Exploit XXE to Perform SSRF Attack
5:37
Пікірлер
@stakmodsco
@stakmodsco 8 күн бұрын
Amazing knowledge and good job of how you explain step by step. Do you have a way of bypassing KYC (document submission and live selfie verification)
@damoeloiflin5417
@damoeloiflin5417 25 күн бұрын
Thanks🙂
@damoeloiflin5417
@damoeloiflin5417 25 күн бұрын
Great👍
@saikirangoud118
@saikirangoud118 29 күн бұрын
brilliant
@DickmanYT
@DickmanYT 23 күн бұрын
do u need premium burl for this?
@raoashar887
@raoashar887 Ай бұрын
u said in video that wait until any victim user click our comment, but in your case you directly get many users like clicking on poll now in my case i won't how much time should i wait??
@tahmidrad6647
@tahmidrad6647 Ай бұрын
Do I need linux to do this or I can do it on windows?
@DoctorWEED-
@DoctorWEED- 2 ай бұрын
its a perfect metod to learn
@cypher875
@cypher875 2 ай бұрын
I got a very less secure app, which allows unlimited OTP tries .. in 5 mins then we just have to resend the otp is it possible to crack it ?
@stephenraj-jf8un
@stephenraj-jf8un 2 ай бұрын
good explanation, is this a stored or reflected xss?
@assassinkid1011
@assassinkid1011 2 ай бұрын
stored
@lskdkdkalslw
@lskdkdkalslw 3 ай бұрын
Clear and well explained👍👍
@AtulRawatpredator
@AtulRawatpredator 3 ай бұрын
Love the way, you explained this concept.
@ghostdocter9006
@ghostdocter9006 4 ай бұрын
can we bypass valorant by this ?
@aliyassin5631
@aliyassin5631 4 ай бұрын
what to do if the website validates the extension name but not the file contents? How to activate the code inside the file?
@himangshumahata4799
@himangshumahata4799 4 ай бұрын
Bro why don't you upload more videos, for network hacking
@drewcurry2882
@drewcurry2882 4 ай бұрын
The basic flaw: it assumes the required code does not change. Use an authenticator tool, with 6-digits that change every 30-seconds, with a 3-mistakes-results in a 5-minute cooldown, and you will need a quantum computer to try to break that puppy.
@MafiMartins-cw5tv
@MafiMartins-cw5tv 4 ай бұрын
Thanks for teaching and giving us the ideal are amazing. I am really happy to be here thanks again 🙏🙌🧐✊
@Some_retard
@Some_retard 5 ай бұрын
Cool video. Are you Israeli or French 😅 the accents always sound so similar
@cameronrich2536
@cameronrich2536 5 ай бұрын
Nice
@MrDARKPSYCHOLOGIST
@MrDARKPSYCHOLOGIST 5 ай бұрын
This Channel Is Amazing Man 👨
@Nochymusic
@Nochymusic 6 ай бұрын
Will the admin get notified??
@user-ev5uo8lb3g
@user-ev5uo8lb3g 6 ай бұрын
Whats the Solution?
@ancestrall794
@ancestrall794 6 ай бұрын
Awesome video
@KLM-writes
@KLM-writes 6 ай бұрын
what is the alternative to Burp collaborator, to see thee data , as its a paid tool, can we go for any free tool to check the data,
@user-un9sh9qe8z
@user-un9sh9qe8z 6 ай бұрын
thie work for only xss stored ?
@user-jf3dt4tk3e
@user-jf3dt4tk3e 7 ай бұрын
many love
@youssefblt9839
@youssefblt9839 7 ай бұрын
helpfull thanks alot straight to the point
@Amil_Esgerli
@Amil_Esgerli 7 ай бұрын
Thanks
@opensearch-
@opensearch- 7 ай бұрын
this is prob the only video i understanded
@bjtaudio
@bjtaudio 7 ай бұрын
That will not work for most sites, as 1 the 4 digit usually 6 digits code keeps changing, often one-time codes and time limited, 2 after several failed attempts the account is locked, 3 often a secure app is used, 4 the system alerts the account holder of a login from a new device. 5 behavior checks, to see if its a automated attack.
@gerardclaude486
@gerardclaude486 8 ай бұрын
Very nice video
@Ashton.Rblx-
@Ashton.Rblx- 9 ай бұрын
How do i get burp suite for free?
@gambaboyallin
@gambaboyallin 9 ай бұрын
great content
@nishantdalvi9470
@nishantdalvi9470 9 ай бұрын
What a great explanation this video should be hosted on port swigger as a community lab solution
@tiwister8773
@tiwister8773 9 ай бұрын
thanks
@siefkhaled1374
@siefkhaled1374 9 ай бұрын
verry good
@montala3380
@montala3380 10 ай бұрын
Can you explain me why we have to use `https`? I did try with `http`, it does not work...
@siefkhaled1374
@siefkhaled1374 10 ай бұрын
nice <3
@shvraj883
@shvraj883 10 ай бұрын
How I want see an otp send by server
@studiospan6426
@studiospan6426 10 ай бұрын
So basically this attack works on requsting a new otp from the server then trying that otp and hope that our combination of generated and payload otp somehow matches . Isn't this , really difficult and completely based on luck i mean yeah we can increase the speed by making our own code in nodejs or some other languages which are very very fast when it comes to webscraping but still the odds are very very high thay we will get the code i am not sure if any website will be willing to pay for this bug . Please correct me if am wrong 🙏
@rubelhossen5401
@rubelhossen5401 10 ай бұрын
Is it possible to steal all of the chome broswer cookies of victim uisng cross site scripting xss Attack on valuable website
@ahmedabualkass390
@ahmedabualkass390 10 ай бұрын
The time is right. When the OTP is six digits long, it will not prevent the final cut of the exam in case of selection due to a challenge. If the OTP is not released within 60 seconds, the OTP will expire.
@bird271828
@bird271828 10 ай бұрын
This was nice. Thank you 🙏👏👏👏👏
@winik2485
@winik2485 10 ай бұрын
What is that comments box has validation and it we can see the code comments section
@user-qn1ri4zy5f
@user-qn1ri4zy5f 11 ай бұрын
lol...now a days firewalls and sniffers are more powerful and normally thwarts this kind of attacks. However, good explanation.
@HOMEISBASE
@HOMEISBASE 11 ай бұрын
very good job on the simple explanation! tnx
@dietrichdietrich7763
@dietrichdietrich7763 11 ай бұрын
interesting things
@user-lz2tn7rl4h
@user-lz2tn7rl4h 11 ай бұрын
so clare and simple actually i didn't saw anyone explain like that thank you so much
@itsksujan
@itsksujan 11 ай бұрын
what if the victim already has an associated social media profile with his account
@romogomu6726
@romogomu6726 11 ай бұрын
Thankyou
@romogomu6726
@romogomu6726 11 ай бұрын
Thank you, need teachers like you - the very way you explain ☺️