Hack your grades

Просмотров 185 тыс.

% 6 503

Dr Katie Paxton-Fear shows us how to hack the Generic University and change grades using the university API. You will learn some of the OWASP top 10 vulnerabilities including Broken Object Level Authorization and Broken User Authentication.
Disclaimer: We are hacking the Generic University for educational purposes only. Generic University is a GitHub project that Katie has created to learn Cybersecurity and APIs. Do not hack a real university.
// University //
The Generic University on GitHub: github.com/InsiderPhD/Generic-University
// MENU //
00:00 - Coming up
01:16 - Katie's RU-vid channel // Recommended playlists
02:31 - How to hack and change your grades // "Generic University"
03:26 - Generic University demo // Burp Suite
04:25 - API vulnerabilities // Bug bounty
07:50 - Generic University demo (continued)
21:27 - Thinking outside the box // Hackers mindset
25:34 - Katie's PhD
26:10 - Will AI take over?
29:42 - Advice for getting into cyber-security
34:01 - Recommended RU-vid playlists
35:44 - Recommended sites and books
36:48 - Conclusion // Final words
// Videos discussed //
Everything API Hacking: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-yCUQBc2rY9Y.html
Hacker Toolkit: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-aN3Nayvd7FU.html
Burp for Beginners: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-UgbYozI436M.html
OWASP Top 10 owasp.org/
// Books //
Hacking API’s by Corey J Ball: amzn.to/3JOJG0E
Bug Bounty Bootcamp Vickie Li: amzn.to/3SPCtBF
// Free API hacking course //
APIsec Certified Expert Course: university.apisec.ai/
// Katie's Social //
Twitter: InsiderPhD
RU-vid: ru-vid.com
Website: insiderphd.dev/
The Generic University on GitHub: github.com/InsiderPhD/Generic-University
// David's SOCIAL //
Discord: discord.gg/davidbombal
Twitter: davidbombal
Instagram: davidbombal
LinkedIn: www.linkedin.com/in/davidbombal
Facebook: davidbombal.co
TikTok: tiktok.com/@davidbombal
RU-vid Main Channel: ru-vid.com
RU-vid Tech Channel: ru-vid.com/show-UCZTIRrENWr_rjVoA7BcUE_A
RU-vid Clips Channel: ru-vid.com/show-UCbY5wGxQgIiAeMdNkW5wM6Q
RU-vid Shorts Channel: ru-vid.com/show-UCEyCubIF0e8MYi1jkgVepKg
Apple Podcast: davidbombal.wiki/applepodcast
Spotify Podcast: open.spotify.com/show/3f6k6gERfuriI96efWWLQQ
// MY STUFF //
www.amazon.com/shop/davidbombal
// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com
// Generic University Challenge //
Vulnerabilities:
API1:2019 Broken Object Level Authorization
API2:2019 Broken User Authentication
API3:2019 Excessive Data Exposure
API5:2019 Broken Function Level Authorization
API6:2019 Mass Assignment
API7:2019 Security Misconfiguration
Your Goals:
- Find the emails of the administrator
- Brute force the API to find new endpoints
- Find out what grades everyone got in a class
- Edit someone's grade
- Make an account
- Access the GraphQL API
- Change another account's password
- Login to your account
- Access admin API
- Find out what vulnerabilities the IT admins have ignored
- Make your account an admin
- Access the admin control panel
- Fire a blind XSS in the admin control panel and validate with your new admin account
- Delete everything
- Restore everything
hacking university
hacking school
hack school
hack university
hacking api
api
api hacking
api hacking tutorial
api hacking bug bounty
api hacking 101
api hacking full course
Disclaimer: This video is for educational purposes only. I own all equipment used for this demonstration. No actual attack took place on any websites.
Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!
#api #hack #hacking

Опубликовано:

27 ноя 2022

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 310

@davidbombal Год назад

Dr Katie Paxton-Fear shows us how to hack the Generic University and change grades using the university API. You will learn some of the OWASP top 10 vulnerabilities including Broken Object Level Authorization and Broken User Authentication. Disclaimer: We are hacking the Generic University for educational purposes only. Generic University is a GitHub project that Katie has created to learn Cybersecurity and APIs. Do not hack a real university. // University // The Generic University on GitHub: github.com/InsiderPhD/Generic-University // MENU // 00:00 - Coming up 01:16 - Katie's RU-vid channel // Recommended playlists 02:31 - How to hack and change your grades // "Generic University" 03:26 - Generic University demo // Burp Suite 04:25 - API vulnerabilities // Bug bounty 07:50 - Generic University demo (continued) 21:27 - Thinking outside the box // Hackers mindset 25:34 - Katie's PhD 26:10 - Will AI take over? 29:42 - Advice for getting into cyber-security 34:01 - Recommended RU-vid playlists 35:44 - Recommended sites and books 36:48 - Conclusion // Final words // Videos discussed // Everything API Hacking: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-yCUQBc2rY9Y.html Hacker Toolkit: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-aN3Nayvd7FU.html Burp for Beginners: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-UgbYozI436M.html OWASP Top 10 owasp.org/ // Books // Hacking API’s by Corey J Ball: amzn.to/3JOJG0E Bug Bounty Bootcamp Vickie Li: amzn.to/3SPCtBF // Free API hacking course // APIsec Certified Expert Course: university.apisec.ai/ // Katie's Social // Twitter: twitter.com/InsiderPhD RU-vid: ru-vid.com Website: insiderphd.dev/ The Generic University on GitHub: github.com/InsiderPhD/Generic-University // David's SOCIAL // Discord: discord.gg/davidbombal Twitter: twitter.com/davidbombal Instagram: instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal RU-vid Main Channel: ru-vid.com RU-vid Tech Channel: ru-vid.com/show-UCZTIRrENWr_rjVoA7BcUE_A RU-vid Clips Channel: ru-vid.com/show-UCbY5wGxQgIiAeMdNkW5wM6Q RU-vid Shorts Channel: ru-vid.com/show-UCEyCubIF0e8MYi1jkgVepKg Apple Podcast: davidbombal.wiki/applepodcast Spotify Podcast: open.spotify.com/show/3f6k6gERfuriI96efWWLQQ // MY STUFF // www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // Generic University Challenge // Vulnerabilities: API1:2019 Broken Object Level Authorization API2:2019 Broken User Authentication API3:2019 Excessive Data Exposure API5:2019 Broken Function Level Authorization API6:2019 Mass Assignment API7:2019 Security Misconfiguration Your Goals: - Find the emails of the administrator - Brute force the API to find new endpoints - Find out what grades everyone got in a class - Edit someone's grade - Make an account - Access the GraphQL API - Change another account's password - Login to your account - Access admin API - Find out what vulnerabilities the IT admins have ignored - Make your account an admin - Access the admin control panel - Fire a blind XSS in the admin control panel and validate with your new admin account - Delete everything - Restore everything Disclaimer: This video is for educational purposes only. I own all equipment used for this demonstration. No actual attack took place on any websites. Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!

@dareilcasinojamerojr.4134 Год назад

Hi SiR David I'm so sad it's because when i try my router crack my password my linux zsh no such file or directory kali linux can you help to fix this??? from philippines....

@SolitaryElite Год назад

i tried to do that by hacking my teacher but you can only add grades not edit, and adding good grades out of nowhere is just sus asf so :(

@game_vloger0 Год назад

Sir hack IGNOU website

@megatee4018 Год назад

@@SolitaryElite don't worry about that I have someone who can do that for you

@megatee4018 Год назад

@@SolitaryElite don't worry about that I have someone who can do that for you

@impostorsyndrome1350 Год назад

the fact that you provide all of this for free is truly astounding. Keep it up, it's really cool!

@ariasm8911 Год назад

i saw several video of yours today and realized you are phenomenal interviewer, questions are spot on. thank you David!

@mr.docker7699 Год назад

I didn't know much about BurpSuite before watching this video. I am improving my knowledge because of you. Thank you so much Mr David 🙋‍♂

@BobBob-qm2bm Год назад

David B. has done it again! Dr Katie is FEAR-less while hacking those APIs. You are rocking the content and presenting awesome guess. Thank you for being a blessing to the community. 🤓👨‍💻

@RustyShacklefordddd Год назад

Another great video David ive been binge watching your videos since Tuesday!

@chelography4410 Год назад

Thank you for your channel and thank you Katie for your insight and encouragement.

@davidbombal Год назад

Thanks for watching!

@dejuridico1691 Год назад

Great guest as always, David!. Greetings from Mexico City.

@trscsaeg 4 месяца назад

Love how david controls conversations and keeps experts from going to far over people’s heads

@shayansec Год назад

I can't thank you enough for providing this vid... Actually I was learning IDOR vuln and want to practicing on Generic University but can't find any resource about it...searched and this just got appeared.

@NAKAEtekq Год назад

Haven't watch to the end but I'm already loving it.....thanks david

@lovejko Год назад

Love people, who have the talent to explain. Thank you.

@funkymonk2254 Год назад

ThankYou David and Dr. Katie.

@mattjohnson6276 Год назад

Katie seems pretty awesome! Thanks for bringing her on.

@ITExplorer-X Год назад

Great video and an eye opener. Thank you for the information.

@jspiteri33 Год назад

Thanks guys so much great information. Keep up the great work

@arghyl Год назад

Another great guest! thank you!

@ArturoGonzalez-uz1by Год назад

I’m going to go hard into bug bounties during my winter break in two weeks, thank you David!!!

@nathanaelhassin7729 Год назад

It's so amazing how you help people out with your service. Continue the good work

@nathanaelhassin7729 Год назад

XDRHAC

@nathanaelhassin7729 Год назад

IS THE BEST HACKER

@esaelvladimir3672 Год назад

Eagerly and literally need this from you Mr David

@davidbombal Год назад

Hope you enjoy the video. Please only hack the generic university - not a real one.

@luizcosta8122 Год назад

Everytime David posts a video, my dream of living off hacking and bug bounties becomes stronger

@abhijithsuren Год назад

Finally it's here ❤️

@tyrojames9937 Год назад

When Katie told the story about her mother being TERRORFIED of Computers, That part HIT HOME!😊

@serialkiller8783 Год назад

do a video of how to stay consistent? i like your consistency of posting new quality content videos.

@hunte-shovelton Год назад

Feeling so inspired and positive after this recommendation , thanks!

@hunte-shovelton Год назад

Xdrhac

@hunte-shovelton Год назад

Best hacker for school grade hack

@MFoster392 Год назад

Another great video, thank you

@alonzosmith6189 Год назад

Thanks for sharing, hopefully this will educate schools on what not to do and what to look for and what they should do to secure their systems.

@davidbombal Год назад

Agreed Alonzo. Let's hope so.

@darwintean4861 Год назад

Let's hope not😈

@ItzHerobrine Год назад

@@darwintean4861 xd

@tyrojames9937 Год назад

I HAVENOT BEEN DISAPPOINTED WITH A VIDEO FROM THIS CHANNEL YET!👔🎉

@Mp-jw1qg Год назад

my highschool used Aeries software , in 2003 i figured out how to access the master accounts by bypassing the schools user login system that ran across every pc on campus. I made a usb that would boot full version of windows isntead of the schools version between bios and windows level. I was able to bypass all the internet filters and had full access to the pc's. It took the cisco networking teacher/class 2 years to figure it out. All of the Teacher computers were all named uniquely since they were the only ones who were able to name the pc's so it was very easy for us to get into the network and see wich physical devices were the teachers lol. The school used to put black rubber film over the keyboards in typing class and the software would keylog EVERY key stroke and judge typing accuracy. it would dump the logs to a central PC that was setup. we found the economics teacher had logged in to a student pc, and logged into Aeries so we logged into his account and changed a bunch of peoples grades, and also took Aeries down for about 4 months by changing the teachers login and passwords. deleting the excel files that aeries would store etc etc. We got suspended and i didnt get to walk across stage at graduation because of it. I got kicked off the baseball team, water polo team etc. I got in a ton of trouble and wasnt allowed to use any Pc at school for the rest of the time i was there. the teachers could never figure it out, i got ratted on by someone whos grades we changed.

@aniketsadal Год назад

Love from India sir❤️ Your content is amazing it helps me a lot

@mohamedmounir6770 Год назад

At the right time👌. During this week I will pass my first term exams😂😂. Mr.david you're a mind reader 😆

@davidbombal Год назад

lol... please only hack the generic university - not a real one. Or join a bug bounty program to be paid to hack real companies :)

@Xvics Год назад

David, your video is great. Please make more videos with Katie; I adore the way she explains things.

@oproadiakdajdbhjadajsld Год назад

HOLY MOLY I NEED IT

@ssf_9 Год назад

Massive Respect David sir.. 🙏

@adventurenewzealand Год назад

I used an system i set up to rewrite excellence (a+) work exemplars supplied by the education system where i live. The system found synonyms for all applicable words. Step two was to put it through a text summarizer. 3 was a stolen text checker. Allways got a plus

@bubz3t136 Год назад

So you got away with? Could you help a kid in the UK?

@endlesscarrow Год назад

Please awaited to hear from you

@michaellasambouw Год назад

It would be nice to having Katie on your RU-vid David. Thanks for sharing Katie

@december8421 Год назад

very cool! more videos like this)

@edwin_terrones Год назад

I’m already subscribed and I have learned a lot from her she’s great!

@davidbombal Год назад

Agreed Edwin!

@upelister Год назад

Great video, thanks.

@mranthony1886 Год назад

7/11/2022 - At Twitter, as well as at some banks, the answer appears to be lines of code. - Good engineers produce a lot of them.... never mind security which is more considered...

@Goosht Год назад

hahahaha 24:24 I was listening so attentively and the B roll and caption killed me!

@ergogenda3374 Год назад

Great guest as usual. I subscribed to her channel.

@shaikjilani8242 Год назад

What is her youtube channel name?

@Ataraxia_Atom Год назад

This is actually how I graduated early. I went to a remedial highschool and we had to take multiple classes online. Well the teacher had to reset our tests/change grades if we didn't pass with his password at our console. Well I saw his password one time and was able to login and change many of my grades to show that I had passed a bunch of tests I didn't to take. I was so done with highschool

@parryhotter9333 Год назад

i mean, you could just study and pass the tests 🤡

@Ataraxia_Atom Год назад

@@parryhotter9333 I mean when you're 16 and done with school, you do what is easiest to get where you want to go. HS is a giant waste of time in the US anyway and I was able to graduate about a year early so

@ipodtouch470 Год назад

@@Ataraxia_Atom hs is not a complete waste of time if you want to get into tech in college. All that math came into effect when I was building a game with real physics.

@Ataraxia_Atom Год назад

@@ipodtouch470 you're not wrong, there is definitely value to be had if it's the right time, but nothing that can't be learned later in life. I didn't start to settle down until i was 22, an now i work as an engineer in the semi conductor industry, previously in aerospace

@RAMADHANIBARAKASHALA 7 месяцев назад

@@Ataraxia_AtomHello

@RapsyJigo Год назад

I like to tell my students who always ask about hacking the best hack I ever done. About ~13 years ago when you would go to the bank and ask for an account and you would ask for internet control of that account (internet was kinda new here so not everyone had it by default) the bank would obviously make an account for you and give you the first time credentials to said account. Now the thing is they gave you the credentials on a sealed piece of paper, most people would take the piece of paper with them home, log in and then change their passwords. But not everyone, some people decided that they'll write down the credentials in their personal notebook for easy memory and just throw the credential paper away. I guess you can see where this is going, I just stood outside the bank, and waited for someone to throw away pieces of paper. Dumpster dive for them and like 1/1000 you're gonna hit the jackpot.

@endlesscarrow Год назад

Like the people you interview with anyone who will love to teach I want to be an ethical hacker or cybersecurity but don’t know where to learn it

@GentlemanPro-zz2ke 8 месяцев назад

Hello Mr David and Dr Katie, I'll like to ask, what if the website your trying to test does not have an API and you are only able to use burp suite. What will you advice you do in such situation.

@Joel-gf4zl Год назад

I was fully capable of changing any grade in high school, but never stupid enough to actually do it. They even stored all students locker combinations on a central server, so if I wished, I could open any locker. Good times.

@abdullahomer14 Год назад

Teach me.

@0ninja213 Год назад

@@abdullahomer14 U need to find a vulnerability first

@Sentient.A.I. Год назад

I hacked into my schools network when I was in middle school. I didnt change a single grade but the school wanted to expel me. They failed in this but still it managed to cause enough trouble to ruin my early hacking career.

@landonmiles293 4 месяца назад

how?

@mikedc Год назад

The movie wargames in the 80s was the first time I seen this practice...he was in high school changing grades

@davidbombal Год назад

For the real world, please only hack the generic university - not a real one. Or join a bug bounty program to be paid to hack real companies :)

@daboijason9466 Год назад

Cant wait to add a bit of bruteforce and loads of proxies for deauth countermeasures

@nineb7640 Год назад

Hi David,thank you very much for the great content,I love all your subjects that you bring up to the table I just wana to mention if possible that you talk about decentralized VPN and if you can get some experts to talk about it ( cause I see a very good project called deeper connect) you can search about it of course I see it as very interesting kind of technology in these days. Thanks a lot again for everything I learnd alot from you and your video. All the best

@ybfc311 Год назад

this was a great talk... 👍🏼 will be def looking into more api stuff

@maniakdemi3548 Год назад

Hi David... I recently watched your video on how to install Kali nethunter on an android phone. After completing all the steps and installing nethunter kex. I'm unable to connect openvpn and network manager is disabled. Do I need to root my phone in order to get it enabled?

@rationalbushcraft Год назад

I have used burpsuite but never considered looking at APIs like that.

@innokirigiti Год назад

This is 100% true, I also once hacked a voting system website just by replacing /login with /register. It turned out I was able to register as an admin, it was the simplest yet powerful hack I used before.

@hendahmed2408 Год назад

is it still not working😢? iam starting my pentesting course, i have mac m1pro so u think i should seal it and buy windows?beacuse as you say some tools doesnt work?

@islamicspirit5956 Год назад

love it

@davidbombal Год назад

Glad you enjoy the videos :)

@CyberNancy Год назад

In my youth, hacking my grades would have been the only chance I had to get high marks.😂

@msascuinonducorduco Год назад

😂 I would have done the same thing especially with non technical courses 🤦🏾‍♂ still don't know why in this day and age we have to take those... I had to take: Philosophy 🤨, Home Ec 🗿Social Studies 🙄, and much more. Still no technical courses yet... until I'm a Junior 😔 Woe is me...

@davidbombal Год назад

lol

@hus73928 Год назад

but cool high marks

@bubz3t136 Год назад

@@davidbombal Is this for real? I'm 47, so I missed out on all of this. How common is grade-hacking? Is there really no way of getting caught? How much does it cost to get a hacker to do it for you?

@ishwartaral9019 11 месяцев назад

Sir Can you hack my grades please 🥺🙏🏻 to get only pass 😭 I don't want high marks but only pass please sir 🙏🏻 I can give you money 💰 also whatever you want 💯

@ModemMage Год назад

Great video. I'm a network engineer trying to become a little more broad and I'm definitely subbing to insiderphd

@ZainBhaiiii Год назад

Thank you so much David for bringing such a video i hope this will help me. I just want to know is it possible on the real website?

@davidbombal Год назад

As Katie said in the video, she finds these vulnerabilities in lots of real websites. Make sure you do this legally by joining a bug bounty program to be paid to hack real companies safely.

@ZainBhaiiii Год назад

@@davidbombal Thank you so much for reply. You are a best teacher in the world

@fahimanayet Год назад

loved it

@monkeydluffy9933 Год назад

I remember doing this with just social engineering and a Bad USB attack as the college servers were too easy to access

@excaliber2845 Год назад

in a prev video you said you will be showing what you can do with the kali nethunter termux but you haven't even mentioned it since, have you forgotten or have u decided it isn't worth making a video about?

@dareilcasinojamerojr.4134 Год назад

Hi SiR David I'm so sad it's because when i try my router crack my password my linux zsh no such file or directory kali linux can you help to fix this???

@mereculescomeback9544 Год назад

this sounds silly, but I appreciate her work

@user-ex7mw8gp8f 15 дней назад

Very interesting, what are the website, tools to start as a beginner please I your help take me through all this

@mu3076 Год назад

I'm doing my Masters Degree in Computer engineering and I hate it. I want to switch to information security but here in Russia foreigners are not allowed to study infosec for whatever reasons... I'm dying from the inside doing what I don't love... I don't know what to do

@glitchinthematrix9306 Год назад

Bro stop doing it

@mu3076 Год назад

@@glitchinthematrix9306 I have no other options, No jobs in Africa back home. I just have to suffer through this whole thing...🤦🏽‍♂️🤦🏽‍♂️🤦🏽‍♂️

@Firoz900 Год назад

I subscribed Katie.

@pradnyabugdane8287 Год назад

Please tell me process to hack write protected sd card to retrieve data

@TheShadowCamo 9 месяцев назад

I actually graduated from Generic University. I got a degree in Translating British to English.

@ushayadav8614 Год назад

This is something incredible 🌝

@Aaron48219 Год назад

I miss the old days in the 90s of directory manipulation.

@MikiasTeshome 5 месяцев назад

Greating from Ethiopia

@hendahmed2408 Год назад

is she using mac m1or m2 please answer me

@PUITKH Год назад

❤

@user-xr3gp6es7v Год назад

Can I contact your team to change my undergraduate grades please

@AchiTechIsolutions Год назад

How to bypass iphone 6splus hello sreen

@theMadhatter817 Год назад

Just subbed to her channel

@zentraidee9701 Год назад

"Be an information Sponge"-Dr. Katie Paxton

@devansh2587 Год назад

❣️

@grandmagician4798 Год назад

Hello Mr. bombal can you please make a video on installing kali Linux on a Samsung galaxy device with android 12

@grandmagician4798 Год назад

@Add-on-Techlore01 yes can you contact me

@cdcrjp2nft867 Год назад

How do I get the university to process my student loans

@shegotass240 Год назад

dayuum

@Scapularbore Год назад

Me and another kid I grew up with did this back in 1994 not that I am stupid but we hacked the school computer system and gave ourselves A's trust me we regretted it why we got cought because the teachers knew what had happened just how we did it changed they way they secured there systems and we didn't get kicked out of school however we did get an assignment helping them fix there computer systems.

@pushparajpraveen5340 Год назад

When you realise you need to study to hack your grades just to compensate for what you not done before your exams......

@davidbombal Год назад

In tech you never stop learning. Best to learn how to learn as it won't stop.

@ameraa775 Год назад

@@davidbombal Can you help me about adjusting grades

@Shadowofher Год назад

I have attention deficit disorder. All this time I've been saying, look at what Katie's saying, now watch out - now David. Okay, okay, no, don't look at the green creature on the shelf behind Katie. Listen... Very good, I was so proud of myself and then all of a sudden - spongebob speaking spanish ! 🤣🙈

@RegenerationOfficial Год назад

Creativity (art) was the first thing they (AI) replaced.

@davidbombal Год назад

A lot of worries about how AI will replace so many jobs and skills. Only time will tell I suppose.

@yotavares Год назад

Just go to Inspect Element, change the numbers, be so happy that you will want to repeat the year!!

@Skilital Год назад

my russian exams site still have a leak on the api thing, there is a .js file that shows all API listings on their website, made a script using python, and basically loaded all the answers before the exams using the updated cookie they gave. i finished 10-11 classes this August using the script. i use arch btw

@sneil7879 Год назад

oh wow thats crazy

@youz123 Год назад

where should I start if I want to learn that?

@Skilital Год назад

@@youz123 you can start with javascript, learning the basics and then getting into how websites use js on front-end, how API's and cookies work. learn how to use chrome's devtools (ctrl + shift + i), then read website's scripts and search for stuff. Took me several weeks accually to make my own tool.