In this video we're looking at Cross-Site Request Forgery, definitely on the more technical end of beginner bugs. This bug is all about abusing how web browsers keep people logged in to trick users into doing actions to their account. It sounds really complex but actually finding them is quite simple, all you need to do is find a single endpoint with a missing token, and bam, way in! This marks the penultimate episode in the Finding Your First Bug series. Fear not, when one door closes another opens, starting soon will be Finding Your Next Bug, all about building on what you've already learned in this series and taking your bug hunting to the next level.
Welcome to this video in the "Finding Your First Bug" in this series I'm going to go over some good first bugs: explain what they are, how to find them, show some examples of real bugs in the wild that paid out and finally do a practical example with Burp on a real target.
-- Case Studies --
- CSRF Trial 14 days express subscription - $300: [ Ссылка ]
- Site-wide CSRF on eats.uber.com - $6,000: [ Ссылка ]
- FileUpload Plugin: CSRF (delete all attached files) - $300: [ Ссылка ]
- Account takeover at [ Ссылка ] due to no CSRF protection in connecting Yahoo account - $512: [ Ссылка ]
- CSRF leads to a stored self xss - $500: [ Ссылка ]
- CSRF on Periscope Web OAuth authorization endpoint - $2,520: [ Ссылка ]
- Cross-origin resource sharing misconfig | steal user information - $1,000: [ Ссылка ]
Finding Your First Bug: Cross-Site Request Forgery (CSRF)
Теги
bug bountybug huntingbug bounty huntinginsider phdinsiderphdfinding your first bugbug bounty for beginnersbug bounty tutorialinfosecethical hackinghacking tutorialhackeronebugcrowdgetting startedhow to get started bug bountypentration testingpenetration testingcsrf attackcsrf poccsrf attack examplecsrf attack tutorialcross site request forgerycross site request forgery explainedcross site request forgery examplehacking