JWT authentication bypass via 'X-HTTP-Method-Override' Header

ESPv2 contains an authentication bypass vulnerability. API clients can craft a malicious X-HTTP-Method-Override header value to bypass JWT authentication in specific cases.
Reference: github.com/Goo...
.
.
.
.
.
Like and Subscribe :)
Social media:
Twitter: / medusa_0xf
Blog:
/ medusa0xf
#api #bugbounty #twitter #vulnerability #postman ostman #pentesting #api #hack #bola #tryhackme #hackerone #apihacking #computerscience #javascript #python #postman #ctf #bughunting #pentesting #hacking #hackingtools #burpsuite #portswigger #ethicalhacking #OAuth #webhacking #programming #websecurity #technology #practical #artificialintelligence #web #recon #bypass

[@docmalitt]

First time I hear about this header (well, that's not hard, of course) and even it sounds ... hackerish. Great vid and thank you for making them.... I would still venture imho that watching is much easier that creating them.

[@MichaelCooter]

Fantastic tutorial! I’ve never thought about this via that header. Thank you . Are you on any other social media like twitter also ?

[@Medusa0xf]

Check out the description

[@nishantdalvi9470]

Enjoyed learning something new : )

[@Medusa0xf]

Glad to hear it!

[@Myg-sl6ln]

Your video are great 🔥
Can you make an video on how to bypass cloudflare protection

[@bughunter9766]

🎉Great video,

[@aechapark4299]

I got a problem for the postman got an error when i type this command sudo docker-compose -f etc

[@badhacker0x1]

Im in love with you

[@nareshrapthadu8262]

Please make video on API Recon steps to get api subdomains and end points to test

[@Rxqqq]

First comment 👋

[@The_Ethical_TN]

Hello Medusa ❤ any idea to bypass API code 400 /414

[@The_Ethical_TN]

Application /xml