Vickie Li Dev
Vickie Li Dev
  • Видео 40
  • Просмотров 126 859
Scanning for hardcoded secrets in source code | Security Simplified
When developers hardcode secrets like passwords and API keys directly into source code, these secrets can make their way to public repos or application packages, then into an attacker’s hands. As developers, we often need to exchange credentials and other secrets programmatically.
This means that you can sometimes make mistakes when handling sensitive data. In this video, we'll talk about how you can detect these accidentally committed credentials in your code repositories.
#cybersecurity #secrets #dataleak
Links:
Entropy calculator: www.shannonentropy.netmark.pl/
Example vulnerable project: github.com/ShiftLeftSecurity/tarpit-java
Просмотров: 5 600

Видео

Career and Community building with Bug Bounties | NahamCon Panel
Просмотров 2,6 тыс.3 года назад
Bug bounties are a great way to grow your knowledge, get into an infosec career, and make friends. In this discussion panel, I chat with InsiderPhd, STOK, and Spaceraccoon about how bug bounties have impacted their lives. #bugbounty #career #cybersecurity
How to conduct a basic security code review | Security Simplified
Просмотров 9 тыс.3 года назад
Performing a source code review is one of the best ways to find security issues and vulnerabilities in an application. But how do you do it? Today, let’s establish a basic framework you can use to analyze your code to find security vulnerabilities. In a security code review, we are specifically looking for pieces of code that will lead to security vulnerabilities like XSS, SQL injection, or bug...
Launching an InfoSec Career: My six essential tips | Security Simplified
Просмотров 2,1 тыс.3 года назад
One of the questions I get the most online is “how do I get into cybersecurity”? When someone asks me this question, I often have a hard time answering because, the truth is that there is no singular or best way to get into cybersecurity. However, there are things that are helpful to know for anyone who wants to go into Infosec. In this talk, I present my six tips for anyone who wants to get in...
Building a secure application in five steps | Security Simplified
Просмотров 2,6 тыс.3 года назад
If you are into building software, you’ve probably heard of the software development life cycle (SDLC). The SDLC describes the five stages of application development: the requirements phase, the design phase, the coding phase, the testing phase, and the release phase. But what does all this have to do with application security? When we look at the SDLC, we also see five distinct chances of inte...
How to learn anything in Computer Science or Cybersecurity | Security Simplified
Просмотров 6 тыс.3 года назад
This time on Security Simplified, let's talk about one of the most important skills you need in order to succeed in both computer science and cybersecurity: How to effectively teach yourself new things. If you are a student looking to become a developer or a security person, then knowing how to teach yourself is really useful when you don’t have access to a mentor or an official degree program....
Building a secure application: the first step | Security Simplified
Просмотров 6863 года назад
What should every developer do before they start writing code? What is the most effective way of preventing most vulnerabilities? A lot of times we think of fixing vulnerabilities as this sort of whack-a-mole operation, where if we find vulnerability, or if someone reports a vulnerability, we'll fix it. But there is a better way. #infosec #SoftwareDevelopment #cybersecurity
They are all Injection Vulnerabilities! - Security Simplified
Просмотров 3,4 тыс.3 года назад
What do SQL injections, command injections, and Cross-site scripting have in common? The answer is that they are all injection vulnerabilities. Hey y'all! It's been a long time since I've last seen you on Security Simplified. This time, let's drill down to the basics of injection vulnerabilities. What were you up to you say? I've been spending most of my time in the last few months working on B...
Getting into a Development Career with Seho Lim
Просмотров 4273 года назад
Let's get to know our community in infosec and learn from their experience! Today, I chat with Seho about working as a software developer in health care, the unique challenges of developing software that deals with sensitive data, and how he got into a development career from a non-traditional background. You can find Seho's channel here: ruclips.net/channel/UCU7ENpWvaUOysPvlFPMmJXg.
Working in AppSec and Getting into Cybersecurity with Ozioma "Ozy" Aghamba
Просмотров 1,2 тыс.3 года назад
Let's get to know our community in infosec and learn from their experience! Today, I chat with Ozy about working as an AppSec Engineer and getting into infosec without a traditional CS degree. You can connect with Ozy here: www.linkedin.com/in/oziomaaghamba/ Another infosec professional we both admire, Tanya Janca: shehackspurple
Chatting with @Hacksplained about Bug Bounties and Infosec Jobs
Просмотров 1,7 тыс.3 года назад
Chatting @Hacksplained​ about our journeys into the infosec world, the role bug bounties plays in our lives, and freelancing in the field. Go make sure to Part 1 of this interview out. It is hosted on @Hacksplained's channel here: ruclips.net/channel/UCyv6ItVqQPnlFFi2zLxlzXA.
Attacking Sites Using CSRF - Security Simplified
Просмотров 2,5 тыс.3 года назад
This video is sponsored by Intigriti. Intigriti is a bug bounty platform that pays you for reporting security vulnerabilities. Sign up to hack here: go.intigriti.com/vickie​ CSRF, or Cross-Site Request Forgery, is a technique that allows hackers to carry out unwanted actions on a victim’s behalf. For example, a hacker might be able to change your password or transferring money from your bank ac...
Intro to CSRF (Cross-Site Request Forgery) - Security Simplified
Просмотров 2,3 тыс.3 года назад
This video is sponsored by Intigriti. Intigriti is a bug bounty platform that pays you for reporting security vulnerabilities. Sign up to hack here: go.intigriti.com/vickie CSRF, or Cross-Site Request Forgery, is a technique that allows hackers to carry out unwanted actions on a victim’s behalf. For example, a hacker might be able to change your password or transferring money from your bank acc...
Hacking banks with race conditions
Просмотров 3,2 тыс.3 года назад
This video is sponsored by Intigriti. Intigriti is a bug bounty platform that pays you for reporting security vulnerabilities. Sign up to hack here: go.intigriti.com/vickie Race conditions stem from simple programming mistakes that developers commonly make. They have been used by hackers to steal money from online banks and manipulate online voting systems. Today, let’s talk about how and why t...
How to prevent PHP type juggling vulnerabilities
Просмотров 6253 года назад
Sometimes, features of programming languages that are designed to make things easier can lead to vulnerabilities. Last time, we discussed PHP’s “type juggling” feature, and how they lead to authentication bypass vulnerabilities. This time, let's talk about how you can prevent them as a PHP developer.
Exploiting PHP Type Juggling Vulnerabilities - Security Simplified
Просмотров 5 тыс.3 года назад
Exploiting PHP Type Juggling Vulnerabilities - Security Simplified
How Attackers Bypass MFA (Multi-Factor Authentication) - Security Simplified
Просмотров 3,5 тыс.3 года назад
How Attackers Bypass MFA (Multi-Factor Authentication) - Security Simplified
Why Is Validating URLs So Hard?
Просмотров 2,2 тыс.3 года назад
Why Is Validating URLs So Hard?
How to Prevent Open Redirects in your Applications
Просмотров 1,4 тыс.3 года назад
How to Prevent Open Redirects in your Applications
Hacking SSO: Authentication Bypass by Stealing OAuth Tokens
Просмотров 10 тыс.3 года назад
Hacking SSO: Authentication Bypass by Stealing OAuth Tokens
How to Prevent Command Injections
Просмотров 9403 года назад
How to Prevent Command Injections
Intro to Command Injection | Security Simplified
Просмотров 9663 года назад
Intro to Command Injection | Security Simplified
How To Prevent IDORs | Security Simplified
Просмотров 1,6 тыс.3 года назад
How To Prevent IDORs | Security Simplified
How to Prevent SSRF Vulnerabilities (Server-Side Request Forgery)
Просмотров 4,8 тыс.3 года назад
How to Prevent SSRF Vulnerabilities (Server-Side Request Forgery)
Understanding Insecure Deserialization Vulnerabilities: Security Simplified
Просмотров 3 тыс.3 года назад
Understanding Insecure Deserialization Vulnerabilities: Security Simplified
What are IDORs (Insecure Direct Object References)?
Просмотров 2,5 тыс.3 года назад
What are IDORs (Insecure Direct Object References)?
Hacking SSO: SAML Signature Misconfigurations
Просмотров 3,3 тыс.3 года назад
Hacking SSO: SAML Signature Misconfigurations
Hacking SSO: Stealing Cookies With Subdomain Takeovers
Просмотров 1,8 тыс.3 года назад
Hacking SSO: Stealing Cookies With Subdomain Takeovers
Hacking SSO: Overview
Просмотров 2,2 тыс.3 года назад
Hacking SSO: Overview
Wildcard Injection Privilege Escalation: Linux Security 07
Просмотров 1,3 тыс.3 года назад
Wildcard Injection Privilege Escalation: Linux Security 07

Комментарии

  • @maxdemontbron9720
    @maxdemontbron9720 2 месяца назад

    Thank you Vickie Li!

  • @maxdemontbron9720
    @maxdemontbron9720 2 месяца назад

    When I grow up I want to become Vickie Li

  • @noface-qs5yi
    @noface-qs5yi 2 месяца назад

    Nice and thanks

  • @kc-onehundred
    @kc-onehundred 2 месяца назад

    2024 and loving the videos vickie😘

  • @namename5156
    @namename5156 3 месяца назад

    hey thanks so much for this video. Articulated very well and it was a breeze learning about sql injection preventions. SERIOUSLY underrated channel and I rly hope u get a lot of traffic and success. Thanks so much once again for providing us high quality education for free 😭🙏

  • @newuser2474
    @newuser2474 4 месяца назад

    Why you ghosted 😢

  • @augustvansickle1
    @augustvansickle1 4 месяца назад

    Great videos! Used them to understand mitigations better and be able to speak to that in my role

  • @newuser2474
    @newuser2474 4 месяца назад

    I love you 💗

  • @yeasinhossain4361
    @yeasinhossain4361 4 месяца назад

    I love you by reading your book

  • @hsn971
    @hsn971 4 месяца назад

    Great video!

  • @Chiph900
    @Chiph900 4 месяца назад

    @VickieLiDev Hello! I have just hopped onto the cybersecurity/hacking train. I was looking for solutions to the question explained below when i bumped into your RUclips Channel. I have just finished setting up my virtual machine. I am running kali on vmware. I was running updates for kali when i noticed my antivirus(on the host machine) blocking some downloads and access to certain websites. Do you know how I can Fix this?

  • @defendyourhealth2080
    @defendyourhealth2080 5 месяцев назад

    What a lovely and informative video. Watched a few of your other videos and i completely understand y blogging helped propell your career. People such as yourself who understand that in IT there is certainly a gap to be bridged in regards to entry level learning and the extreme technical complexity in the concepts and language that experts use when explaining whats really going on. Unfortunately not all of us have all that impressive of an IQ.....so having professionals of your caliber in this industry who sees the value in articulating otherwise broad or complex concepts in such a way that us simple folk can understand. 😅 this is essential in recruitment and industry growth. Way to go girl! Keep doing what your doing and a big thx from us simple folk❤🫡

  • @procsorted
    @procsorted 5 месяцев назад

    Thanks Vickie this is exactly what I was looking for 👍

  • @adarshsutar4065
    @adarshsutar4065 6 месяцев назад

    Mam, Can I get your Twitter or discord or linkedin

  • @adarshsutar4065
    @adarshsutar4065 6 месяцев назад

    Mam, Can I get your Twitter or another

  • @teddybest02
    @teddybest02 7 месяцев назад

    Nice

  • @platoschauvet
    @platoschauvet 7 месяцев назад

    well explained, thanks!

  • @dwaynebrock8979
    @dwaynebrock8979 9 месяцев назад

    Thank you for what you present. I personally think self learning is the way to evolving at anything. I'm a bit older, in my mid 50's. There is something in the way you relate, the energy of it, that reminds me of the young hackers I knew in the 1990s. There's a feeling of realness about it.

  • @5c4rfAc3
    @5c4rfAc3 10 месяцев назад

    absolutely love this, very good and inspirational!!!

  • @CarsonCameronClark
    @CarsonCameronClark Год назад

    super helpful comparison, thank you!

  • @zzzzzzzzZzZZzzzaZzz
    @zzzzzzzzZzZZzzzaZzz Год назад

    after the Redirection How The Attacker Can Get The access Token ? Via Refer or what ?

  • @zzzzzzzzZzZZzzzaZzz
    @zzzzzzzzZzZZzzzaZzz Год назад

    Great!

  • @StephenCarrado
    @StephenCarrado Год назад

    This is not how digital signatures work. The receiving party does not use the "same key" to verify the message. It uses the public key from the sender (sender always maintains and never shares the private key) from the sender to decrypt the message resulting in a hash. It then takes the plain text portion (usually a random value or a nonce) also sent and runs the same hashing algorithm against it. If the two hashed values match, the signature is accepted. If they do not, the message was likely tampered with and should be dropped.

  • @stephenm837
    @stephenm837 Год назад

    Great content Vickie!

  • @CapFilin
    @CapFilin Год назад

    whoa All Stars )

  • @harunimpande
    @harunimpande Год назад

    Thank you for the video.!!

  • @TheNikakz
    @TheNikakz Год назад

    Vc poderia demosntrar isso usando o burp suite? Obrigada

  • @保羅狄拉克
    @保羅狄拉克 Год назад

    This is gold

  • @InspiraDrone
    @InspiraDrone Год назад

    ohh you haven't explained how to avoid on the pratice.... 😓

  • @avimehenwal
    @avimehenwal Год назад

    excellent video on topic. Thankyou so much for sharing

  • @odenmal3178
    @odenmal3178 Год назад

    Thank you Vickie! my professor didnt even explain why we should parameterized, just gave us the code to study. Thank you for clearing up confusion!

  • @codeski_
    @codeski_ Год назад

    vickie u absolute g

  • @skiptomylucas
    @skiptomylucas Год назад

    Thank you

  • @Myk4my
    @Myk4my Год назад

    Thank you so much for this. I'm currently learning from scratch, but with your help and your book, I'll be able to get into the bug bounty world. do you have any recommendation for me? I'm thinking of starting in this order: 1- Learn Python 2- Ethical Hacking: A Hands-On Introduction to Breaking 3- Hacking The Art of Exploitation 4- Attacking Network Protocols A Hacker’s Guide to Capture, Analysis, and Exploitation 5- Black Hat Python 4- Gray hat hacking 5- Bug Bounty Bootcamp The Guide to Finding and Reporting Web Vulnerabilities 6- A lot of CTF's in the middle of them lol 7- And then try to find my first bug (with reward of course)... Obs: I have some degree of knowledge (but not much) in linux, tcp/ip, a bit of C ansi, and a lot o passion

  • @hendahmed2408
    @hendahmed2408 Год назад

    please can you help me i have mac m1pro and they say that mac m1 is not good for hacking should i get another computer?

    • @yoshi5113
      @yoshi5113 Год назад

      the only thing that you have to be concerned about is your mindset in hacking, whatever device you use as long as you have a mindset of hacking it doesn't matter. I doing hacking with MacBook pro 2015 anyway :D

  • @CheaterM.
    @CheaterM. Год назад

    the best video i found about protecting sql, relly good explanation, i rlly like it, and i also use your examples for a work in my course

  • @paulojr1384
    @paulojr1384 Год назад

    👍

  • @drive8263
    @drive8263 Год назад

    Thank you..

  • @simonjester2424
    @simonjester2424 2 года назад

    Because they are caused by the same uses of functions like os.system(), any content about command injections should at least warn about argument injections so the viewer knows to go look into that threat as well.

  • @md.mahamudulhasan1015
    @md.mahamudulhasan1015 2 года назад

    Nice work. very useful

  • @niioizin
    @niioizin 2 года назад

    Nice explanation.

  • @stevenfong1928
    @stevenfong1928 2 года назад

    You have such a kind voice.

  • @wendylouis3425
    @wendylouis3425 2 года назад

    Perfect content love it

  • @neiltsakatsa
    @neiltsakatsa 2 года назад

    Whoa! 😲 Well explained! 👌🤌😎

  • @daronwolff
    @daronwolff 2 года назад

    Thanks

  • @hatsu1101
    @hatsu1101 2 года назад

    Nice content, I love it

  • @ozaiali7500
    @ozaiali7500 2 года назад

    Thank you..

  • @BobBob-qm2bm
    @BobBob-qm2bm 2 года назад

    Thank you.

  • @sairam-lj6zu
    @sairam-lj6zu 2 года назад

    Excellent

  • @TheBashir007
    @TheBashir007 2 года назад

    Hi Do u have any practical video on how to take that approach to a POC And do u have a cheet sheet of some sort