Scope Targets Without Feeling Overwhelmed
zhlédnutí 4,7KPřed 7 měsíci
In this video, we discuss how beginners can tackle large scope targets in bug bounty hunting. These targets offer more flexibility and potential for bug discovery, making them a great starting point for new hackers. However, they can be overwhelming due to their size and diversity. We suggest focusing on one part of the larger scope, which helps you understand the target's application developme...
New OWASP API Top 10 for Hackers
zhlédnutí 9KPřed 7 měsíci
Blog article isn’t done yet but I’ll get it up ASAP! Today we explore the new OWASP API Top 10 in detail, the new version is much more hacker friendly and focuses on bugs we can find rather than defenders but how can we start to study these bugs and actually find them? Let’s take a look at some of the changes in the new OWASP API top 10 2023, which ones I recommend for beginners just starting o...
E-commerce Flaws and $500-1000 Bounties
zhlédnutí 4,3KPřed 7 měsíci
We're continuing our stories of bad bugs theme with some business logic flaws. Unfortunately, I couldn't find the link to the whitepaper with the e-commerce flaws, but I remember it being quantity manipulation, price manipulation by changing the currency and guessing giftcards. In today's video we look at a pretty basic authentication issue, a pretty boring price manipulation issue and end with...
TryHackMe Advent Of Cyber Day 20 - DevSecOps
zhlédnutí 12KPřed 8 měsíci
DevSecOps has enabled developers to be much more efficient, committing code and deploying it automatically, but it's a fantastic tool for us to go exploring and hacking in their pipelines! Advent of cyber is a yearly event run by TryHackMe, there are 24 days of cyber security challenges in December AND prizes for competing. Last year I finished every challenge soooooo, I think it’s good. If you...
Updated Beginners Guide to API Bug Bounty
zhlédnutí 13KPřed 8 měsíci
If you’re just getting started with bug bounty hunting, web APIs are a fantastic place to start, they’re easy to approach, can’t easily be automated and are full of bugs. Join the free, API security live class on Zoom webinars www.traceable.ai/resources/lp/webinar-api-security-masterclass? This series couldn't happen without the support of our sponsor Bugcrowd, Bugcrowd is the best place to sta...
What Can an Attacker Actually Do With a Bug Anyway?
zhlédnutí 1,5KPřed 8 měsíci
We explore the significance of understanding and explaining the impact of vulnerabilities in a bug bounty context. Using Flare.io, to peek into the dark web and see what attackers are actually doing with our vulnerabilities. We cover different vulnerabilities, provide guidelines on creating an effective impact statement, and offer three examples of impactful bug bounty reports. Before I give yo...
TryHackMe Advent Of Cyber Day 10 - SQL Injection
zhlédnutí 20KPřed 8 měsíci
Today we escalate a SQL injection vulnerability into a RCE, and explore MS SQL Server Advent of cyber is a yearly event run by TryHackMe, there are 24 days of cyber security challenges in December AND prizes for competing. Last year I finished every challenge soooooo, I think it’s good. If you want to compete, join using this link: tryhackme.com/r/christmas
TryHackMe Advent Of Cyber Day 7 - Log Analysis
zhlédnutí 17KPřed 8 měsíci
Today we abandon our red hats for the day and dive into the blue team, there’s a piece of malware on the network, but how can we tell? Well it’s time for us to dive into proxy logs and the cut command to find out! Advent of cyber is a yearly event run by TryHackMe, there are 24 days of cyber security challenges in December AND prizes for competing. Last year I finished every challenge soooooo, ...
Hacking when all the bugs have been found?
zhlédnutí 5KPřed 8 měsíci
Finding bugs on the main app is something a lot of people are a little afraid of, a lot of people think that if a program has been out a while that there's no point even looking at it. But actually the majority of my bugs have actually been on the main application and rarely do I write off a program as unhackable. As you all know by now recon is definitely one of my weakest skills, so here are ...
Giving Yourself the Best Opportunity to Find a Bug
zhlédnutí 6KPřed 8 měsíci
I get asked a lot how do you choose a target you can actually find bugs on and get bounties, so I've compiled a lot of my tips for choosing a target and how to use bugcrowd features (like joinable programs) to make it so you aren't reliant on the right program coming through on luck. So here's how to choose a target on Bugcrowd and some general advice on some of the things I look for in a good ...
3 Real API Bugs I got a bounty for
zhlédnutí 9KPřed 10 měsíci
3 Real API Bugs I got a bounty for
Here are 3 bugs I’ve Found with Recon (and how I hacked them)
zhlédnutí 4,5KPřed 10 měsíci
Here are 3 bugs I’ve Found with Recon (and how I hacked them)
Finding Your First API Bug (NahamCon 2023)
zhlédnutí 11KPřed rokem
Finding Your First API Bug (NahamCon 2023)
Learn Bug Bounty Hunting with These Resources!
zhlédnutí 14KPřed rokem
Learn Bug Bounty Hunting with These Resources!
Revealing Secrets with Information Disclosure Bugs
zhlédnutí 7KPřed rokem
Revealing Secrets with Information Disclosure Bugs
Stored, Blind, Reflected and DOM - Everything Cross--Site Scripting (XSS)
zhlédnutí 9KPřed rokem
Stored, Blind, Reflected and DOM - Everything Cross Site Scripting (XSS)
"Easiest" Beginner Bugs? Access Control and IDORs
zhlédnutí 20KPřed rokem
"Easiest" Beginner Bugs? Access Control and IDORs
My Hacking Setup and How to Use It (Firefox/Burp Community)
zhlédnutí 17KPřed rokem
My Hacking Setup and How to Use It (Firefox/Burp Community)
Why does DNS always break the internet?
zhlédnutí 10KPřed rokem
Why does DNS always break the internet?
How does Bug Bounty work anyway?
zhlédnutí 24KPřed rokem
How does Bug Bounty work anyway?
Advent of Cyber 2022: Day 17 Filtering for Order Amidst Chaos (Walkthrough)
zhlédnutí 12KPřed rokem
Advent of Cyber 2022: Day 17 Filtering for Order Amidst Chaos (Walkthrough)
Advent of Cyber 2022: Day 16 SQLi’s the king, the carolers sing (Walkthrough)
zhlédnutí 14KPřed rokem
Advent of Cyber 2022: Day 16 SQLi’s the king, the carolers sing (Walkthrough)
Advent of Cyber 2022: Day 15 Santa is looking for a Sidekick (Walkthrough)
zhlédnutí 13KPřed rokem
Advent of Cyber 2022: Day 15 Santa is looking for a Sidekick (Walkthrough)
How to Use Bug Bounty to Help Your Career!
zhlédnutí 10KPřed 2 lety
How to Use Bug Bounty to Help Your Career!
My API Testing Automated Toolbox
zhlédnutí 17KPřed 2 lety
My API Testing Automated Toolbox
Escalating Your Bugs With GDPR Impact
zhlédnutí 2,8KPřed 2 lety
Escalating Your Bugs With GDPR Impact
Easy IDOR hunting with Autorize? (GIVEAWAY)
zhlédnutí 34KPřed 2 lety
Easy IDOR hunting with Autorize? (GIVEAWAY)
Try Hack Me: Advent of Cyber 2021 - Day 3
zhlédnutí 26KPřed 2 lety
Try Hack Me: Advent of Cyber 2021 - Day 3

Komentáře

  • @ulkeshchaugule3615
    @ulkeshchaugule3615 Před 3 dny

    Love from INDIA you too good in APIs

  • @lsik231l
    @lsik231l Před 5 dny

    For hierarchical note-taking, I use selfhost bookstack. On the fly note-taking, I'm starting to use Obsidian. You don't have to pay for the syncing feature if you get creative with your vault storage.

  • @Abood-wn1fi
    @Abood-wn1fi Před 6 dny

    Please make shorts for api hacking. Also the audio is not clear ☺️

  • @ak0904
    @ak0904 Před 13 dny

    I also found a business logic issue in Apple , but sadly it's not their bounty category 😞, but still got credited though.

  • @linuxluminary
    @linuxluminary Před 19 dny

    Thank you so much for the motivation, I started bug hunting on bugcrowd in July and so far I have reported over 15 bugs and all of them got either duplicate or information or not applicable. I am watching your videos to get motivated 😉😉😉

  • @hzhz9013
    @hzhz9013 Před 20 dny

    alot of thx katie ❤️❤️❤️

  • @ce_cabeza
    @ce_cabeza Před 21 dnem

    You never finished the series 😭😅

  • @user-fp7fs9xl2t
    @user-fp7fs9xl2t Před 21 dnem

    thanks for sharing your knowledge , God bless you

  • @khai-vq5hn
    @khai-vq5hn Před 27 dny

    Burpsuite! #bbhammer

  • @vipracitti
    @vipracitti Před 27 dny

    It's been a week I have been watching these videos but got overwhelmed because most of Researchers assume one might know about these starting points and got lost in all this process. Your video really help in clearing my mind and for that Thanks a lot. Really appreciate your efforts in producing such easy to understand content.

  • @saikirangoud118
    @saikirangoud118 Před 28 dny

    great video

  • @georgepagel7706
    @georgepagel7706 Před 28 dny

    OWASP web security testing guide has been useful for me as a checklist going through an app. 23:57

  • @ihebhamad1477
    @ihebhamad1477 Před měsícem

    Thank you for this great explanation

  • @helalsadat2077
    @helalsadat2077 Před měsícem

    i have watched this video 1 and half month ago and i was able to identify a function prone to IDOR , i spent 20 days on that function and at the End i was able to bypass the access controls and view invoices, billing addresses, finance records, my report is triaged and waiting for bounty , thank you this video really gave me an Idea where to look for IDORs :) , But now i am watching it again since i started API hacking and i hope i will learn something new again in this video about API hacking

  • @helalsadat2077
    @helalsadat2077 Před měsícem

    for those who want to make word list of get a good word list i would recommend asset notes API routes word list it's really big and give really good results , Happy API Hacking

  • @helalsadat2077
    @helalsadat2077 Před měsícem

    I have watched the Full video , Thank you very much Katie , I am Regularly following this playlist of API Hacking

  • @ahmedezealdean6189
    @ahmedezealdean6189 Před měsícem

    Bussiness Logic errors are so similar to IDORS, and according the web applications hacker handsbook it a type of IDOR.

  • @helalsadat2077
    @helalsadat2077 Před měsícem

    Starting TOday Lets rock and roll :))

  • @M3dU5aXX_Ray_Tierney
    @M3dU5aXX_Ray_Tierney Před měsícem

    Katie, you are a life saver!!! I could not wrap my brain around these for college exam!!❤🎉

  • @dukedud9743
    @dukedud9743 Před měsícem

    1- finding ur first bug 2- firefox containers 3- api top 10 4- api enumeration

  • @x7331x
    @x7331x Před měsícem

    Great content, congratulations!

  • @x7331x
    @x7331x Před měsícem

    Great video and tutorial, thanks for doing that!

  • @chetansalunke9632
    @chetansalunke9632 Před měsícem

    How to fuźz with the list of urls .txt with ffuf??

  • @flavioferlin3127
    @flavioferlin3127 Před měsícem

    Howdy to all. Dear Katie, bless your heart. Thank you, kudos.

  • @helalsadat2077
    @helalsadat2077 Před měsícem

    By Learning From You , You Will See One Day i Will Tag You in a Tweet , thank you very much i am learning alot about API hacking From your videos and Corey J Ball's Book , Lot Of Love and Respect , God Bless You

  • @V.WalkingTours
    @V.WalkingTours Před měsícem

    Hi Kattie! I watch a lot of your videos and I keep watching them and learning! I don't know if i this video, but I came here to tell you that I found my first IDOR and looks quite serious because I can log in other users account too! Thank you so mucho for your content and This course is great!

  • @bradnaylor35
    @bradnaylor35 Před měsícem

    Great video! You have a serious aptitude for teaching. Enjoying all the bug bounty basics lessons

  • @rdx8122
    @rdx8122 Před měsícem

    Thanks didi !

  • @asuhayda1
    @asuhayda1 Před měsícem

    You mentioned putting several links in the description but there aren't any there.

  • @asuhayda1
    @asuhayda1 Před měsícem

    I really appreciate your point of view on this topic. I'm just getting started learning cybersecurity and found your video to be super helpful. Thanks!

  • @user-ju6fi7vh7n
    @user-ju6fi7vh7n Před 2 měsíci

    just be honest. I'm frustrated about bug bounties

  • @Sakuraigi
    @Sakuraigi Před 2 měsíci

    You are a philosopher

  • @friend-el3fc
    @friend-el3fc Před 2 měsíci

    literally you are the best !! please keep on posting Bug Bounty videos

  • @khaledmohamed5564
    @khaledmohamed5564 Před 2 měsíci

    You are the most helpful Bug bounty content creator and I learnt a lot from you, I hope you make more videos about Android Pentesting because Web is sooooo much competitive.

  • @maapi
    @maapi Před 2 měsíci

    I'm having an issue with autorize picking up requests that should be out of scope. Anyone else have this issue? This leads to a lot of extra requests to parse through, which really slows me down

  • @V.WalkingTours
    @V.WalkingTours Před 2 měsíci

    Luckily I found your channel! I am exiting to watch all course!

  • @user-ts2of2nz1h
    @user-ts2of2nz1h Před 2 měsíci

    Love your videos ! I’ve a simple question, in your opinion for someone( like me , 32 old) wants to start hacking in 2024 ( bug hunting ) , a learning path ?

  • @user-ts2of2nz1h
    @user-ts2of2nz1h Před 2 měsíci

    Love your videos ! I’ve a simple question, in your opinion for someone( like me , 32 old) wants to start hacking in 2024 ( bug hunting ) , a learning path ?

  • @volodyakost4354
    @volodyakost4354 Před 2 měsíci

    <

  • @tokyorockstarVALORANT
    @tokyorockstarVALORANT Před 2 měsíci

    ty for the video. wanted to ask what languages i should learn to reverse engineer.

  • @detecht
    @detecht Před 2 měsíci

    This is so good. Everyone that watches this video, almost automatically becomes a better hunter. It's like the video we all wanted, even though we didn't realize it. Thank you, Katie. We're really lucky to have you. (P.S. AI Avatar Katie, is super cute. I gotta make me one of those...)

  • @snookieNaija
    @snookieNaija Před 2 měsíci

    Thanks love

  • @xas-oi7sv
    @xas-oi7sv Před 2 měsíci

    Started watching you about a month ago and started testing IDORs everywhere. Got my first serious IDOR granting account takeover & PII disclosure in 2 massive internet companies where I live , thanks!

  • @katmandu0
    @katmandu0 Před 2 měsíci

    My fav bug bounty tool is u doctor katie😊.#bbhammer

  • @user-us4yi6mc7i
    @user-us4yi6mc7i Před 2 měsíci

    great

  • @arman-ez3ir
    @arman-ez3ir Před 3 měsíci

    love these kind of tuts, well done

  • @LindsayLppzz
    @LindsayLppzz Před 3 měsíci

    Not the video I was looking for but thanks

  • @ihebhamad1477
    @ihebhamad1477 Před 3 měsíci

    Thank you @kati would you do some web application testing, how do you approach a real target.

  • @ahmedmohamednabil4789
    @ahmedmohamednabil4789 Před 3 měsíci

    Where i can practice for bug hunting when i learn new bugs ?

  • @anukiranghosh637
    @anukiranghosh637 Před 3 měsíci

    Great video! Is the blog article up yet?