Ethical Hacking in 100 Seconds // And why do we need CORS?

[@marcroberts5251]

It's not much, but will continue to support your page. Your teaching is a breath of fresh air in a very stale curriculum.

[@Evoleo]

At this point these are never 100s, but it's still high-quality videos with no BS, so I'm not complaining

[@dom8429]

i mean there is a break after 100s so you get the best of both worlds: if you prefer 100s videos you can close the video there, or keep watching if you want. and fireship gets to upload 10min+ videos which helps with the youtube algorithm, which is a bonus for the channel.

[@Evoleo]

@@dom8429 nah, even the short ones are 2min +

[@PandaTheGFX]

I don't know if I'm just used to your rhythm of teaching, but this guy's teaching makes me want to open reddit and doomscroll while kinda listening

[@Venom-ne4ox]

2x speed or more solves your problem

[@dashamm98]

I love r/collapse also

[@DanishShakeel]

Next video: Writing good code, or OTP vulnerabilities.

[@nameless_9504]

It's simple A brute force attack or found of apikeys to there sms provider nothing much

[@DanishShakeel]

@@nameless_9504 Bruteforcing a 6 digit OTP, I doubt it is a good idea. Talking about master OTPs, intercepting requests, are better alternatives.

[@DanishShakeel]

@@nameless_9504 I mean, I have been doing it for a while. I like Fireship so much that I want a video on this. A few days back, I was testing a website - you could literally change the phone number on which they sent you the OTP and login with a different phone.

[@nameless_9504]

@@DanishShakeel is it even possible? Never heard about it! Give me a example that may help me understand

[@DanishShakeel]

@@nameless_9504 The website used an API, and they POSTed the number to it in plaintext. I changed the request, and the OTP arrived on the updated number, whereas the webapp logged me in with the actual phone number.

[@MM-vr8rj]

Holy shit you are literally covering every single corner of IT and all those subjects I learned at school as well.

[@erniea5843]

This channel consistently provides awesome and educational content balanced with good entertainment. Keep up the great work

[@dylankendrick27]

You make my favorite videos - the perfect TL;DR + details

[@saswotlamichhane5862]

*My website recently got hacked, but it was so badly coded the hackers ended up giving me the fix to those vulnerabilities, Bad code can help sometimes.*

[@poglord._]

This is one of the best videos on ethical hacking

[@fpspsyduck]

Love this channel!!

[@edisonarango]

Well, CORS might seem to protect websites from requests of evil origins, but it's super weak, it can be bypassed easily by making requests outside of browsers or just by creating a Proxy, besides, the requests always hit the server, so in the end it's not really that helpful, and instead, it always annoys developers on every single project.

[@Norsilca]

What kind of proxy are you talking about? A proxy running on the user's machine next to the browser? That's a lot harder to do than getting some javascript running in someone's browser.

[@edisonarango]

@@Norsilca No, a server proxy, you can easlily get the response from server to server and then return it with the CORS headers.

[@Norsilca]

@@edisonarango Wouldn't your proxy have to be running at the same origin as the first party website?

[@wadexyz]

@@Norsilcai don't think that guy has a clue what he's talking about based on his response. either that, or he's a genius and we're both baffled.

[@jugertmucoimaj9017]

This 11 min video taught me what stckoverflow and other complicated explaining never taught me!!!

[@shootnado]

Omg after 2 years of confusion somebody finally explains sop properly

[@bhbblblblllb]

'And why do we need CORS?' Should be 'What is CORS?'

[@sheepy0125]

this doesn't seem like 100 seconds, but i'm watching all of it anyways

[@idemchenko-js]

@fireship used to publish literally 100 sec videous without going deep into the topic. These days, the first part is 100 sec bird-eye view on the topic and then comes the rest. That's why it is 100 sec of sth.

[@sarcasticdna]

Notification Squad, attendance here, with a 👍.

[@Diamonddrake]

Cors only applies to JSON and is enforced by the Client. It hardly prevents cross site scripting. The requests go through fine, you just can’t read the results.

[@niton6474]

I dont understand what CORS is even usefull for. He only explained what it blocks and not WHY. I dont see the benefit - i am searching for this and the title suggests that he explains it

[@udaykumarmettu]

Lol please i am dying to know

[@wiri2391]

I agree with the others, your voice, pacing and structure are just ..“easily enjoyable“, which is highlighted in contrast to the other guy.

[@DevOpsBoss]

Being featured in Jeff's video is the ultimate accolade a content creator can earn - so jealous of Bartosz 😍

[@DK-ox7ze]

Great content like always. Can you do a video on designing backend apis with a focus on creating the right endpoints (from a front-end engineer's perspective)?

[@yark618]

Your videos are pure gold. Thank you.

[@realgoogleuser]

100 Seconds of XML is much needed

[@Zolodar]

Are you a time traveling developer from 1995?

[@akashdeepnandi]

Off topic, was wondering if you can provide some insight to this question or anyone for that matter. I'm a javascript developer, love doing frontend development with react progressing towards fullstack but I'm a bit confused about what after fullstack? What are some viable career paths to choose, I'm open to branching out to other fields in relevance, I am learner and love to see my limits(Also interested in security but found my niche in web development due to low entry barrier) Feedbacks are much appreciated.

[@soniablanche5672]

You can also load an external image to but you won't be able to modify it

[@IshanKBG]

We needed this You are my inspiration I have decided to open my own programming youtube channel like you but in my own regional language

[@husler7424]

Really mind boggling explanation, thank you very much, i would like to see more videos like this.

[@Michael-Martell]

Honestly If my web security doesn’t have a Slavic accent idk if I could fully trust him/her. This guy really knows his target market.

[@JR-um3kt]

First Edit: Second Gold Is there any reward after 10? Love your videos!

[@sadhlife]

yup

[@sadhlife]

congratulations you won... idk what

[@Fireship]

Gold! 🥇

[@gerolmed]

I still dont quite get what this prevents. If i make a page i wont add in any requests to servers I dont want them to go. An attacker couldn't modify my page or inject any api calls. So why would I want a cors policy to be not widely open in that case

[@anouar-fadili]

Thanks, I have no luck... This video was uploaded after my interview... So yeah 🙃

[@13hdni37]

This channel was made in heaven

[@manishgarhwal7119]

You wouldn't believe it, But this tool is what I was trying to figure out yesterday and today, so that I can check CCAvenue Payment Gateway Integration vulnerability in my app. 🙏🙏🙏

[@AhmadBarghouthi]

You suouldnt be thanking for watching dude We who have to thank you for amazing materials

[@DEVDerr]

You can simply pronounce "Bartosz" as "Bartosh" 😁 Good video as always!

[@DevAcademyCom]

😂

[@PabloGnesutta]

And why is it that static files are allowed (including executables scripts) but calling the API is not?

[@killerdroid99]

because of allowed origins in the server side cors settings, only the whitelisted hosts are allowed to fetch or mutate data that is why you have to declare those hosts in the environment variables

[@sefterm-zade9744]

I wish I had teacher like you. thanks man😍😍😍

[@kevinbasence1147]

As always, quality and informative videos!

[@Minecodes]

I am learning this already and i found one problem on reddit, i found it when i was trying to use a normal user as a bot. I already reported it.

[@ashuzon]

This video is? I mean if you know fetch, js, some online wordlists and how to press F12, you don't need to step out of your browser to do all penetration tests. F12 in browser is OP. Every aspect can be checked via developer tools, the networking, request/response, data manipulation, js manipulation and many more.

[@doontz111]

Your voice is like a soft caramel.. I love listening to you

[@nickvelos9571]

Please make 100 second & beyond videos for social media APIs like Instagram Twitter KZbin Facebook tiktok etc

[@okie9025]

Do JWT authentication next if you haven't already (access tokens, refresh tokens, etc.)

[@weshuiz1325]

Learn to google before you ask

[@okie9025]

@@weshuiz1325 I could learn anything using Google, you're missing the point entirely lol

[@weshuiz1325]

@@okie9025 hey already did jwt if you looked for it

[@crycetruly]

@@weshuiz1325 😂😂😂😂😂😂😂😂😂😂😂😂😂😂

[@samlama6223]

Wondering cross policy is only for frontend. If anyone try to fetch using backend language, then it ignores cross policy.

[@shaynepreston6055]

Can you explain a little why stylesheets and scripts were fine to grab from the external server but the api call was blocked? I understand the premise of CORS but is there a reason that css and scripts were ignored? Is there other things that CORS ignores as well?

[@cloudfox1908]

Edit: This is WRONG: The basic premise is that you can receive/download assets from the external origin, but you cannot send anything to it.

[@shaynepreston6055]

@@cloudfox1908 got it. What about something like an HTTP GET request? While I’m not sending anything to my server is that still a part of the CORS model?

[@cloudfox1908]

@@shaynepreston6055 ah I led you wrong before. When you download/GET a page, you are still making a request to a server for those resources. The reason it may be allowed is because "For security reasons, browsers restrict cross-origin HTTP requests initiated from within scripts." I'm assuming it's ok since it wasn't within a script, but this stuff is quite confusing for me too. Reference: stackoverflow.com/a/42605316/14056792

[@shaynepreston6055]

@@cloudfox1908 ah that makes more sense. Thanks!

[@cubeofcheese5574]

So you can retrieve static files from and external server but not call its api

[@efari]

But then why do the external stylesheets and scripts and images get loaded? They are also cross-origin but yet they are not blocked by the browser???

[@HP_Tubcraft]

dude your channel is priceless.

[@kristiandaugaard7495]

Nice video. Would have been nice if the video included an example where the external api was whitelising origin a

[@letsbuildseries]

When you're ready to lean how to do Smart Contracts? I've been writing a Truffle tutorial on how to use react and MetaMask.

[@JohnDoe-pr6yf]

What is the difference between first GET to 8081 to fetch css and js during page rendering and later GET to 8081 triggered by button?

[@niton6474]

The mime type. script/js, style/css, application/json. Json is forbidden - but it doesn't matter since he only explained what is blocked. not WHY as the title suggests

[@kendedetar]

Great video! What icon set do you use? These colorful icons are beautiful 🤩

[@johnlee4778]

@7:40 he doesn't explain how making this request and getting the static files is possible through the external origin. Is it because the Express 'get()' acts as a middleware? Or is it because somehow 'public' folder is recognized as the same origin(url) due to its folder structure/location..?

[@tjgdddfcn]

Express.js (and all other backend libraries) disables CORS by default on static files

[@dennisbarzanoff9025]

Dear Mr. Jeff Fireship, If you opt for quality in your videos, then ensure more quality control in the collabs because they are sometimes boring and do not match the rest of the video.

[@sylvereleipertz955]

I might be wrong but i though that it was the preflight request that failed in case of CORS policy and not the actual Request/Response.

[@benhalicki9749]

Good video, thanks for sharing. Can you please explain how a hacker could take advantage of a website not implementing CORS correctly? From what I understand this does nothing to protect the API as CORS is enforced by the browser. Thanks

[@tjgdddfcn]

CORS is there to protect the Client, not the Server

[@arjuns2219]

Pls do something on DevOs, MLOps

[@JimmyS2]

Compared to Burp commercial ( free) version, i find ZAP more appealing in features and usability

[@niton6474]

I would rename "And why do we need CORS?" to "What does CORS do?" because the reason of the blocking (what i urge to understand) is not explained at all. The title is a little missleading

[@md.tahmeedhossain9409]

can you please provide a roadmap or guide on how to get started with ethical hacking. thanks a lot.

[@rimzzlabs]

Interesting topic, even tho im still learning ES6 JS

[@dieperfektemakaroni1528]

1:25 It's really hard to hack and takes a lot of years ... you just click "start attack"

[@SudhanshuIGI]

Please do a reverse engineering on Apple’s new iPad Pro webpage. Their web designs are on completely next level.

[@kusumojha5ojha849]

Can you please make a video on webgl?

[@Fireship]

That's on the list

[@sufler7180]

Ayyyy, hi Poland!

[@DevAcademyCom]

👋😻

[@SwapnilSoni]

Yeah I'm a Full DevOps Stack Hacker

[@xxbomelxx874]

Can't I just run a proxy and add the 'Access-Control-Allow-Origin' manually and bypass the browser's security?

[@rhettmelton]

Someone please respond to this. I have the same concern

[@paddyspencer6762]

Am I stupid or have u done an auth vid. Of not pls do. And like not with fire base. Thx. EDIT - thx for all the great vid. Keep em up, I love this channel.

[@maxc9432]

沒想到豆豆會提到馬來西亞（我是馬來西亞人）。看完整個系列我也被燒到了，bucket list世界多一項

[@subrahmanyakm4859]

You are awesome !!

[@m.b786]

4:56 oups: the browser will comunicate with Origin B but when i receive the response if the header allow-origine is not there i will kick out the response

[@thedelanyo]

The line between the role of the hat (hat_role) is just intention. On the other hand, those that are using the the tools are they the hackers?

[@lepepito]

Nice video dude

[@moon911x]

Me after 3 years of hacking journey when first see the title (Ethical Hacking in 100 Seconds) :)

[@br9377]

Gonna put this on 2x speed and learn it in 50 seconds 😎

[@ExplosiveKaboom]

put me in the woosh

[@khadimhusen]

Good video, but title is misleading.

[@krtirtho]

How do you always know what I need😃?! I was wandering around entire internet for way of preventing some security issues in one of my project. CORS is of course one of 'em. Thanks Fireship❤ & of course huge thanks to Bartosz🙏 for explaining the whole process so easily...

[@DevAcademyCom]

I am really happy you like it! 😍

[@GosuHub]

Do php and manipulation of databases

[@aanchaltiwari9205]

Apologies for asking something irrelevant,.. what is the bg music?

[@original_anu]

I'm here for my daily tech knowledge bytes :D

[@mohitdas5292]

Great video 👍

[@ravichandra3383]

Next video: Chrome Extension and Outlook Add-ins

[@winterboltgames]

Nice video! Can you give ReScript a try and let us know your opinion about it?

[@tomihawk01]

4:50 What am I missing here? If Origin B is the potentially malicious server, why is it Origin B that whitelists Origin A? And what is the browser protecting me from by preventing outward communication with Origin B? Or is Origin B the thing that CORS is protecting? I don't get it.

[@Aakrarvaxa]

I can explain partially. The browser is protecting you from another origin’s attack. If you have one tab open in the browser and open the second one with malicious software - JavaScript on this website can do anything that you can do on that 1st page (as a user). So for example it may be able to view sensitive data, read messages, or analyze DOM as you type in your password etc. Same origin policy does not allow these two tabs (origins) to communicate on this level. The browser checks if the JavaScript comes from an HTML page on the same origin or if it comes from an external origin. If that is the case - access is blocked by the browser.

[@Dxpress_]

From the diagram, it looks like Origin A wants to request the images, CSS styles, and scripts from Origin B. In this case, Origin A is the potentially malicious one, since it's the one requesting the data.

[@tomihawk01]

@@Aakrarvaxa It makes a little bit of sense but it also contradicts what the image shows. You say "Same origin policy does not allow these two tabs (origins) to communicate on this level" but tabs aren't origins. The servers are the origins. And how did this become about two tabs communicating?

[@tomihawk01]

@@Dxpress_ I don't see anything in the diagram showing Origins requesting data. Origin A and B are the servers. They don't request anything.

[@Dxpress_]

@@tomihawk01 You're right actually, the diagram is drawn a bit weirdly. And yeah, I don't know what the guy was on about with the two browser tabs either. I think what they meant to imply was that the website displayed in the browser is hosted on Origin A. When the website requests data, the origin sent in the request is not the user's origin, it is still Origin A, since that's where the site is hosted.

[@MIXT4PEmessiah]

Bro I'm also Bartosz and I got the same shirt 😅 Good vid

[@DevAcademyCom]

😂😂😂

[@omanavarghess6847]

I was so fast there are no dislikes!

[@alvaro.makes.music1]

Anyone knows where can I find the gif at 1:25? I'd love to use it in my lectures

[@samuelbartik5265]

Next video: oAuth 2.0 in 100 Seconds and beyond

[@sachinaasuri]

can we get strict mode in 100sec.

[@oussamamaatallah0]

make a video about best practices of a REST api design or the purpose of header and body and so on...

[@AliBerro-c1s]

“Given us permission” as they say

[@alejomakevids]

Finally, I can stop being a script kiddie that install Kali along with a desktop environment.

[@hart1254]

What i never understood is: so how APIs work. Lets say my react app that works on port 3000 needs some resource from an external api, how does this work

[@tjgdddfcn]

APIs configure their response headers to allow for other sites to access them

[@hart1254]

@@tjgdddfcn thank you, so that's the way to go, i thought that was just a hack or some unsecure option

[@josemanuel5205]

video idea: 100 seconds of laravel

[@paweszewczyk3537]

What is the name of this music ?

[@SolomonTheStoryTeller]

please a video on the new Angular State management StateAdapt!!!

[@HijabiCoder]

Loool right in the middle of security class too 😂 so strange

[@kanakbagga3824]

Please do a video on DGraph :)

[@dystopianNinja1289]

Amazing video but i was annoyed by the fact that his video was difficult to watch with all that editing cuts

[@ahmedabdelwadod5823]

Go in 100 seconds please!

[@Noah-vm8id]

Lol, I had this error yesterday but fixed it by doing another approach