Exploiting a Server Side Request Forgery (SSRF) in WeasyPrint to hack Lyft & HackerOne’s $50M CTF

[@STOKfredrik]

LOOVE IT!!

[@NahamSec]

[@hardwork3196]

I saw ur repository (bug bounty for beginners), thank you :)

[@DragonStoneCreations]

Awesome! Similar to yours I did RCE through jasper a Report parsing library

[@ujwalkumar1040]

Nahamsec is genius. Your videos are absolutely amazing. 🌟Great work, to educate the community.

[@J0R1AN]

Quick tip: to type the correct quote on iOS, just hold the “ button and select the straight quotes. For me they are directly above the original quote

[@NahamSec]

yep. That's how I did it but wasn't really paying attention because of the excitement that came with finding the bug! haha

[@theedmbrewery6234]

One of the exercises on pentester lab is about your weazy print find.

[@cyberdruid9100]

This is just genius! And to think you found this 6 months ago and didn't even realise it, very cool

[@fedes9626]

Hi mahamsec! I want you to help out with reports, for example I found that a website would let me provide an URL that gives a 413 error, and discloses what kind of backed they are using, it is just low severity but the way they are handling the URL letting me add 0 in front of ids is not something secure, also when providing a long input on forms I can get a 500 error but I have not been able to exploit, maybe because I am lacking the knowledge, the 413 error exposes they are using a library that was exploitable in the past. I have seen that if I report this non bugs, it depends on how you put it to be able to earn some low bounty. What do you think can you help figuring out if this is something that still needs work or can be reported?

[@AnshumanPattnaik]

Great tip thanks and 0:29 nice intro :)

[@theenlightenpath5194]

Hey @nahamsec, you should aslo try BXSS if its vulnerable to HTML. I did on a bounty program and had similar functionality so I tried Xss Hunter and the payload fired on the back end also giving interal path disclosure

[@or5248]

This was really good, thanks for posting

[@offlife77]

Hi sir, which profile is better as a fresher...VAPT or SOC

[@KishoreKumar-bo3iv]

Do you like breaking or building?

[@offlife77]

@@KishoreKumar-bo3iv breaking

[@audiogenius8570]

Then SOC

[@armansurti2745]

Thanks Ben !

[@jinupatel0_0eth09]

Bro really thanks for this type of contents... Real inspiration!! Lot of love from india n from personally. Keep helping us. Thanks & Regards, 0_0eth0

[@NahamSec]

Thanks for watching!

[@wadagehome7414]

You don't read files in the network ☺️

[@CookieHF]

Great video

[@gamerited]

lets do more of your bug finding explained stuffs XD

[@marcschweiz]

awesome content!

[@0m1d]

دوست داریم داداش:)

[@xxhanukexx]

hello friend thankyou

[@wadagehome7414]

Naham is best

[@termux-api]

who else found vulnerability by mistake I (from future) 🙋

[@masonhck3578]

Badass shit right here!!

[@meh.7539]

I need that shirt...

[@deepbhalerao7661]

cool find by cool guys

[@cipherundoer]

i liked it

[@Kattue]

*cough* lyft *cough*

[@alihassam8748]

Lyft

[@hehe1205]

خسته نباشی

[@sowhatsupeirik]

Lyft