In this video we're looking at Cross-Site Request Forgery, definitely on the more technical end of beginner bugs. This bug is all about abusing how web browsers keep people logged in to trick users into doing actions to their account. It sounds really complex but actually finding them is quite simple, all you need to do is find a single endpoint with a missing token, and bam, way in! This marks the penultimate episode in the Finding Your First Bug series. Fear not, when one door closes another opens, starting soon will be Finding Your Next Bug, all about building on what you've already learned in this series and taking your bug hunting to the next level.

Welcome to this video in the "Finding Your First Bug" in this series I'm going to go over some good first bugs: explain what they are, how to find them, show some examples of real bugs in the wild that paid out and finally do a practical example with Burp on a real target.

-- Case Studies --
- CSRF Trial 14 days express subscription - $300: [ Ссылка ]
- Site-wide CSRF on eats.uber.com - $6,000: [ Ссылка ]
- FileUpload Plugin: CSRF (delete all attached files) - $300: [ Ссылка ]
- Account takeover at [ Ссылка ] due to no CSRF protection in connecting Yahoo account - $512: [ Ссылка ]
- CSRF leads to a stored self xss - $500: [ Ссылка ]
- CSRF on Periscope Web OAuth authorization endpoint - $2,520: [ Ссылка ]
- Cross-origin resource sharing misconfig | steal user information - $1,000: [ Ссылка ]

свернуть