![TraceTheCode](/img/default-banner.jpg)
- Видео 28
- Просмотров 267 998
TraceTheCode
Великобритания
Добавлен 3 фев 2022
TraceTheCode comprehensive tutorials helps you level up your Cyber Security skills.
Effectively find and exploit vulnerabilities.
Learn the latest offensive tricks and techniques.
Deploy practical and robust defensive mechanisms.
Effectively find and exploit vulnerabilities.
Learn the latest offensive tricks and techniques.
Deploy practical and robust defensive mechanisms.
Authentication bypass via Information disclosure
Insecure configuration of the web application can lead to information disclosure vulnerability that allows an attacker to access sensitive information. During this educational video we see how an attacker can use the "TRACE" HTTP method to access sensitive information and use this information to bypass application authentication and access administrator panel.
Web Security Academy | Lab: Authentication bypass via information disclosure:
portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-authentication-bypass
The TRACE method is used for debugging and testing purposes, as it allows developers to see how a server is handling a request and to identify any issues that ma...
Web Security Academy | Lab: Authentication bypass via information disclosure:
portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-authentication-bypass
The TRACE method is used for debugging and testing purposes, as it allows developers to see how a server is handling a request and to identify any issues that ma...
Просмотров: 2 480
Видео
SQL Injection Tutorial For Beginners
Просмотров 2 тыс.Год назад
In this EDUCATIONAL video, we go through a detailed, step-by-step process of performing SQL Injection attacks. First, we learn how to identify SQL injection vulnerabilities in a web application. Once we have identified the vulnerability, we will demonstrate how to exploit SQL injection to retrieve data from the application database. 🕰Timestamp🕰 00:00 Intro 01:00 Identifying SQL injection vulner...
Bypass File Upload Restrictions using Magic Bytes
Просмотров 6 тыс.Год назад
Web applications often check file contents to ensure that only valid files are uploaded to the server. This is a common security measure that may web applicaitons use to prevent users from upoading malicous files to the server. During this educational video we see how attackers can modify the file content using "magic trick" in order to bypass an insecure file content validation to upload a web...
File Upload Restriction Bypass | Upload Web shell via Path Traversal
Просмотров 1,5 тыс.Год назад
In this educational video, we will explore the potential security weaknesses that can arise from file upload functionality in web applications. While some applications prevent file execution as a security measure to protect against malicious files being executed on the server, these measures can be bypassed with path traversal techniques. Through practical demonstrations, we will show how an at...
Brute-Force Attacks: How Hackers Use Password Change to Take Over User Accounts
Просмотров 2,4 тыс.Год назад
In this educational video we see how an insecure implementation of "Change password" function of a web application will leave the application vulnerable to brute-force attack and allow an attacker to target the application users to enumerate their password and take over their account. By understanding these security weaknesses, application developers and security engineers can take effective re...
Bypassing Access Control to Become Administrator
Просмотров 634Год назад
In this educational video, we will be discussing a common flaw in web application access control that is based on "Method-based access control". We will see how a normal user can bypass this flawed access control by changing HTTP POST method to GET method and upgrade its level to become an administrator. This video is intended to educate viewers on the potential vulnerabilities in their own web...
OAuth Authentication Bypass via Profile Linking
Просмотров 1,5 тыс.Год назад
Some web applications use OAuth authentication to allow users to login with their social media account. During this video we see how insecure implementation of OAuth would put users data at risk and lead to account take over. NOTE: This video is made ONLY for educational purposes and to help developers and security researchers to enhance their security knowledge. Therefore, allowing them to rem...
Authentication Bypass via Insecure Deserialisation
Просмотров 1,2 тыс.2 года назад
If a web application that is using serialised objects to transfer sensitive data between web browser and server doesn’t properly check the authenticity of the serialised object then an attacker might be able to modify the data types of the object attributes to bypass authentication and get access to administrator account. During this video we look at this scenario in action. NOTE: This video is...
Privilege Escalation via Insecure Deserialization
Просмотров 5032 года назад
If user provided data is deserialised by a web application this can lead to insecure deserialisation vulnerabilities. During this video we look at a simple scenario where an attacker identify and exploit an insecure deserialisation vulnerability to get access to administrative functions. NOTE: This video is made ONLY for educational purposes and to help developers and security researchers to en...
Two Factor Authentication(2FA) Bypass Using Brute-Force Attack
Просмотров 38 тыс.2 года назад
During video we see how a weak protection against brute force attacks allows an attacker to automate a multi-step authentication process and successfully brute force verification code to bypass 2 factor authentication and log into the victim account. Web Security Academy | Lab: 2FA bypass using a brute-force attack portswigger.net/web-security/authentication/multi-factor/lab-2fa-bypass-using-a-...
Account Take Over via Forgot Password Function
Просмотров 8 тыс.2 года назад
Forgot Password function allows the application users to reset their password if they forgot their account password. If a web application doesn’t implement a secure forgot password function this would allow an attacker to reset the application users password and take over their account. During this video we look at this scenario in action. NOTE: This video is made ONLY for educational purposes ...
Perform SQL Injection Attack To Retrieve Hidden Data
Просмотров 2,4 тыс.2 года назад
If a web application doesn’t have a robust defence mechanism against SQL injection attacks then an attacker can submit malicious inputs to application to modify the SQL queries and retrieve hidden data from the application database. During this video we look at this scenario in action. NOTE: This video is made ONLY for educational purposes and to help developers and security researchers to enha...
Exploit Insecure Direct Object References (IDOR)
Просмотров 9182 года назад
Insecure direct object reference (IDOR) is a access control vulnerabilities. If a web application uses user controllable input to directly access objects such as resources or functions and an attacker can modify the input to get unauthorised access to other users' data . During this video we see this scenario in action. NOTE: This video is made ONLY for educational purposes and to help develope...
Exploit XXE to Perform SSRF Attack
Просмотров 1,6 тыс.2 года назад
One of the main impacts of XXE attacks is that they can be used to perform server-side request forgery (SSRF). During this video we look at a scenario where an attacker exploit XML external entity (XXE) injection to deliver SSRF attack and get access to an internal system inside a private network. NOTE: This video is made ONLY for educational purposes and to help developers and security researc...
Exploit XML External Entity (XXE) Injection To Retrieve Files
Просмотров 2,9 тыс.2 года назад
Some web application use XML to transmit data between browser and server. In such scenario if the application doesn't perform proper actions on the received XML document then an attacker can inject custom external entities into the XML document to exploit XML external entity injection and retrieve sensitive filesystems from the application web server. During this video we see this scenario in a...
Exploit Cross-Site Scripting(XSS) To Capture User Credential
Просмотров 1,8 тыс.2 года назад
Exploit Cross-Site Scripting(XSS) To Capture User Credential
Two Factor Authentication(2FA) Bypass | 2FA Broken Logic
Просмотров 8 тыс.2 года назад
Two Factor Authentication(2FA) Bypass | 2FA Broken Logic
Password Reset Poisoning | Host Header Injection
Просмотров 6 тыс.2 года назад
Password Reset Poisoning | Host Header Injection
Username Enumeration and Password Brute-Force Attack
Просмотров 6 тыс.2 года назад
Username Enumeration and Password Brute-Force Attack
Host Header Injection Attack | Authentication Bypass
Просмотров 26 тыс.2 года назад
Host Header Injection Attack | Authentication Bypass
Server Side Request Forgery(SSRF) | Bypass Blacklist Input Validation
Просмотров 1,7 тыс.2 года назад
Server Side Request Forgery(SSRF) | Bypass Blacklist Input Validation
Exploit SQL Injection to Retrieve Admin Password
Просмотров 7 тыс.2 года назад
Exploit SQL Injection to Retrieve Admin Password
Exploit SQL injection To Bypass Login
Просмотров 76 тыс.2 года назад
Exploit SQL injection To Bypass Login
Exploit Cross-Site Scripting(XSS) To Capture Passwords
Просмотров 22 тыс.2 года назад
Exploit Cross-Site Scripting(XSS) To Capture Passwords
Exploit Cross-Site Scripting(XSS) To Capture Cookies
Просмотров 40 тыс.2 года назад
Exploit Cross-Site Scripting(XSS) To Capture Cookies
Cross-Site Scripting(XSS) Attack | Overview and Prevention
Просмотров 1,3 тыс.2 года назад
Cross-Site Scripting(XSS) Attack | Overview and Prevention
Server Side Request Forgery(SSRF) | Access Internal Server
Просмотров 9672 года назад
Server Side Request Forgery(SSRF) | Access Internal Server
Server Side Request Forgery(SSRF) | Bypass Application Access Control
Просмотров 1,2 тыс.2 года назад
Server Side Request Forgery(SSRF) | Bypass Application Access Control
Amazing knowledge and good job of how you explain step by step. Do you have a way of bypassing KYC (document submission and live selfie verification)
Thanks🙂
Great👍
brilliant
do u need premium burl for this?
u said in video that wait until any victim user click our comment, but in your case you directly get many users like clicking on poll now in my case i won't how much time should i wait??
Do I need linux to do this or I can do it on windows?
its a perfect metod to learn
I got a very less secure app, which allows unlimited OTP tries .. in 5 mins then we just have to resend the otp is it possible to crack it ?
good explanation, is this a stored or reflected xss?
stored
Clear and well explained👍👍
Love the way, you explained this concept.
can we bypass valorant by this ?
what to do if the website validates the extension name but not the file contents? How to activate the code inside the file?
Bro why don't you upload more videos, for network hacking
The basic flaw: it assumes the required code does not change. Use an authenticator tool, with 6-digits that change every 30-seconds, with a 3-mistakes-results in a 5-minute cooldown, and you will need a quantum computer to try to break that puppy.
Thanks for teaching and giving us the ideal are amazing. I am really happy to be here thanks again 🙏🙌🧐✊
Cool video. Are you Israeli or French 😅 the accents always sound so similar
Nice
This Channel Is Amazing Man 👨
Will the admin get notified??
Whats the Solution?
Awesome video
what is the alternative to Burp collaborator, to see thee data , as its a paid tool, can we go for any free tool to check the data,
thie work for only xss stored ?
many love
helpfull thanks alot straight to the point
Thanks
That will not work for most sites, as 1 the 4 digit usually 6 digits code keeps changing, often one-time codes and time limited, 2 after several failed attempts the account is locked, 3 often a secure app is used, 4 the system alerts the account holder of a login from a new device. 5 behavior checks, to see if its a automated attack.
Very nice video
How do i get burp suite for free?
great content
What a great explanation this video should be hosted on port swigger as a community lab solution
thanks
verry good
Can you explain me why we have to use `https`? I did try with `http`, it does not work...
nice <3
How I want see an otp send by server
So basically this attack works on requsting a new otp from the server then trying that otp and hope that our combination of generated and payload otp somehow matches . Isn't this , really difficult and completely based on luck i mean yeah we can increase the speed by making our own code in nodejs or some other languages which are very very fast when it comes to webscraping but still the odds are very very high thay we will get the code i am not sure if any website will be willing to pay for this bug . Please correct me if am wrong 🙏
Is it possible to steal all of the chome broswer cookies of victim uisng cross site scripting xss Attack on valuable website
The time is right. When the OTP is six digits long, it will not prevent the final cut of the exam in case of selection due to a challenge. If the OTP is not released within 60 seconds, the OTP will expire.
This was nice. Thank you 🙏👏👏👏👏
What is that comments box has validation and it we can see the code comments section
lol...now a days firewalls and sniffers are more powerful and normally thwarts this kind of attacks. However, good explanation.
very good job on the simple explanation! tnx
interesting things
so clare and simple actually i didn't saw anyone explain like that thank you so much
what if the victim already has an associated social media profile with his account
Thankyou
Thank you, need teachers like you - the very way you explain ☺️
love form bangladesh