No video

#NahamCon2024

  Рет қаралды 4,458

NahamSec

NahamSec

Күн бұрын

LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍
For many hackers, changing the redirect_uri to an attacker-controlled host is the only attack they know. But in 2024 it won't work. We have to work harder - exploit and chain multiple smaller bugs together to get the account takeover. Those chains will be the topic of this talk.
📚 If you want to learn bug bounty hunting from me: bugbounty.nahamsec.training
💻 If you want to practice soem of my free labs and challenges: app.hacking.hub.io
🔗 LINKS:
📖 MY FAVORITE BOOKS:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -amzn.to/3Re8Pa2
Hacking APIs: Breaking Web Application Programming Interfaces - amzn.to/45g4bOr
Black Hat GraphQL: Attacking Next Generation APIs - amzn.to/455F9l3
🍿 WATCH NEXT:
If I Started Bug Bounty Hunting in 2024, I'd Do this - • If I Started Bug Bount...
2023 How to Bug Bounty - • How to Bug Bounty in 2023
Bug Bounty Hunting Full Time - youtu.be/watch...
Hacking An Online Casino - youtu.be/watch...
WebApp Pentesting/Hacking Roadmap - youtu.be/watch...
MY OTHER SOCIALS:
🌍 My website - www.nahamsec.com/
👨‍💻 My free labs - app.hackinghub...
🐦 Twitter - / nahamsec
📸 Instagram - / nahamsec
👨‍💻 Linkedin - / nahamsec
WHO AM I?
If we haven't met before, hey 👋! I'm Ben, most people online know me online as NahamSec. I'm a hacker turned content creator. Through my videos on this channel, I share my experience as a top hacker and bug bounty hunter to help you become a better and more efficient hacker.
FYI: Some of the links I have in the description are affiliate links that I get a a percentage from.

Пікірлер: 13
@ZarakKhanNiazi
@ZarakKhanNiazi 2 ай бұрын
BBRE guy is the only person who cares about eyesight of content consumers, he used large fonts which we can read easily
@KarahannAe
@KarahannAe 2 ай бұрын
18:24 if anyone else was also confused when he says POST-AUTH REDIRECT he is talking about after the Oauth dance is over, he doesnt mean POST based oauth flow.
@so3litude_
@so3litude_ 2 ай бұрын
Even though the state parameter is present in the request you should always check for CSRF I've found many targets vulnerable to this . Most of the people leave as soon as they see State parameter in the request. This happens because of misconfig in OUath flow where it doesen't validate the state parameter server side . It only checks if it is present or not.
@deporison
@deporison 2 ай бұрын
Also the login csrf is still possible because we still have the state and we can send it to the user
@BugBountyReportsExplained
@BugBountyReportsExplained 2 ай бұрын
very true! The presence doesn't mean it's checked
@bughunter9766
@bughunter9766 2 ай бұрын
Thanks Ben and Enjoooooooy 😊
@ZarakKhanNiazi
@ZarakKhanNiazi 2 ай бұрын
I love and enjoy hearing him say enjoy
@bughunter9766
@bughunter9766 2 ай бұрын
@@ZarakKhanNiazi All of us like it 😁✌️✌️✌️
@heller64
@heller64 2 ай бұрын
most site now uses strict url validation on redirect_uri not even extra dot can be added btw thx greg
@MarkFoudy
@MarkFoudy 2 ай бұрын
Thanks Ben!
@InfoSecIntel
@InfoSecIntel 2 ай бұрын
Hey brother can you add these to the playlist
@user-mk3zz8zn9b
@user-mk3zz8zn9b 2 ай бұрын
this was nice
@hamzabohra5083
@hamzabohra5083 2 ай бұрын
Second
#NahamCon2024: GraphQL is the New PHP | @0xlupin
26:17
NahamSec
Рет қаралды 6 М.
Вы чего бл….🤣🤣🙏🏽🙏🏽🙏🏽
00:18
Magic? 😨
00:14
Andrey Grechka
Рет қаралды 19 МЛН
WHO CAN RUN FASTER?
00:23
Zhong
Рет қаралды 45 МЛН
How to Hack OAuth
25:10
OktaDev
Рет қаралды 43 М.
2024 Guide: Hacking APIs
20:21
NahamSec
Рет қаралды 18 М.
5 Techniques that you didn't know about Amass
6:01
LeetDoor
Рет қаралды 1,3 М.
Open Redirect Leading to OAuth Access Token Disclosure!
15:36
Intigriti
Рет қаралды 13 М.
My Favorite API Hacking Vulnerabilities & Tips
10:08
NahamSec
Рет қаралды 10 М.
"Easiest" Beginner Bugs? Access Control and IDORs
31:46
InsiderPhD
Рет қаралды 19 М.
HACKING OAuth 2.0 FOR BEGINNERS!
10:26
Farah Hawa
Рет қаралды 43 М.