Request smuggling - do more than running tools! HTTP Request smuggling bug bounty case study

Поделиться
HTML-код
  • Опубликовано: 18 ноя 2024
  • НаукаНаука

Комментарии • 33

  • @BugBountyReportsExplained
    @BugBountyReportsExplained  7 месяцев назад +3

    Thank you for watching this video. If you've learnt something new, leave a like to show me that you appreciate it!

    • @michamoneta669
      @michamoneta669 6 месяцев назад

      Szkoda, że nie ma tłumaczenia na Polski. Pomyśl o tym😉

    • @BugBountyReportsExplained
      @BugBountyReportsExplained  6 месяцев назад

      @@michamoneta669 myślałem nie raz i doszedłem do wniosku, że jeżeli ktoś chce rozwijać się w web security to i tak musi znać angielski

    • @michamoneta669
      @michamoneta669 6 месяцев назад

      Jesteś wybitnym Pentesterem i fajnie jakby były chociaż napisy po Polsku. Właśnie będę działał z angielskim z Wiki Sitko i działam również z Security Starter pakietem, ze Szkoły Maćka Kofla. Fajna sprawa Cybersec. tylko nie wiem czy już dla mnie nie jest za późno..... chodzi o moj wiek.🤔 Zrobiłem suba Twojego kanału, cóż będę słuchał po angielsku😁

  • @musawerkhan9817
    @musawerkhan9817 5 месяцев назад +1

    Why do we have to use white space character please clarify this is possible

    • @musawerkhan9817
      @musawerkhan9817 5 месяцев назад

      And also how can we figure it out that a backend is using HTTP/1.1, HTTP/2 or HTTP/3

  • @fengzhi-p1f
    @fengzhi-p1f Месяц назад

    您好,我有一些关于 HTTP 请求走私的问题。我如何在 Discord 上联系你们?

  • @HerlockShomes
    @HerlockShomes 6 месяцев назад

    Hi thanks for the video, can I get the notion link of the reports?

  • @day0xyz1
    @day0xyz1 7 месяцев назад

    In addition to Burp Plugin HTTP Request Smuggler, what other methods can find this vulnerability?🤒

  • @crlfff
    @crlfff 7 месяцев назад +1

    I’ve watched so many videos, done courses on http request smuggling and still don’t understand. I’m thinking about making a http server in C to exploit it myself to understand it better

    • @huzaifamuhammad8044
      @huzaifamuhammad8044 7 месяцев назад

      Is that you didn't understand or that you couldn't exploit one HRS in the wild ?
      I did understand the bug class but I never found one in the wild.

    • @crlfff
      @crlfff 7 месяцев назад

      @@huzaifamuhammad8044well maybe, I’m testing a target right now and I have two responses but I’m not sure if its a false positive or not

    • @BugBountyReportsExplained
      @BugBountyReportsExplained  7 месяцев назад +3

      a few years ago, I made a video about basics of request smuggling, maybe that will help: ruclips.net/video/gzM4wWA7RFo/видео.html

  • @alvarobalada6528
    @alvarobalada6528 7 месяцев назад +2

    Next Video: $$.$$$ bounty using request smuggling

  • @airsky21
    @airsky21 5 месяцев назад

    How to contact you privately?

  • @javeleyjaveley
    @javeleyjaveley 7 месяцев назад

    Can you share the notion reports?

    • @BugBountyReportsExplained
      @BugBountyReportsExplained  7 месяцев назад

      At this point I don't know if you're trolling me or just haven't watched the video but I answered this in 6:57

    • @InfoSecIntel
      @InfoSecIntel 5 месяцев назад

      I think he means the database, which i also just tweeted you about because I cant find it

    • @BugBountyReportsExplained
      @BugBountyReportsExplained  5 месяцев назад

      @@InfoSecIntel it's in the bottom of the article that's linked in the description

    • @InfoSecIntel
      @InfoSecIntel 5 месяцев назад

      Thank you. I see soo many people ask this question so sorry lol, that database on the article looks like an image so that's what I always thought it was. But you mention it in the video. Thanks again.

    • @BugBountyReportsExplained
      @BugBountyReportsExplained  5 месяцев назад

      @@InfoSecIntel No problem ;) There's also the link to the same database but in Notion below that embedded database.

  • @airsky21
    @airsky21 6 месяцев назад

    Hello, I am from China. I like the video content of your channel very much. I want more people to learn these vulnerabilities. Can I translate your video and repost it to the Chinese bilibili video website? I will mark your RUclips address on the video page, thank you

  • @adampauloantony3097
    @adampauloantony3097 7 месяцев назад

    thanks👍

  • @kunshtanwar4765
    @kunshtanwar4765 7 месяцев назад

    Hey dude, great video as always.
    I had a question for so long after completing all the labs related to http request smuggling from portswigger is that I am able to identify the HRS vulnerabilities using the detection method, and even the Smuggler tool but never able to showcase a full-proof POC because I have seen people use Turbo intruder for that like here 6:26, and I couldn't find a place to learn that so I request you if you can make a video on how to actually make a POC or show the IMPACT as we say, because I have so many places I couldn't show the actual poc it was annoying.

    • @BugBountyReportsExplained
      @BugBountyReportsExplained  7 месяцев назад

      There are many scenarios, many context and I couldn't make one video to cover all exploit methods. If you believe you have a valid bug but can't piece an exploit, DM me on Twitter or Discord and I'll try to exploit.

  • @gespoL-
    @gespoL- 6 месяцев назад

    Se garantiu

  • @balsonga
    @balsonga 7 месяцев назад +1

    🧉mate time 19:24