Your content is amazing. I'm a beginner to bug bounty hunting and I have learned a lot things from you. I really appreciate your content and your contribution to the community. Thank you Katie..
Hello Katie, First of all thank you so much for providing us such information. I've a question I was hunting on a bug bounty platform and I found a end point which is vulnerable to IDOR cookie manipulation as I interchanged the cookie of two account and it worked but the triage team responded by marking it as NON-APPLICABLE as they quoted "It's not worth it as you have to have cookies of both attacker as well as victim account" can you tell me if it's a Valid bug or it needs to land on NON APPLICABLE category...? Thanks agian.
Because when you use an endpoint with cookie A you’re affecting user A and with user Bs cookie you’re affecting user B. That is how it’s supposed to work and it’s intentional.
Yes if you are accessing your own account, here the cookie trick is to change the cookies to act like you are logged into one account but you can change another!
Informative..!!..Please also add link of related videos in the description..it would help people like me as I haven't seen that "firefox containers" video. Thanks for the video..💖
Just FYI. in the IDOR videos of yours that I've watched, you've never explained what IDOR stands for. Looks like it's Insecure direct object reference. Learned about you from The Cyber Mentor (TCM).
Hey Katie ! Let's say I have found a cookie based IDOR , but this falls in the category of MITM because you have to steal cookies first !🤔 Is this an false positive ?
Im confused a little bit. Sorry. What if the cookie of user A contains user 's credentials like user id encoded in it. So if i will change the request of user B' s cookie to uaer A's cookies, it would be just like User A is sending the request right? So it's not an idor if that's the case right?
An IDOR occurs when one user (B) can access something they shouldn't, eg something on another user (A)'s account. So to test for that we do something on A's account, then repeat the request changing the cookies from A->B, if that then impacts As account, it means you could login as anyone and access anyones stuff.
please i want this video How to become a cyber security analyst full road map Topic is after 12 what should I do, with BCA, skills , course, jobs , salary, which is best and which in demand in future ( Web Exploitation, Cryptography, Reverse Engineering, Forensics, General Skills, Binary Exploitation) Almost full road map Please 🙏🙏
Hi Priyam, it's hard to give you a roadmap without knowing you well, but this I think is a REALLY good graph - www.linkedin.com/pulse/map-cybersecurity-domains-version-20-henry-jiang-ciso-cissp as for what to learn it completely depends on what interests + excites you! Any jobs in security are going to be in demand so the world is your oyster!
Is there any getting started video for any platform like hackerone, bugcrowd. I mean how to setup account ,start real target and report issue like that. Thank you
Your content is amazing. I'm a beginner to bug bounty hunting and I have learned a lot things from you. I really appreciate your content and your contribution to the community.
Thank you Katie..
*This is was by far **_THE BEST_** video I’ve watch on cyber security I’ve seen, thus far!*
Katie you are a superstar - thank you for taking the time to make these videos. They are very helpful
Glad you like them! It means a lot for me to get messages like this!
It takes lots of efforts in making such content I loved it -thanks
My pleasure 😊
This video really put me in interest to study more about Bug Hunting! I was all confused before haha xd
NICELY EXPLAINED!
Please never stop posting
Never stop posting videos
Hello Katie,
First of all thank you so much for providing us such information. I've a question I was hunting on a bug bounty platform and I found a end point which is vulnerable to IDOR cookie manipulation
as I interchanged the cookie of two account and it worked but the triage team responded by marking it as NON-APPLICABLE as they quoted "It's not worth it as you have to have cookies of both attacker as well as victim account" can you tell me if it's a Valid bug or it needs to land on NON APPLICABLE category...?
Thanks agian.
Because when you use an endpoint with cookie A you’re affecting user A and with user Bs cookie you’re affecting user B. That is how it’s supposed to work and it’s intentional.
literally got told the same thing
I got a doubt. What if the triage team asks how can an attacker get another user's cookie? And don't consider an impact?!
same
Hi Katie, wouldn't changing the cookies be a MITM Attack, which is invalid for I'm sure most programs.
Yes if you are accessing your own account, here the cookie trick is to change the cookies to act like you are logged into one account but you can change another!
Can i use community edition of burp suite in a real bug hunting?
Thank you!! Neatly explained.
Thanks a lot. Very well explained.
Does it also count as IDOR if I can access objects by changing PHPSESSID in the cookies?
thanks Katie! IDORs make more sense now. 🌊️⛱️😎
Informative..!!..Please also add link of related videos in the description..it would help people like me as I haven't seen that "firefox containers" video. Thanks for the video..💖
I hope not! I would like a bounty!
(Im kidding!) thank you
I will add those videos now!
Thanks, In the video you mentioned about middlewares. I hope you will make video's on Code Review :)
Thanks again
Just FYI. in the IDOR videos of yours that I've watched, you've never explained what IDOR stands for. Looks like it's Insecure direct object reference. Learned about you from The Cyber Mentor (TCM).
Thank you!!! Amazing video!!! (Like always)
4th place
also as usual awesome video
Hi kattie..
How you get access victim account to see changes or victim cookies ,this big question
So if i understand in correct way login copy cookies logout and use cookies to login as other user ?
Was Able to Use Paypal Payment Token of User1 with User2 & vise-versa on a shopping portal. Is this also a case of IDOR vulnerability ?
Hey Katie ! Let's say I have found a cookie based IDOR , but this falls in the category of MITM because you have to steal cookies first !🤔
Is this an false positive ?
Check the scope of the program. Did they say anything about MITM?
signing up Intigriti with ur link let's hope for the best
I will keep my fingers crossed for you good luck! And good hunting my friend
Im confused a little bit. Sorry. What if the cookie of user A contains user 's credentials like user id encoded in it. So if i will change the request of user B' s cookie to uaer A's cookies, it would be just like User A is sending the request right? So it's not an idor if that's the case right?
Yes, if you can affect User B using User A's cookies or User A with user B's cookies, it's an IDOR
@@InsiderPhD madam whats the difference between csrf and idor that you are talking about right know? Thankssss
Thanks , very helpful 🙏
Am I right to think that IDOR is a type of broken access control vulnerability? There's no mention to this in the video.
Yes! It is :)
if they've caused something to happen to account A rather than B what to do next?
Not a bug, move on
Thanks for this man
Thank you a lot.
Hey katie,
What do you mean by "see if they've caused something to happen to account A"? at 16:54
An IDOR occurs when one user (B) can access something they shouldn't, eg something on another user (A)'s account. So to test for that we do something on A's account, then repeat the request changing the cookies from A->B, if that then impacts As account, it means you could login as anyone and access anyones stuff.
@@InsiderPhD Gotcha...
really great knowledge
Sweet
please i want this video
How to become a cyber security analyst full road map
Topic is after 12 what should I do, with BCA, skills , course, jobs , salary, which is best and which in demand in future ( Web Exploitation, Cryptography, Reverse Engineering, Forensics, General Skills, Binary Exploitation)
Almost full road map
Please 🙏🙏
Hi Priyam, it's hard to give you a roadmap without knowing you well, but this I think is a REALLY good graph - www.linkedin.com/pulse/map-cybersecurity-domains-version-20-henry-jiang-ciso-cissp as for what to learn it completely depends on what interests + excites you! Any jobs in security are going to be in demand so the world is your oyster!
@@InsiderPhD thanks for this advice 🙏
There is authorize now
Well explain 😍
Till date, no findings :-((if you remember me from previous videos)
Thank you so much mam 💞😊🇳🇵
Hello Dr
👋👋
🔥
❤️
Is there any getting started video for any platform like hackerone, bugcrowd. I mean how to setup account ,start real target and report issue like that.
Thank you
I don’t know but I will make that video for you :)
@@InsiderPhD thank you :)
@@InsiderPhD when I expect such video? I am curious for that :) . In between if you find any reference kindly share?
Thank you
@@salmankhandu3819
U can ckeck this ...she made it previously ruclips.net/video/A0LTyH4tOmQ/видео.html
you missed up all of this.
2nd
@albonycal
Too slow Albony!
@@InsiderPhD :/
l
not the best video