Тёмный

How not to implement AWS S3 signed URLs? $25,000 bounty 

Bug Bounty Reports Explained
Подписаться 57 тыс.
Просмотров 9 тыс.
50% 1

Опубликовано:

 

17 окт 2024

Поделиться:

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист
Посмотреть позже
Комментарии : 24   
@BugBountyReportsExplained
@BugBountyReportsExplained 3 года назад
Welcome to the comment section! I hope you enjoyed the video. Sign up for my mailing list to receive the BBRE newsletter to get the best hacking info delivered right to your inbox: mailing.bugbountyexplained.com/
@monKeman495
@monKeman495 Год назад
Came after your recent finding so here it is all started 😂😂watching again after long time
@BugBountyReportsExplained
@BugBountyReportsExplained Год назад
Yeah, it's almost exactly the same
@renganathanofficial
@renganathanofficial Год назад
haha same here!
@dhruvkandpal9909
@dhruvkandpal9909 3 года назад
Love your content and meticulous explanation! 👏🏻👏🏻👏🏻 Keep posting such amazing videos!
@test-vf3iv
@test-vf3iv 3 года назад
nice video man really enjoyed watching it and a very easy explaination
@_DeProgrammer
@_DeProgrammer 3 года назад
Love these videos! Thanks.
@000t9
@000t9 3 года назад
Hello Is this vulnerability disclosed 2 years ago as I saw in this video?
@BugBountyReportsExplained
@BugBountyReportsExplained 3 года назад
yes, but cloud-related topics are only more and more popular
@000t9
@000t9 3 года назад
@@BugBountyReportsExplained Thank you!
@ahmadshami5847
@ahmadshami5847 3 года назад
my goodness that bug is so cool yet it looks so random. did the hunter mention any thing about luck involved or did he use a certain methodology.
@BugBountyReportsExplained
@BugBountyReportsExplained 3 года назад
unfortunately this aspect was not mentioned in the blogpost😕 I'd love to hear that too
@jaeger809
@jaeger809 3 года назад
I hope i can do this. Thanks
@hamzabettache497
@hamzabettache497 3 года назад
any chance with "GET /api/aws/getSignedImageUrl?objectName=316923.jpg&contentType=image%2Fjpeg" ?
@BugBountyReportsExplained
@BugBountyReportsExplained 3 года назад
yeah, definitely test the objectName parameter. Also, there's a chance for header injection using the contentType param
@hamzabettache497
@hamzabettache497 3 года назад
@@BugBountyReportsExplained thanks, how to exploit the content type and header ?
@BugBountyReportsExplained
@BugBountyReportsExplained 3 года назад
@@hamzabettache497 use %0d%0a characters. You'll find more by googling CRLF injection
@cybersecurity3523
@cybersecurity3523 3 года назад
Good bro
@dzakialthalsyah
@dzakialthalsyah 3 года назад
@sameersh.5647
@sameersh.5647 3 года назад
one day i am gonna hack google because of this guy
@BugBountyReportsExplained
@BugBountyReportsExplained 3 года назад
I hope you will! good luck!
@pmohan67
@pmohan67 3 года назад
I am beginner of bug finding How I find bug using tools Tell any tool name to finding How know the bug is there How check the bug status securely Make an video about How find bug How verify it How report it Pls Make an video 👆 👆 👆 👆
@BugBountyReportsExplained
@BugBountyReportsExplained 3 года назад
My every video is about this I think.
@tekken-pakistan2718
@tekken-pakistan2718 3 года назад
04:04 Thanks!
Далее
$31,337 Google Cloud blind SSRF + HANDS-ON labs
9:44
Upload Images Directly to S3 from Front End
18:28
Просмотров 125 тыс.