2022-style OAuth account takeover on Facebook - $45,000 bug bounty

Поделиться
HTML-код
  • Опубликовано: 27 окт 2024

Комментарии • 44

  • @BugBountyReportsExplained
    @BugBountyReportsExplained  2 года назад +12

    You can also now use the Thanks feature if you like these videos😏

    • @abdulx01
      @abdulx01 2 года назад +1

      @@trtrhr Intigriti. Bug bounty Platform if you such kind of knowledge you can start hunting.

  • @prodigyprogrammer3187
    @prodigyprogrammer3187 2 года назад +17

    The truth is I only understood half of what you said but one day i hope to understand all this better

    • @BugBountyReportsExplained
      @BugBountyReportsExplained  2 года назад

      Yeah, this bug is quite complex. Do you have any particular questions?

    • @itsm3dud39
      @itsm3dud39 2 года назад

      @@BugBountyReportsExplained yes i have.i see many cve reports in hackerone hacktivity.but when i search that particular cve on internet i cant find any result.where can i find the poc of those cve's??

    • @eyephpmyadmin6988
      @eyephpmyadmin6988 Год назад

      @@itsm3dud39 90% of CVE's don't have a PoC for the exploit, just shows that it had an exploit and might say what type it was

    • @itsm3dud39
      @itsm3dud39 Год назад

      @@eyephpmyadmin6988 👍

    • @tpevers1048
      @tpevers1048 Месяц назад

      Yeah true that's why you should be able to build poc or just buy them for 1day exploit

  • @-bubby9633
    @-bubby9633 2 года назад +1

    Finally got round to watching this! Great job as always! :) Not gonna lie I had no idea about being able to interact with frames hosted on windows of different origins! Will definitely keep that in mind for the future. Explained fantastically as always thanks!

  • @aniBunny12378
    @aniBunny12378 2 года назад +1

    Wow that's creativity...
    The way he exploited the bug was so beautiful but ofc explanation was good too...
    Keep posting more!

  • @utensilapparatus8692
    @utensilapparatus8692 2 года назад +2

    Keep covering this subject bro. I need more.

    • @joewharton7735
      @joewharton7735 2 года назад

      Read up on dirty dancing attacks if you think oauth stuff is cool :)

  • @alexandro6033
    @alexandro6033 2 года назад +2

    Very nice and your way of explanation is more than wonderful. I hope you will explain more videos of Youssef Samouda and thank you very much

  • @Lainad27
    @Lainad27 2 года назад +1

    Great video as always

  • @thepotatogaming2340
    @thepotatogaming2340 3 месяца назад

    Hey great video. I dont get how it was possible to acheive two csrf with the user clicking one link? Every time I try this only one request goes threw and the page changes

  • @robot67799
    @robot67799 2 года назад +2

    Mind blowing!

  • @crusader_
    @crusader_ 2 года назад

    Great video. Why don't you cover the recent oauth research by fransrosen?

    • @BugBountyReportsExplained
      @BugBountyReportsExplained  2 года назад

      I covered it in BBRE Premium two weeks ago. The idea behind the attack is very similar, just the method of leaking the URL is different.

  • @saurabhbhardwaj3427
    @saurabhbhardwaj3427 2 года назад

    Great content

  • @cybersecurity3523
    @cybersecurity3523 2 года назад +1

    Good job bro

  • @jpierce2l33t
    @jpierce2l33t 2 года назад

    'Ennnjoy!' 🤣 I definitely do, my friend!

  • @saeedkamranfar684
    @saeedkamranfar684 2 года назад +1

    he knows alot about the facebook features and sub sites. very interesting.

  • @Elliottwavetheory6
    @Elliottwavetheory6 2 года назад +2

    From where did you learn bug bounty

    • @BugBountyReportsExplained
      @BugBountyReportsExplained  2 года назад +8

      from Bug Bounty Reports Explained channel on RUclips 😏

    • @Elliottwavetheory6
      @Elliottwavetheory6 2 года назад

      Oh wow , can I get his number
      I have seceret to tell him....😉😉

    • @dmytrovolosnik281
      @dmytrovolosnik281 2 года назад

      @@BugBountyReportsExplained and the guy who makes the videos learned it from you? 🤔😄

    • @BugBountyReportsExplained
      @BugBountyReportsExplained  2 года назад +8

      To understand recursion, you must first understand recursion

    • @Elliottwavetheory6
      @Elliottwavetheory6 2 года назад

      Congratulations 🎉🎉 , confusion is successfully installed into the brains

  • @bdsgameing9789
    @bdsgameing9789 2 года назад

    Thanks you bro

  • @mnageh-bo1mm
    @mnageh-bo1mm 2 года назад +1

    HMMM , CSRF IN FACEBOOK ...... how tho ???

    • @BugBountyReportsExplained
      @BugBountyReportsExplained  2 года назад +1

      CSRFs on login and logout are often considered too low impact for a bug bounty report so I'm not that amazed.

  • @caesorx7232
    @caesorx7232 2 года назад

    Hey If you don't mind can you give me model number of your Logitech mouse?😅

  • @Quir_Quest
    @Quir_Quest 2 года назад

    Bro apk to jpg exploit and Android hack possible?

    • @BugBountyReportsExplained
      @BugBountyReportsExplained  2 года назад

      send me links to these writeups via Twitter and I'll see what I can do

    • @Quir_Quest
      @Quir_Quest 2 года назад

      @@BugBountyReportsExplained ruclips.net/video/pvmx7PKIk_c/видео.html

  • @MeshMohamedAshraf
    @MeshMohamedAshraf Год назад

    creativity

  • @brainrelaxing6895
    @brainrelaxing6895 2 года назад

    Please show actual hacking u have done