![InsiderPhD](/img/default-banner.jpg)
- Видео 102
- Просмотров 1 959 835
InsiderPhD
Великобритания
Добавлен 14 июн 2009
Dr, apparently. Lecturer in Cyber Security at a university, ex-Bugcrowd triager. #BugBounty hunter & #infosec RUclipsr making videos about how to get into Bug Bounty
Should I report this vulnerability? Will I get a bounty?
It’s really exciting to find your first bug BUT it’s crushing when you realise it isn’t reportable or comes back as NA from a client. Here are my top tips for identifying if you’ve found something and double checking before getting caught up in excitement! I still get emails about IDORs being NA because you need a victims cookie and hackers who are angry at bug bounty programs or triagers.
Просмотров: 2 548
Видео
How to take notes when you suck at it
Просмотров 12 тыс.5 месяцев назад
This episode of the Bug Bounty course we talk about the importance of developing a personal note taking system that supports both hacking and learning. Emphasizing the differentiation between notes taken during hacking activities and those for learning about vulnerabilities. We look at methods for organizing and accessing your notes whether you are into Notion, Obsidian or Vim or even mind maps...
Approaching Large Scope Targets Without Feeling Overwhelmed
Просмотров 4,7 тыс.7 месяцев назад
In this video, we discuss how beginners can tackle large scope targets in bug bounty hunting. These targets offer more flexibility and potential for bug discovery, making them a great starting point for new hackers. However, they can be overwhelming due to their size and diversity. We suggest focusing on one part of the larger scope, which helps you understand the target's application developme...
New OWASP API Top 10 for Hackers
Просмотров 9 тыс.7 месяцев назад
Blog article isn’t done yet but I’ll get it up ASAP! Today we explore the new OWASP API Top 10 in detail, the new version is much more hacker friendly and focuses on bugs we can find rather than defenders but how can we start to study these bugs and actually find them? Let’s take a look at some of the changes in the new OWASP API top 10 2023, which ones I recommend for beginners just starting o...
E-commerce Flaws and $500-1000 Bounties
Просмотров 4,3 тыс.7 месяцев назад
We're continuing our stories of bad bugs theme with some business logic flaws. Unfortunately, I couldn't find the link to the whitepaper with the e-commerce flaws, but I remember it being quantity manipulation, price manipulation by changing the currency and guessing giftcards. In today's video we look at a pretty basic authentication issue, a pretty boring price manipulation issue and end with...
TryHackMe Advent Of Cyber Day 20 - DevSecOps
Просмотров 12 тыс.8 месяцев назад
DevSecOps has enabled developers to be much more efficient, committing code and deploying it automatically, but it's a fantastic tool for us to go exploring and hacking in their pipelines! Advent of cyber is a yearly event run by TryHackMe, there are 24 days of cyber security challenges in December AND prizes for competing. Last year I finished every challenge soooooo, I think it’s good. If you...
Updated Beginners Guide to API Bug Bounty
Просмотров 13 тыс.8 месяцев назад
If you’re just getting started with bug bounty hunting, web APIs are a fantastic place to start, they’re easy to approach, can’t easily be automated and are full of bugs. Join the free, API security live class on Zoom webinars www.traceable.ai/resources/lp/webinar-api-security-masterclass? This series couldn't happen without the support of our sponsor Bugcrowd, Bugcrowd is the best place to sta...
What Can an Attacker Actually Do With a Bug Anyway?
Просмотров 1,5 тыс.8 месяцев назад
We explore the significance of understanding and explaining the impact of vulnerabilities in a bug bounty context. Using Flare.io, to peek into the dark web and see what attackers are actually doing with our vulnerabilities. We cover different vulnerabilities, provide guidelines on creating an effective impact statement, and offer three examples of impactful bug bounty reports. Before I give yo...
TryHackMe Advent Of Cyber Day 10 - SQL Injection
Просмотров 20 тыс.8 месяцев назад
Today we escalate a SQL injection vulnerability into a RCE, and explore MS SQL Server Advent of cyber is a yearly event run by TryHackMe, there are 24 days of cyber security challenges in December AND prizes for competing. Last year I finished every challenge soooooo, I think it’s good. If you want to compete, join using this link: tryhackme.com/r/christmas
TryHackMe Advent Of Cyber Day 7 - Log Analysis
Просмотров 17 тыс.8 месяцев назад
Today we abandon our red hats for the day and dive into the blue team, there’s a piece of malware on the network, but how can we tell? Well it’s time for us to dive into proxy logs and the cut command to find out! Advent of cyber is a yearly event run by TryHackMe, there are 24 days of cyber security challenges in December AND prizes for competing. Last year I finished every challenge soooooo, ...
Hacking when all the bugs have been found?
Просмотров 5 тыс.8 месяцев назад
Finding bugs on the main app is something a lot of people are a little afraid of, a lot of people think that if a program has been out a while that there's no point even looking at it. But actually the majority of my bugs have actually been on the main application and rarely do I write off a program as unhackable. As you all know by now recon is definitely one of my weakest skills, so here are ...
Giving Yourself the Best Opportunity to Find a Bug
Просмотров 6 тыс.8 месяцев назад
I get asked a lot how do you choose a target you can actually find bugs on and get bounties, so I've compiled a lot of my tips for choosing a target and how to use bugcrowd features (like joinable programs) to make it so you aren't reliant on the right program coming through on luck. So here's how to choose a target on Bugcrowd and some general advice on some of the things I look for in a good ...
3 Real API Bugs I got a bounty for
Просмотров 9 тыс.10 месяцев назад
3 Real API Bugs I got a bounty for
Here are 3 bugs I’ve Found with Recon (and how I hacked them)
Просмотров 4,5 тыс.10 месяцев назад
Here are 3 bugs I’ve Found with Recon (and how I hacked them)
Finding Your First API Bug (NahamCon 2023)
Просмотров 11 тыс.Год назад
Finding Your First API Bug (NahamCon 2023)
Learn Bug Bounty Hunting with These Resources!
Просмотров 14 тыс.Год назад
Learn Bug Bounty Hunting with These Resources!
Revealing Secrets with Information Disclosure Bugs
Просмотров 7 тыс.Год назад
Revealing Secrets with Information Disclosure Bugs
Stored, Blind, Reflected and DOM - Everything Cross--Site Scripting (XSS)
Просмотров 9 тыс.Год назад
Stored, Blind, Reflected and DOM - Everything Cross Site Scripting (XSS)
"Easiest" Beginner Bugs? Access Control and IDORs
Просмотров 20 тыс.Год назад
"Easiest" Beginner Bugs? Access Control and IDORs
My Hacking Setup and How to Use It (Firefox/Burp Community)
Просмотров 17 тыс.Год назад
My Hacking Setup and How to Use It (Firefox/Burp Community)
Why does DNS always break the internet?
Просмотров 10 тыс.Год назад
Why does DNS always break the internet?
Advent of Cyber 2022: Day 17 Filtering for Order Amidst Chaos (Walkthrough)
Просмотров 12 тыс.Год назад
Advent of Cyber 2022: Day 17 Filtering for Order Amidst Chaos (Walkthrough)
Advent of Cyber 2022: Day 16 SQLi’s the king, the carolers sing (Walkthrough)
Просмотров 14 тыс.Год назад
Advent of Cyber 2022: Day 16 SQLi’s the king, the carolers sing (Walkthrough)
Advent of Cyber 2022: Day 15 Santa is looking for a Sidekick (Walkthrough)
Просмотров 13 тыс.Год назад
Advent of Cyber 2022: Day 15 Santa is looking for a Sidekick (Walkthrough)
How to Use Bug Bounty to Help Your Career!
Просмотров 10 тыс.2 года назад
How to Use Bug Bounty to Help Your Career!
Escalating Your Bugs With GDPR Impact
Просмотров 2,8 тыс.2 года назад
Escalating Your Bugs With GDPR Impact
Easy IDOR hunting with Autorize? (GIVEAWAY)
Просмотров 34 тыс.2 года назад
Easy IDOR hunting with Autorize? (GIVEAWAY)
Try Hack Me: Advent of Cyber 2021 - Day 3
Просмотров 26 тыс.2 года назад
Try Hack Me: Advent of Cyber 2021 - Day 3
Love from INDIA you too good in APIs
For hierarchical note-taking, I use selfhost bookstack. On the fly note-taking, I'm starting to use Obsidian. You don't have to pay for the syncing feature if you get creative with your vault storage.
Please make shorts for api hacking. Also the audio is not clear ☺️
I also found a business logic issue in Apple , but sadly it's not their bounty category 😞, but still got credited though.
Thank you so much for the motivation, I started bug hunting on bugcrowd in July and so far I have reported over 15 bugs and all of them got either duplicate or information or not applicable. I am watching your videos to get motivated 😉😉😉
alot of thx katie ❤️❤️❤️
You never finished the series 😭😅
thanks for sharing your knowledge , God bless you
Burpsuite! #bbhammer
It's been a week I have been watching these videos but got overwhelmed because most of Researchers assume one might know about these starting points and got lost in all this process. Your video really help in clearing my mind and for that Thanks a lot. Really appreciate your efforts in producing such easy to understand content.
great video
OWASP web security testing guide has been useful for me as a checklist going through an app. 23:57
Thank you for this great explanation
i have watched this video 1 and half month ago and i was able to identify a function prone to IDOR , i spent 20 days on that function and at the End i was able to bypass the access controls and view invoices, billing addresses, finance records, my report is triaged and waiting for bounty , thank you this video really gave me an Idea where to look for IDORs :) , But now i am watching it again since i started API hacking and i hope i will learn something new again in this video about API hacking
for those who want to make word list of get a good word list i would recommend asset notes API routes word list it's really big and give really good results , Happy API Hacking
I have watched the Full video , Thank you very much Katie , I am Regularly following this playlist of API Hacking
Bussiness Logic errors are so similar to IDORS, and according the web applications hacker handsbook it a type of IDOR.
Starting TOday Lets rock and roll :))
Katie, you are a life saver!!! I could not wrap my brain around these for college exam!!❤🎉
1- finding ur first bug 2- firefox containers 3- api top 10 4- api enumeration
Great content, congratulations!
Great video and tutorial, thanks for doing that!
How to fuźz with the list of urls .txt with ffuf??
Howdy to all. Dear Katie, bless your heart. Thank you, kudos.
By Learning From You , You Will See One Day i Will Tag You in a Tweet , thank you very much i am learning alot about API hacking From your videos and Corey J Ball's Book , Lot Of Love and Respect , God Bless You
Hi Kattie! I watch a lot of your videos and I keep watching them and learning! I don't know if i this video, but I came here to tell you that I found my first IDOR and looks quite serious because I can log in other users account too! Thank you so mucho for your content and This course is great!
Great video! You have a serious aptitude for teaching. Enjoying all the bug bounty basics lessons
Thanks didi !
You mentioned putting several links in the description but there aren't any there.
I really appreciate your point of view on this topic. I'm just getting started learning cybersecurity and found your video to be super helpful. Thanks!
just be honest. I'm frustrated about bug bounties
You are a philosopher
literally you are the best !! please keep on posting Bug Bounty videos
You are the most helpful Bug bounty content creator and I learnt a lot from you, I hope you make more videos about Android Pentesting because Web is sooooo much competitive.
I'm having an issue with autorize picking up requests that should be out of scope. Anyone else have this issue? This leads to a lot of extra requests to parse through, which really slows me down
Luckily I found your channel! I am exiting to watch all course!
Love your videos ! I’ve a simple question, in your opinion for someone( like me , 32 old) wants to start hacking in 2024 ( bug hunting ) , a learning path ?
Love your videos ! I’ve a simple question, in your opinion for someone( like me , 32 old) wants to start hacking in 2024 ( bug hunting ) , a learning path ?
<
ty for the video. wanted to ask what languages i should learn to reverse engineer.
This is so good. Everyone that watches this video, almost automatically becomes a better hunter. It's like the video we all wanted, even though we didn't realize it. Thank you, Katie. We're really lucky to have you. (P.S. AI Avatar Katie, is super cute. I gotta make me one of those...)
Thanks love
Started watching you about a month ago and started testing IDORs everywhere. Got my first serious IDOR granting account takeover & PII disclosure in 2 massive internet companies where I live , thanks!
U find something?
My fav bug bounty tool is u doctor katie😊.#bbhammer
great
love these kind of tuts, well done
Not the video I was looking for but thanks
Thank you @kati would you do some web application testing, how do you approach a real target.
Where i can practice for bug hunting when i learn new bugs ?
Great video! Is the blog article up yet?