Cross-Site Scripting (XSS) Explained! // How to Bug Bounty

[@NahamSec]

Want to learn directly from me? Check out my course here: app.hackinghub.io/hubs/nahamsec-bug-bounty-course

[@Skaxarrat]

This is my favourite format. You should do all the Top 10 OWASP vulnerabilities (Or Top 25...) like this one.

[@wolfrevokcats7890]

Finally, someone is teaching XSS the right way. I'm glad that you're listening, I love how you make the font way bigger than your old video. I can watch your video even in mobile phone now if I don't feel like to open a laptop. Thanks man appreciate it

[@mamuli01]

naham sir i just opened this video for 10 seconds and thought of exiting it but read the first comment on ur video and damn i am blown away by your explanation

[@NahamSec]

I'm so happy to hear that! I hope this helped!

[@aswadshaikh8312]

Awesome video Naham.Absolutely loved it. Just one suggestion:- Can you please go a little slow next time? As someone from a technical background I could understand everything and keep up with u but even a lapse of couple of secs would lose me completely about what's happening

[@AliYar-Khan]

Damn ... the only thing now holding us to hunt XSS are our own Procrastination

[@rydanstark9494]

Great man. Your videos helped me transition into Webapp pentesting from System Pentesting ❤🎉 More Power to you

[@saadadil6112]

great video naham .absolutely loved it

[@shubhamgupta-ji9nh]

at 9:48, instead of an application, there is api running in the background of the application and it has a parameter which is un-used in the api, is there any possibility of a XSS considering the request is in json?

[@BoricuaFez]

Thanks for the information. Been working on a target that has made me loose motivation and taken me down a rabbit hole about JS and React.JS. This video and others gave another point of view on how to approach the target. Thank you again!

[@lostsecArmy]

🎉🎉🎉 love you from Pakistan 🎉🎉🎉

[@souraldandothi5681]

Great Approach! Looking forward to it!

[@ExplorewithRite]

the blog title field seemed to have a validation check ,is it possible that it would be bypassed ? and hence archieve xss through the blog title field

[@ss-rc1gy]

awesome content , what about the DOM xss and stored xss?

[@papafhill9126]

NahamSec probably wants people to find injection points first, that's the "foothold" so to speak. Then you escalate from there, so RXSS is a great first step to getting to escalation.

[@ss-rc1gy]

Ya , that makes a lot of sense 😁

[@vexed3185]

​@@papafhill9126 Hey man, i dont understand, how can this affect the webapp? like does it edit the main code of the webapp or what?

[@un4v5s83]

thank you so much! i feel indebted to learn this much from scratch and from only knowing the terminology of XSS that need put payload on some parameter into this little more advanced things that very interesting to me to learn about. I need to learn more and how far the learning goes? (Try to play auto5d chess in case one day i will come back to this video)

[@rohitshastry2007]

Really Great Stuff!! Thanks for the 5WP

[@alexparakan]

Does anybody here with ADHD who are super passionate about pentesting but struggling to start it?! 😢

[@skyedunphy]

Thats so me

[@bhavypatel1642]

Yes bro I am same here

[@alexparakan]

@@skyedunphy I knew I wasn't alone. But the only way for us to survive this is we people with ADHD have to work together. Or we'll probably eventually become broke af. But the best thing about us is we can super skilled and hyperfocused in the IT field. Especially since we are good at finding things. Would be helpful if you have any suggestions for solving this problem. Because I'm just too tired of just wasting my time and saving videos like these to my watch later list.

[@garrettguthrie2536]

@@alexparakan me too!!!

[@WorldwideWave811]

i really love your content bro, helps me learn alot as a cyber security student

[@MiroPeev]

Great video and content! Thanks for helping out ....One question i have - where do you install your attack box for bug bounty? Is it on the VPS provider or it is local on your machine?

[@sanjaiKumar-.-]

I would positively say he uses a VPS

[@WaseemLaghari-m4e]

Once i got xss on TikTok but on that time they did not start their bug bounty program 😢

[@vlogsprasenjit]

Great start❤

[@ezekiel-my1pl]

well explained! thank you for this

[@parshva3516]

do you suggest using a VPN while testing?

[@Dext3r-Hwqkwtom]

Thank you for sharing your knowledge. Please extend this to 10 weeks 🙏🙏🙏

[@b.i_khalil]

How do I login with an API key??

[@Frawkesish]

So I'm not gonna lie.. I've been trying to learn the art of bug bounties for some time and to be frank I got overwhelmed and pivoted to Web Development.. even landed a gig as a developer and about 6 months in now I'm back to try again.. I feel like this makes a hell of a lot more sense now having built several web apps now. I guess I should start by just hacking my own shit..

[@ciconid]

What resources did you use to learn Web Dev?

[@Frawkesish]

@@ciconid Fireship youtube channel and practice. Start with a project you think is cool and learn how to build that. You don't have to know everything to build something.

[@musaharuna756]

​@@FrawkesishBut how did you find the gig. Is it a full time?

[@Frawkesish]

@@musaharuna756 I actually kinda "hacked" my way into my current role.. I was working at an *insert retail company* and I found a simple issue I could solve. For me I found it frustrating we had to post a pic to discord and wait for a response to get the price of something that wasn't scanning.I ended up making discord bot with a simple database so I could search for the price of some specific items by name . I waited for a good opportunity to show it off to the right people and landed a gig . I don't get paid that silicon valley programmer pay but I now make a decent enough salary considering I had Zero experience and no degrees.. Note they are not even close to a tech company and I am the only developer.. it is very stressful at times but if I gotta go another year or 2 to keep building my resume up then so be it !

[@Frawkesish]

@@musaharuna756 I'm not sure if my comment actually worked or not. KZbin is tripping

[@razmjumehdi9069]

Do you upload videos for 5 weeks on this KZbin channel?

[@SamuelEssa-ic6bt]

the last way this is self XSS ?

[@gamerz9129]

i always get double quote filter " is there any technique to bypas the double quote filter ?

[@mr.bouttacheck6656]

Within the next 4 weeks ima get something on one of those targets 💪🏾

[@haanrey]

Lookingg fresh my byoyyyy !!!🤩

[@preciousjoyb]

Me, I am a Software QA and starting to learn Pentesting bug bounty

[@mmnahian]

i am first bro

[@NahamSec]

Almost

[@rctech1237]

I am feeling like a bug hunter now 😂😊

[@musaharuna756]

Well ur not lil bro

[@mohammedettayby]

Thanks man this vidéo help me to get my first bounty

[@askholia]

Great video!

[@praveenmsp]

Why do you always change the protocol to http?

[@NahamSec]

Because the labs were having issues and only worked over HTTP. We did implement a fix though!

[@Jarling-so4oi]

Make us more technical content and more hackinghub hubs, can we have a open redirect explained?

[@Couple-Rounds]

Lots of Love 🇰🇪

[@ucheugbomah2228]

all this you found means that this all vul?

[@enigma.better]

You really gotta do this for other common vulnerabilities too we all love this kind of content

[@Farsheedify]

Thanks for the amazing content.

[@leghdaf]

Great Content ...

[@AbhishekGupta-fz5dn]

this is the best video on internet about XSS

[@lol-hz9mc]

Thank you for the video sir!

[@MarkFoudy]

First

[@NahamSec]

[@MarkFoudy]

Thanks for the content, nahmsec!

[@fabiothebest89lu]

I learnt something new, thanks

[@ankitjha883]

Ben is really good

[@thegyanshow812]

amazing🤠🤠

[@saulo-moreira]

5:37

[@am012z]

Amazing 👏

[@minervaa0001]

şu bugbounty öğrenmeye çalışan türk yok mu ya birlikte öğrenelim yazsınn

[@Duskk0077]

Great video thx

[@elinamk12]

so good big thanks.

[@bertrandfossung1216]

Thank you for this awesome video. Little by little I’m grabbing these .

[@Bit_Fury]

Thank you very much You have given us so much 😊❤

[@GilligansTravels]

Thank you

[@aquatester]

THANKS DUDE!!!!!!!!!!!!

[@AntoinetteFanny-l8s]

Lewis Betty Clark Joseph Anderson Jason

[@AbdelrahmanAwad-kd5le]

bro you are awesome

[@AntoinetteFanny-l8s]

Garcia Susan Walker George Hall Sandra

[@شیداعسکری-ل5ل]

Great

[@Learning.Something.New.Daily.]

👍🏻

[@iamwitchergeraltofrivia9670]

Hahahhahahahhaha blocking dangerous prots 😡😡😡😡😡😡😡😡

[@shubham_srt]

Thanks

[@benjamenwitaker5437]

P r o m o s m

[@austynstephens9263]

[@ahmada8629]

✌🏻😍

[@h4s4n_ma]

wow😍

[@MhdiSec]

👏

[@TylerDurden-dd1tq]

WOW A VIDEO ON HOW TO GET MY FIRST 350 DUPES. CRAZY.

[@aftabsaifi2436]

[@Cyber_AR15]

Great video 👍🏽

[@newbiejember9854]

Great content 🎉

[@mehrankurd]

Thanks

[@rajiniganth5322]

great

[@Nejtak853]

great