Dr Katie Paxton-Fear shows us how to hack the Generic University and change grades using the university API. You will learn some of the OWASP top 10 vulnerabilities including Broken Object Level Authorization and Broken User Authentication. Disclaimer: We are hacking the Generic University for educational purposes only. Generic University is a GitHub project that Katie has created to learn Cybersecurity and APIs. Do not hack a real university. // University // The Generic University on GitHub: github.com/InsiderPhD/Generic-University // MENU // 00:00 - Coming up 01:16 - Katie's KZfaq channel // Recommended playlists 02:31 - How to hack and change your grades // "Generic University" 03:26 - Generic University demo // Burp Suite 04:25 - API vulnerabilities // Bug bounty 07:50 - Generic University demo (continued) 21:27 - Thinking outside the box // Hackers mindset 25:34 - Katie's PhD 26:10 - Will AI take over? 29:42 - Advice for getting into cyber-security 34:01 - Recommended KZfaq playlists 35:44 - Recommended sites and books 36:48 - Conclusion // Final words // Videos discussed // Everything API Hacking: kzfaq.info/get/bejne/r6mFhKWUl9i9aY0.html Hacker Toolkit: kzfaq.info/get/bejne/l7RjgcSq28qbdok.html Burp for Beginners: kzfaq.info/get/bejne/i82SjNKrrpqXZoE.html OWASP Top 10 owasp.org/ // Books // Hacking API’s by Corey J Ball: amzn.to/3JOJG0E Bug Bounty Bootcamp Vickie Li: amzn.to/3SPCtBF // Free API hacking course // APIsec Certified Expert Course: university.apisec.ai/ // Katie's Social // Twitter: twitter.com/InsiderPhD KZfaq: kzfaq.info Website: insiderphd.dev/ The Generic University on GitHub: github.com/InsiderPhD/Generic-University // David's SOCIAL // Discord: discord.gg/davidbombal Twitter: twitter.com/davidbombal Instagram: instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal KZfaq Main Channel: kzfaq.info KZfaq Tech Channel: kzfaq.info/love/ZTIRrENWr_rjVoA7BcUE_A KZfaq Clips Channel: kzfaq.info/love/bY5wGxQgIiAeMdNkW5wM6Q KZfaq Shorts Channel: kzfaq.info/love/EyCubIF0e8MYi1jkgVepKg Apple Podcast: davidbombal.wiki/applepodcast Spotify Podcast: open.spotify.com/show/3f6k6gERfuriI96efWWLQQ // MY STUFF // www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // Generic University Challenge // Vulnerabilities: API1:2019 Broken Object Level Authorization API2:2019 Broken User Authentication API3:2019 Excessive Data Exposure API5:2019 Broken Function Level Authorization API6:2019 Mass Assignment API7:2019 Security Misconfiguration Your Goals: - Find the emails of the administrator - Brute force the API to find new endpoints - Find out what grades everyone got in a class - Edit someone's grade - Make an account - Access the GraphQL API - Change another account's password - Login to your account - Access admin API - Find out what vulnerabilities the IT admins have ignored - Make your account an admin - Access the admin control panel - Fire a blind XSS in the admin control panel and validate with your new admin account - Delete everything - Restore everything Disclaimer: This video is for educational purposes only. I own all equipment used for this demonstration. No actual attack took place on any websites. Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!
@dareilcasinojamerojr.4134 Жыл бұрын
Hi SiR David I'm so sad it's because when i try my router crack my password my linux zsh no such file or directory kali linux can you help to fix this??? from philippines....
@SolitaryElite Жыл бұрын
i tried to do that by hacking my teacher but you can only add grades not edit, and adding good grades out of nowhere is just sus asf so :(
@game_vloger0 Жыл бұрын
Sir hack IGNOU website
@megatee4018 Жыл бұрын
@@SolitaryElite don't worry about that I have someone who can do that for you
@megatee4018 Жыл бұрын
@@SolitaryElite don't worry about that I have someone who can do that for you
@impostorsyndrome1350 Жыл бұрын
the fact that you provide all of this for free is truly astounding. Keep it up, it's really cool!
@trscsaeg5 ай бұрын
Love how david controls conversations and keeps experts from going to far over people’s heads
@chelography4410 Жыл бұрын
Thank you for your channel and thank you Katie for your insight and encouragement.
@davidbombal Жыл бұрын
Thanks for watching!
@luizcosta8122 Жыл бұрын
Everytime David posts a video, my dream of living off hacking and bug bounties becomes stronger
@ariasm8911 Жыл бұрын
i saw several video of yours today and realized you are phenomenal interviewer, questions are spot on. thank you David!
@alonzosmith6189 Жыл бұрын
Thanks for sharing, hopefully this will educate schools on what not to do and what to look for and what they should do to secure their systems.
@davidbombal Жыл бұрын
Agreed Alonzo. Let's hope so.
@darwintean4861 Жыл бұрын
Let's hope not😈
@ItzHerobrine Жыл бұрын
@@darwintean4861 xd
@BobBob-qm2bm Жыл бұрын
David B. has done it again! Dr Katie is FEAR-less while hacking those APIs. You are rocking the content and presenting awesome guess. Thank you for being a blessing to the community. 🤓👨💻
@esaelvladimir3672 Жыл бұрын
Eagerly and literally need this from you Mr David
@davidbombal Жыл бұрын
Hope you enjoy the video. Please only hack the generic university - not a real one.
@mohamedmounir6770 Жыл бұрын
At the right time👌. During this week I will pass my first term exams😂😂. Mr.david you're a mind reader 😆
@davidbombal Жыл бұрын
lol... please only hack the generic university - not a real one. Or join a bug bounty program to be paid to hack real companies :)
@mr.docker7699 Жыл бұрын
I didn't know much about BurpSuite before watching this video. I am improving my knowledge because of you. Thank you so much Mr David 🙋♂
@dejuridico1691 Жыл бұрын
Great guest as always, David!. Greetings from Mexico City.
@RustyShacklefordddd Жыл бұрын
Another great video David ive been binge watching your videos since Tuesday!
@nathanaelhassin7729 Жыл бұрын
It's so amazing how you help people out with your service. Continue the good work
@nathanaelhassin7729 Жыл бұрын
XDRHAC
@nathanaelhassin7729 Жыл бұрын
IS THE BEST HACKER
@CyberNancy Жыл бұрын
In my youth, hacking my grades would have been the only chance I had to get high marks.😂
@msascuinonducorduco Жыл бұрын
😂 I would have done the same thing especially with non technical courses 🤦🏾♂ still don't know why in this day and age we have to take those... I had to take: Philosophy 🤨, Home Ec 🗿Social Studies 🙄, and much more. Still no technical courses yet... until I'm a Junior 😔 Woe is me...
@davidbombal Жыл бұрын
lol
@hus73928 Жыл бұрын
but cool high marks
@bubz3t136 Жыл бұрын
@@davidbombal Is this for real? I'm 47, so I missed out on all of this. How common is grade-hacking? Is there really no way of getting caught? How much does it cost to get a hacker to do it for you?
@ishwartaral9019 Жыл бұрын
Sir Can you hack my grades please 🥺🙏🏻 to get only pass 😭 I don't want high marks but only pass please sir 🙏🏻 I can give you money 💰 also whatever you want 💯
@mattjohnson6276 Жыл бұрын
Katie seems pretty awesome! Thanks for bringing her on.
@Ataraxia_Atom Жыл бұрын
This is actually how I graduated early. I went to a remedial highschool and we had to take multiple classes online. Well the teacher had to reset our tests/change grades if we didn't pass with his password at our console. Well I saw his password one time and was able to login and change many of my grades to show that I had passed a bunch of tests I didn't to take. I was so done with highschool
@parryhotter9333 Жыл бұрын
i mean, you could just study and pass the tests 🤡
@Ataraxia_Atom Жыл бұрын
@@parryhotter9333 I mean when you're 16 and done with school, you do what is easiest to get where you want to go. HS is a giant waste of time in the US anyway and I was able to graduate about a year early so
@ipodtouch470 Жыл бұрын
@@Ataraxia_Atom hs is not a complete waste of time if you want to get into tech in college. All that math came into effect when I was building a game with real physics.
@Ataraxia_Atom Жыл бұрын
@@ipodtouch470 you're not wrong, there is definitely value to be had if it's the right time, but nothing that can't be learned later in life. I didn't start to settle down until i was 22, an now i work as an engineer in the semi conductor industry, previously in aerospace
@RAMADHANIBARAKASHALA8 ай бұрын
@@Ataraxia_AtomHello
@tyrojames9937 Жыл бұрын
When Katie told the story about her mother being TERRORFIED of Computers, That part HIT HOME!😊
@shayansec Жыл бұрын
I can't thank you enough for providing this vid... Actually I was learning IDOR vuln and want to practicing on Generic University but can't find any resource about it...searched and this just got appeared.
@Xvics Жыл бұрын
David, your video is great. Please make more videos with Katie; I adore the way she explains things.
@hunte-shovelton Жыл бұрын
Feeling so inspired and positive after this recommendation , thanks!
@hunte-shovelton Жыл бұрын
Xdrhac
@hunte-shovelton Жыл бұрын
Via
@hunte-shovelton Жыл бұрын
Is the best 💯
@NAKAEtekq Жыл бұрын
Haven't watch to the end but I'm already loving it.....thanks david
@ZainBhaiiii Жыл бұрын
Thank you so much David for bringing such a video i hope this will help me. I just want to know is it possible on the real website?
@davidbombal Жыл бұрын
As Katie said in the video, she finds these vulnerabilities in lots of real websites. Make sure you do this legally by joining a bug bounty program to be paid to hack real companies safely.
@ZainBhaiiii Жыл бұрын
@@davidbombal Thank you so much for reply. You are a best teacher in the world
@lovejko Жыл бұрын
Love people, who have the talent to explain. Thank you.
@Ucsd4life Жыл бұрын
I’m going to go hard into bug bounties during my winter break in two weeks, thank you David!!!
@tyrojames9937 Жыл бұрын
I HAVENOT BEEN DISAPPOINTED WITH A VIDEO FROM THIS CHANNEL YET!👔🎉
@funkymonk2254 Жыл бұрын
ThankYou David and Dr. Katie.
@mu3076 Жыл бұрын
I'm doing my Masters Degree in Computer engineering and I hate it. I want to switch to information security but here in Russia foreigners are not allowed to study infosec for whatever reasons... I'm dying from the inside doing what I don't love... I don't know what to do
@glitchinthematrix9306 Жыл бұрын
Bro stop doing it
@mu3076 Жыл бұрын
@@glitchinthematrix9306 I have no other options, No jobs in Africa back home. I just have to suffer through this whole thing...🤦🏽♂️🤦🏽♂️🤦🏽♂️
@pushparajpraveen5340 Жыл бұрын
When you realise you need to study to hack your grades just to compensate for what you not done before your exams......
@davidbombal Жыл бұрын
In tech you never stop learning. Best to learn how to learn as it won't stop.
@ameraa775 Жыл бұрын
@@davidbombal Can you help me about adjusting grades
@jspiteri33 Жыл бұрын
Thanks guys so much great information. Keep up the great work
@arghyl Жыл бұрын
Another great guest! thank you!
@innokirigiti Жыл бұрын
This is 100% true, I also once hacked a voting system website just by replacing /login with /register. It turned out I was able to register as an admin, it was the simplest yet powerful hack I used before.
@ITExplorer-X Жыл бұрын
Great video and an eye opener. Thank you for the information.
@serialkiller8783 Жыл бұрын
do a video of how to stay consistent? i like your consistency of posting new quality content videos.
@edwin_terrones Жыл бұрын
I’m already subscribed and I have learned a lot from her she’s great!
@davidbombal Жыл бұрын
Agreed Edwin!
@abhijithsuren Жыл бұрын
Finally it's here ❤️
@user-xr3gp6es7v Жыл бұрын
Can I contact your team to change my undergraduate grades please
@Mp-jw1qg Жыл бұрын
my highschool used Aeries software , in 2003 i figured out how to access the master accounts by bypassing the schools user login system that ran across every pc on campus. I made a usb that would boot full version of windows isntead of the schools version between bios and windows level. I was able to bypass all the internet filters and had full access to the pc's. It took the cisco networking teacher/class 2 years to figure it out. All of the Teacher computers were all named uniquely since they were the only ones who were able to name the pc's so it was very easy for us to get into the network and see wich physical devices were the teachers lol. The school used to put black rubber film over the keyboards in typing class and the software would keylog EVERY key stroke and judge typing accuracy. it would dump the logs to a central PC that was setup. we found the economics teacher had logged in to a student pc, and logged into Aeries so we logged into his account and changed a bunch of peoples grades, and also took Aeries down for about 4 months by changing the teachers login and passwords. deleting the excel files that aeries would store etc etc. We got suspended and i didnt get to walk across stage at graduation because of it. I got kicked off the baseball team, water polo team etc. I got in a ton of trouble and wasnt allowed to use any Pc at school for the rest of the time i was there. the teachers could never figure it out, i got ratted on by someone whos grades we changed.
@adventurenewzealand Жыл бұрын
I used an system i set up to rewrite excellence (a+) work exemplars supplied by the education system where i live. The system found synonyms for all applicable words. Step two was to put it through a text summarizer. 3 was a stolen text checker. Allways got a plus
@bubz3t136 Жыл бұрын
So you got away with? Could you help a kid in the UK?
@Sentient.A.I. Жыл бұрын
I hacked into my schools network when I was in middle school. I didnt change a single grade but the school wanted to expel me. They failed in this but still it managed to cause enough trouble to ruin my early hacking career.
@landonmiles2935 ай бұрын
how?
@RapsyJigo Жыл бұрын
I like to tell my students who always ask about hacking the best hack I ever done. About ~13 years ago when you would go to the bank and ask for an account and you would ask for internet control of that account (internet was kinda new here so not everyone had it by default) the bank would obviously make an account for you and give you the first time credentials to said account. Now the thing is they gave you the credentials on a sealed piece of paper, most people would take the piece of paper with them home, log in and then change their passwords. But not everyone, some people decided that they'll write down the credentials in their personal notebook for easy memory and just throw the credential paper away. I guess you can see where this is going, I just stood outside the bank, and waited for someone to throw away pieces of paper. Dumpster dive for them and like 1/1000 you're gonna hit the jackpot.
@Joel-gf4zl Жыл бұрын
I was fully capable of changing any grade in high school, but never stupid enough to actually do it. They even stored all students locker combinations on a central server, so if I wished, I could open any locker. Good times.
@abdullahomer14 Жыл бұрын
Teach me.
@0ninja213 Жыл бұрын
@@abdullahomer14 U need to find a vulnerability first
@Goosht Жыл бұрын
hahahaha 24:24 I was listening so attentively and the B roll and caption killed me!
@mikedc Жыл бұрын
The movie wargames in the 80s was the first time I seen this practice...he was in high school changing grades
@davidbombal Жыл бұрын
For the real world, please only hack the generic university - not a real one. Or join a bug bounty program to be paid to hack real companies :)
@oproadiakdajdbhjadajsld Жыл бұрын
HOLY MOLY I NEED IT
@Skilital Жыл бұрын
my russian exams site still have a leak on the api thing, there is a .js file that shows all API listings on their website, made a script using python, and basically loaded all the answers before the exams using the updated cookie they gave. i finished 10-11 classes this August using the script. i use arch btw
@sneil7879 Жыл бұрын
oh wow thats crazy
@youz123 Жыл бұрын
where should I start if I want to learn that?
@Skilital Жыл бұрын
@@youz123 you can start with javascript, learning the basics and then getting into how websites use js on front-end, how API's and cookies work. learn how to use chrome's devtools (ctrl + shift + i), then read website's scripts and search for stuff. Took me several weeks accually to make my own tool.
@balala7567 Жыл бұрын
arch user try not to say they use arch challenge (impossible)
@keshi5541 Жыл бұрын
ofc you use arch linux.
@Shadowofher Жыл бұрын
I have attention deficit disorder. All this time I've been saying, look at what Katie's saying, now watch out - now David. Okay, okay, no, don't look at the green creature on the shelf behind Katie. Listen... Very good, I was so proud of myself and then all of a sudden - spongebob speaking spanish ! 🤣🙈
@endlesscarrow Жыл бұрын
Like the people you interview with anyone who will love to teach I want to be an ethical hacker or cybersecurity but don’t know where to learn it
@ergogenda3374 Жыл бұрын
Great guest as usual. I subscribed to her channel.
@shaikjilani8242 Жыл бұрын
What is her youtube channel name?
@gulmonpradhan3 ай бұрын
Please help me 😭
@aniketsadal Жыл бұрын
Love from India sir❤️ Your content is amazing it helps me a lot
@TRS6328 Жыл бұрын
Which course should I do in ethical hacking or cyber security?
@robeldesta4926 Жыл бұрын
EH
@TRS6328 Жыл бұрын
@@robeldesta4926 r u learning EH
@robeldesta4926 Жыл бұрын
@@TRS6328 yes
@TRS6328 Жыл бұрын
@@robeldesta4926 Till now how much hacking you have learned means if EH is 100% then what % you have learned
@TRS6328 Жыл бұрын
@@robeldesta4926 hey bro tell me how i contact you
@vardhangoud8851 Жыл бұрын
Now I am gonna change my grades. Inspiration: Thank you David sir
@davidbombal Жыл бұрын
Please only hack the generic university - not a real one Vardhan. Or join a bug bounty program to be paid to hack real companies :)
@yotavares Жыл бұрын
Just go to Inspect Element, change the numbers, be so happy that you will want to repeat the year!!
@user-ex7mw8gp8fАй бұрын
Very interesting, what are the website, tools to start as a beginner please I your help take me through all this
@excaliber2845 Жыл бұрын
in a prev video you said you will be showing what you can do with the kali nethunter termux but you haven't even mentioned it since, have you forgotten or have u decided it isn't worth making a video about?
@MFoster392 Жыл бұрын
Another great video, thank you
@GentlemanPro-zz2ke9 ай бұрын
Hello Mr David and Dr Katie, I'll like to ask, what if the website your trying to test does not have an API and you are only able to use burp suite. What will you advice you do in such situation.
@hendahmed2408 Жыл бұрын
is it still not working😢? iam starting my pentesting course, i have mac m1pro so u think i should seal it and buy windows?beacuse as you say some tools doesnt work?
@ybfc311 Жыл бұрын
this was a great talk... 👍🏼 will be def looking into more api stuff
@endlesscarrow Жыл бұрын
Please awaited to hear from you
@TheShadowCamo10 ай бұрын
I actually graduated from Generic University. I got a degree in Translating British to English.
@RegenerationOfficial Жыл бұрын
Creativity (art) was the first thing they (AI) replaced.
@davidbombal Жыл бұрын
A lot of worries about how AI will replace so many jobs and skills. Only time will tell I suppose.
@francaperichault9486 Жыл бұрын
Leaving a relationship you’re not happy in is much easier than emotionally damaging someone. But selfish people don’t get that
@florencedaniel2007 Жыл бұрын
Be sure before you take actions, smoothspykings can help you access their phones
@lohphat Жыл бұрын
THIS is what blockchain should be used for: Creating an immutable ledger so that entries cannot be changed.
@rationalbushcraft Жыл бұрын
I have used burpsuite but never considered looking at APIs like that.
@albertma4875 Жыл бұрын
Not going to lie this sounds like a good way to get kids into cybersecurity
@ssf_9 Жыл бұрын
Massive Respect David sir.. 🙏
@ModemMage Жыл бұрын
Great video. I'm a network engineer trying to become a little more broad and I'm definitely subbing to insiderphd
@hendahmed2408 Жыл бұрын
is she using mac m1or m2 please answer me
@monkeydluffy9933 Жыл бұрын
I remember doing this with just social engineering and a Bad USB attack as the college servers were too easy to access
@mranthony1886 Жыл бұрын
7/11/2022 - At Twitter, as well as at some banks, the answer appears to be lines of code. - Good engineers produce a lot of them.... never mind security which is more considered...
@bartmaunga783120 күн бұрын
how cam i get this software?
@michaellasambouw Жыл бұрын
It would be nice to having Katie on your KZfaq David. Thanks for sharing Katie
@december8421 Жыл бұрын
very cool! more videos like this)
@mortal5250 Жыл бұрын
so we can use this to hack our grades, isn't it illegal?
@marwanharby5251 Жыл бұрын
what if i didn't find the api ?
@salamlacin4715 Жыл бұрын
What does it mean to have a rabbit in the control system
@zentraidee9701 Жыл бұрын
"Be an information Sponge"-Dr. Katie Paxton
@mereculescomeback9544 Жыл бұрын
this sounds silly, but I appreciate her work
@maniakdemi3548 Жыл бұрын
Hi David... I recently watched your video on how to install Kali nethunter on an android phone. After completing all the steps and installing nethunter kex. I'm unable to connect openvpn and network manager is disabled. Do I need to root my phone in order to get it enabled?
@christopher38627 ай бұрын
But Would the school actually notice if one student out of 1000 changed there results though?
@grandmagician4798 Жыл бұрын
Hello Mr. bombal can you please make a video on installing kali Linux on a Samsung galaxy device with android 12
@grandmagician4798 Жыл бұрын
@Add-on-Techlore01 yes can you contact me
@daboijason9466 Жыл бұрын
Cant wait to add a bit of bruteforce and loads of proxies for deauth countermeasures
@jeremiahosagie613711 ай бұрын
Please can you help to hacky results
@pradnyabugdane8287 Жыл бұрын
Please tell me process to hack write protected sd card to retrieve data
@islamicspirit5956 Жыл бұрын
love it
@davidbombal Жыл бұрын
Glad you enjoy the videos :)
@alienrevolution Жыл бұрын
Dr Kate Paxton Fear or BLINDSPOT Ashley Johnson ? WOW Amazing lol
@upelister Жыл бұрын
Great video, thanks.
@SmedleyButler1 Жыл бұрын
What's her yt channel name again?
@Aaron48219 Жыл бұрын
I miss the old days in the 90s of directory manipulation.
@loganfruchtman953 Жыл бұрын
You know how to hack your grades? Show up to class, Participate, Do the homework and and do well on quizzes tests and exams
@yoursoulessmate Жыл бұрын
Yes, but it was frustating when the teacher gave me D. I wish at least it was C. Sigh...
@nineb7640 Жыл бұрын
Hi David,thank you very much for the great content,I love all your subjects that you bring up to the table I just wana to mention if possible that you talk about decentralized VPN and if you can get some experts to talk about it ( cause I see a very good project called deeper connect) you can search about it of course I see it as very interesting kind of technology in these days. Thanks a lot again for everything I learnd alot from you and your video. All the best
@theloser3965 Жыл бұрын
Sir, I am from a non-IT background, but I wish to start my career in ethical hacking I want to learn everything which is essential to become an ethical hacker and it is also my desire that you could like to be my mentor?
@dareilcasinojamerojr.4134 Жыл бұрын
Hi SiR David I'm so sad it's because when i try my router crack my password my linux zsh no such file or directory kali linux can you help to fix this???
@Firoz900 Жыл бұрын
I subscribed Katie.
@MikiasTeshome6 ай бұрын
Greating from Ethiopia
@rodrigogomesvianna15611 ай бұрын
Hello, David. How are you? Need to hack a university in Brazil in order to change 1 grade. Could you help me? Just need to change 1 single grade. That's all. I didn't give importance to the content the professor was teaching and failed (actually, his content is the craziest I have ever seen). I did the discipline again with other professor and got a 9. Thx