How we made $5000 with this exploit

Hi, thanks for watching our video about the Sandwich Attack !
In this video we’ll walk you through:
- How did we find the vulnerability ?
- What's a UUIDv1 ?
- The recipe of the Sandwich Attack
- Struggles and mitigations
- The CTF Challenge
LINKS
sandwich.rb:
- github.com/Lup...
More about the Sandwich Attack:
- versprite.com/...
HacktivityCon:
- • Vulnerabilities I've F...
Underscore_:
- • On a reçu le hacker qu...
ABOUT THE CHANNEL
The channel is about cybersecurity. We cover lots of cool stuff such as bug bounty hunting, cool vulnerabilities and breaking stuff for fun !
Follow me on Twitter:
/ 0xlupin
Don’t forget to subscribe !
CREDITS:
Produced By: Lupin & Holmes
Presented by: Roni “Lupin” Carta
Edited by: Gabriel Jardin
Artistic Direction: Amandine “Idnamaa” Kohlmuller
Thumbnail by: Justicia Satria, Amandine “Idnamaa” Kohlmuller
Outro by: Math “blueish” Dumoulin
Directed by: Roni “Lupin” Carta
Written by: Roni “Lupin” Carta
Guest Star: Stök
Inspired by: LiveOverflow, InsiderPHD, Stök, Sylvqin, Versprite

[@foolbazar9176]

Amazing edit and great content ! Thank you for it

[@0xlupin]

Thanks a lot ! :D

[@computerauditor]

One of the most super simple and super detailed video🔥🔥🔥
Great video!!

[@alainfocom]

Wow you just did a very great work ^^
Waiting for more !

[@0xlupin]

Thank you so much !

[@shubham_srt]

The production and edit is too good

[@_CryptoCat]

Cool vuln, great video! 🔥

[@deadeye1652]

super cool find man. it really makes me wonder how something so arbitrary looking like UUID tokens have so much depth and expose attack surface. would never skip over uuids ever again xD.

[@0xlupin]

Thanks a lot for the feedback ! And yes now I check the Version every time haha

[@bughunter1731]

Cool video man, found you on twitter, I just subscribed!

[@nithinr5959]

Fantastic!
Congratulations and thanks for sharing ;)

[@0xlupin]

Thanks for watching ;)

[@h4ckerR4hul]

Thanks for sharing the rb script.. nice one.. like to see similar vids more

[@baravind719]

Very helpful 😊

[@user-qj8zb5lu7g]

Incroyable

[@h4ckerR4hul]

can u share how do u ffuf to brute force the UUID.. how do u setup the FUZZ word ??

[@shubham_srt]

more videos pls!!

[@NithinJune]

the microphone in the beginning legitimately worried me

[@0xlupin]

I love the jokes that my editor added in this video haha

[@deepm0078]

Awsm such a great learn

[@mohammedshine2372]

Awesome find man

[@0xlupin]

Thanks !

[@H3t4]

nice videos

[@mehdibouhamidi4675]

Bravo c'est cool comme idée 😁🤌

[@crusader_]

How did you initially identify the timestamp was from Julien calendar?

[@computertech3986]

My understanding is that UUIDv1 uses the Julien calendar. The version can be determined from the token string.

[@0xlupin]

In the article of VerSprite they actually wrote about it. I just followed the documentation :)

[@TomTom-gx1sm]

Putain tu me donnes envie de me lancer sur YT en Anglais :).

[@youtubeprenium601]

2:35 ?

[@mavisdavis1997]

*promosm*