An IDOR Vulnerability on INSTAGRAM! 49500$ Rewarded!

Get 10,000 free mins to build mobile and web app: bit.ly/3uuotSV
Learn more about ZEGOCLOUD API & SDK: bit.ly/3Fy5HAm
How to build iOS, Android and Web app: bit.ly/3hf7xfX
Check out my FREE course on SQL Injection for Beginners with hands-on training and completion certificate: bit.ly/3MTMQ2Q
Neeraj Sharma's writeup: infosecwriteup...
Neeraj Sharma, a 20-year-old Security Enthusiast from India has discovered a critical IDOR (Insecure Direct Object References) vulnerability on Instagram which allowed an attacker to change the thumbnail of any instagram reel without any authorization!
Facebook offered him 49500$ for reporting this bug and also added him to the Hall Of Fame.
Facebook's Bug Bounty Hall of Fame: / thanks
Thanks for watching!
SUBSCRIBE for more videos!
Join my Discord: / discord
Follow me on Instagram: / teja.techraj
Website: techraj156.com​​​​​
Blog: blog.techraj15...

[@TechRaj156]

Check out my FREE course on SQL Injection for Beginners, you also get a completion certificate: bit.ly/3MTMQ2Q

[@Jay-gf4pt]

Your explanation was perfect, thanks for the video

[@24host99]

That bounty hunt was so rewardable

[@Naveenventure]

Reward:-40 Lacks.....💀

[@mangakadomingos292]

I like the way you explain, clear as clean water, keep it up.

[@rakno12]

Damn...that looked so simple!!!

[@IHAteyoutub]

Yeah

[@akinkunmi__]

Exactly

[@muhammadazkanaufal8695]

Too simple tbh

[@carollina9781]

Too simple that nobody would believe a bug was there

[@d-balldragonballs4901]

Can you please explain..how did you bypass ssl pinning in genny.....

[@adarshverma3372]

That’s why all your action should be user centric in the backend

[@imkir4n]

perfect explanation and awesome finding!!

[@0RIPPER0]

Lol 🤣 Beluga is hacked ... Now his Hecker friend will come to save his ass..

[@ncr.jat.samaaj]

billo bagge bagge bilya da ki kregi bagge bagge bilya da ki kregi " kuch nahi kregi bhai bass bounty dilvayegi 😂"

[@dimlight1172]

Thanks for the explanation brother!! Got to learn many new stuff.

[@nadakuditigopikrishna6587]

Thank you bro! you explained very well. your presentation skills are awesome.

[@rakeshpanchal8007]

Your explanation was perfect, thanks for the video bro

[@grahampawar]

Please bring more such examples 🙏🧑‍💻

[@paritoshkumar4465]

Bro why don't you start a complete course of coding from beginning to expert level. Ex- coding + connectivity to database related video. I know coding then what to learn after coding i don't know That make hoch poch in my brain.

[@atirrasheedhashmi]

He is gonna charge you & he is not uploading here on youtube

[@chinedumichael8776]

We'll pay I need it too

[@noorjay1363]

@@atirrasheedhashmi I will pay

[@Riborwahz]

Who else not indian but Indian Well not the small letter i 😂

[@nafeeskhan007]

Nice detail explanation 👌 👍 thumb up. Keep it up 👍

[@shivajivarma]

Hi @Tech taj what is your mic setup? Can you share amazon link for it? FYI. Looks like your website is down. Its showing WIZ service error.

[@didyouknowamazingfacts2790]

I'm a little confused by the difference between a BOLA and IDOR vulnerability?

[@Child0ne]

Your channel is coming a lot good bro

[@_Thomas_Shelby_]

yesterday loi has posted it full form :-Insecure direct object reference

[@jaisaljaisu8332]

mahn , appreciate your work .. thanks for this :)

[@noorjay1363]

Crazy.. I never think that thumbnail can be hacked.

[@JohnPaulBuce]

trolling session

[@Shadow-xi2sv]

Really nice explanation! Thanks!

[@GameWithSNAKE]

New subscriber ❤️

[@funfillers249]

Is it's patched?

[@nitinkumarsaini....]

Yes

[@badmashito4059]

Damn it was a awesome finding !!

[@belharra5756]

Lets say i am hunting for price manipulation idor but the request is encrypted with % any way to decore it ?

[@IDontModWTFz]

I wonder what other sites are vulnerable to this attack?

[@zedvn3792]

Could you please tell me how to use burpsuite in the android emulator like in the exploit video ?

[@nyctophilialone]

So this vulnerability doesn't work now, right?

[@hackersvision2811]

My mentor is here again with another motivating hacking video ✌️✌️

[@itsmmdoha]

Damn! Great video 🔥

[@saleemahmed8302]

Wonderfully explained. Thanks a lot.

[@MalikRabichon]

i don't trust on the bug bounty program , the rewards are not two much !

[@vrushabhpatil2867]

Well r u studying right now or doing some cybersecurity job

[@chupkaryaar1677]

damn! copy of network chuck btw loved your videos

[@hridaybhatia5643]

Superb video sir loved it 😍😍

[@AskLichy]

M ardam kale but video motham chusa.... ❤️

[@raphaelziade5422]

Hi, what the name of that Phone sim that he used...?

[@mixwood1130]

Is it possible to reproduce the vulnerability?

[@photographymaniac2529]

Awesome find definitely

[@ItzHerobrine]

I love how the comment section has no bots

[@remy2885]

Raj i really appreciate ur videos very clear and interesting, could u make a vid about evilnginx2? i think it would be great to learn about it for alot of people.

[@rivu____2329]

Can this Practice can we do after this?

[@surendarmurthi551]

Bro neenga dhan unlucky bug hunter channel host ah

[@bisen6475]

Beluga👀

[@igu642]

❤❤

[@praveenkurup8894]

Please make A video to access server with shodan

[@PepesCashino]

He sound like an indian scammer

[@magenta8979]

Dark market probably 100k$

[@OthmanAlikhan]

Thanks for the video =)

[@acousticamar8109]

Moral:- Bug Kahi Bhi Ho Sakta Hai 🥲

[@niravchauhan2278]

Subscribed✌️

[@Yash15361]

love your content :}

[@thewolf-ps1qz]

poor beluga account 🥺🙏

[@unknown_3293]

awsome prank to people

[@helloworld4402]

Make more videos like this

[@TechnicalRex]

Awesome

[@pinkpantherkidsofficial9058]

Your explanation was not good no thanks for the video

[@rigbyb]

good video thank you

[@proxy5061]

37lakhs ✌️✌️

[@harshzala7019]

Can we try now

[@_AayushKumar]

Great. Explanation

[@rishabhrana3773]

I know him

[@robot67799]

Woah! It's so cool!

[@jeanandre3651]

wtf 🤯

[@zeeshandil2917]

so easy and so powerful

[@imvjsai]

Good one Anna. Keep going

[@akhilv3487]

More videos plz

[@davbj7707]

Great vid man

[@dhanushariah5330]

More such videos bud!

[@yuuki-1829]

Fixed?

[@passiveearner726]

Second

[@vinothn4228]

Cool mannnn😍

[@ft.Atulkumarsingh]

Some websites has listed amount to 4500USD??

[@adityamehra4412]

No its 49500USD

[@adityamehra4412]

i know because he is my friend

[@nitinkumarsaini....]

@@adityamehra4412 o really , you are also hacker

[@ft.Atulkumarsingh]

@@adityamehra4412 okay, I was confused that some websites are saying 49k and some are 4500 thanks for conformation.

[@ft.Atulkumarsingh]

@@adityamehra4412 tell him congrats from me.

[@latesthitstch9428]

Wow

[@utensilapparatus8692]

1337

[@ClashWithHuzefa]

😎

[@lesleybw]

🤯

[@itscorneveryday6344]

Bro i did report 4 Idor's but haven't got response it's been 24 hours for the first Idor.. are they gonna response me or not? it says it is private and only participants can view it... when they gonna response me please answer...

[@negaaa5080]

in which app

[@itscorneveryday6344]

@@negaaa5080 yahoo or reddit

[@aashita6850]

Woaaaaaah! How does something like this even hits in the mind?

[@BlueEdgeTechno]

It doesn't, they try a bunch of different methods until something seems odd.

[@aashita6850]

@@BlueEdgeTechno Ah! I guess Patience is the key!!

[@savagegirl9357]

First

[@akshaychordia8724]

Hi @Beluga