JavaScript Security Vulnerabilities Tutorial - With Code Examples

[@takanome-dev]

Turns out that I did not figure out any of these vulnerabilities which means that I have been shipping vulnerable code all this time 😬Thanks for the awesome tuts. Time to debug prod 😅

[@nishantdalvi9470]

Keep Shipping vulnerable code, This keeps penetration testers like us in job : >

[@random_guy1024]

Finally!!!!!!! Just the tutorial I was looking for learning code review. As a security researcher and CTF player, this is a very Vital skill one should master. Or at least try to learn basic Thanks a lot ❤️

[@davidtosin6995]

i can teach you a better way around this. simply but complex but simple and fast to grasp.

[@random_guy1024]

@@davidtosin6995 how do I contact you? And if you don't mind, will you do it for free? Cause I'm broke.

[@developerGRohit]

I really enjoyed your coding style, the clarity in presenting scenarios, and your explanations. I look forward to watching more of your videos. Additionally, I believe it's crucial to stay informed about security topics, especially given their significance in today's landscape.

[@AbAb-q3p]

Does this guy have a course online? What a teacher

[@ВиталийОвчаренко-и1н]

Some common security vulnerabilities in JavaScript include Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). These vulnerabilities can be addressed by following correct development techniques, implementing the same origin policy, and using tools like JavaScript security testing tools and GuardRails for automated security testing. It is important for developers to remain proactive and defensive in securing their JavaScript applications to prevent malicious attacks and keep the web safe.

[@ceciljoel9577]

Giving examples is a good idea you should give more of them in your courses

[@jayseb]

Thanks for including proper error management in the second example. I so often see during my tests apps sending global 200's or 500's - not really taking the time to correctly management them -> thus poor having logging information. Many teams should watch this video. Cheers.

[@germantoenglish898]

Thank you, this was a great refresher. 😃👍

[@johnsansevere9787]

Please change the color of your comment. I can't read it on a black screen, but otherwise you have a fantastic video.

[@मुरलीधरसिंह]

understood nothing but loved it! Watched almost 9 minutes of this tut, will come back later after learning the basics of js. Still trying to make a tic-tac-toe game> Wish me luck!

[@saltymiche]

Very nice + quick intro to secure code review!

[@dreamofyesterday]

Awesome video as always. Would love to see more videos about cyber security/ethical hacking/pentesting!!

[@kooldandy]

Good one. Would like to see more on this.

[@patrickchan2503]

wow, amazing quick fire tips, thanks

[@keilerguardo2164]

That was an incredible tutorial, thank you very much for share with us.

[@johny962]

That is so helpful. Thank you!

[@gk_eth]

Looking forward for more videos like this.. it's lit💥

[@alexbird1507]

Great idea, would be really cool to increase font size and install more contrast theme just for the video, because I can't see comments from my phone and barely can read other code. But nevertheless, thanks!

[@TopsecretArtpc]

The last could be IDOR i mean we can use anothers user ID or others user email, btw learning about JS security

[@stea27]

Really nice tutorial with how simple modifications make difference in code. But next time please use a different color for code comments. Grey on grey background makes it really hard to read.

[@TheJohndward01]

Thank you so much, this is incredible!

[@chenmoasis]

Thank you for this amazing video! Very informative.

[@rubenverster250]

Super nice interview questions :)

[@Khal_Rheg0]

Great video, thanks!

[@ismailmadeit]

Thank you Brandon ❤

[@79Nardo]

Nice explanation! thanks :)

[@soumadip_banerjee]

Short n sweet! ❤

[@paras.developer]

great video about security information

[@WebWonders1]

Awsome keep the serious long please

[@Teardrop-u4z]

thanks man! you are good

[@jdmayfield88]

Nice. Thank you for that. Can you do a vid on incorporating 2FA/MFA? Preferably something you can do for free with only something you control. I.E. no dependancy on servers you don't control.

[@ДиванныйМонстр-ъ8с]

Amazing course. Thank you sooooooo much for publishing it. Very usefull.

[@i_am_dumb1070]

Please make a similar video for solidity . I would say it would help if fcc can upload the famous Secureum Bootcamp for Smart Contract Security Auditing...... it would be very beneficial 🙏

[@dipayancodes]

Branden teaching Brendan's language 🎉

[@OnurKAFALI]

You re all stars

[@FeFeronkaMetallica]

Damn this was a cool video. The === surprised me

[@ASDevelopersTutorials]

Thanks for this !! Very informative

[@anisdragan]

About the Mass Assignment Attack, it seems like you've only made it more challenging for the attacker without completely preventing the attack. This is because req.body.username can still contain any value. I believe it's necessary to validate the data you receive in addition to the measures you've taken to enhance security.

[@jnath]

Of course validation is implied. The point is to prevent user from assigning data to a parameter that they're not supposed to.

[@sosolowkey9318]

Can you guys do a RPA Development Tutorial?

[@toyin5522]

Timing attacks make sense

[@SASA_maxillo]

for the first one, an attacker can enter a https link which links to his unsafe website and then execute code, isn't that unsafe too?

[@OS-wp5ew]

Yes , Open redirect vulnerability

[@Mari_Selalu_Berbuat_Kebaikan]

Let's always do alot of good ❤️

[@FeFeronkaMetallica]

Can we get more of these? Does Brandon has a channell?

[@LoneWolfCodingProfessional]

what about server side validation? since client side is exposed to end user

[@iamashwincherian]

Yes, server side validation should be there no matter what. But there will still be vulnerabilities like SQL injections if not handled properly

[@s.p.sanjay4253]

Please launch a internet of things course

[@nullcarry6893]

Vue doesn’t have this issue because it prescribes a router for you to use that has param / query sanitization built in.

[@captainalpha4853]

In 14:35, in this case won't we get an error before even entering the find method? because the request's body is in JSON format but the username is an object that can't be inserted into the request's body.

[@mynameisrezza]

Gold Bro!

[@krispern]

19:07 Number 8 is missing the intro/explanation part

[@ahmed.systems]

This guy is literally Ryan from The Office

[@richardprakash4630]

RYAN STARTED THE FIRE 🔥🔥😂

[@ahmed.systems]

@@richardprakash4630 Fire Guy *insert kevin giggle*

[@brandon_wallace]

Very nice.

[@NewPath-w9h]

Are these videos allowed to download?

[@kephas-media]

I heard search Param, saw redirect and started laughing 😂😂😂

[@adeni4359]

Does he have a KZbin channel?

[@As74ful]

what the heck is that hand in the thumbnail of this video

[@aboutaline3423]

Great tutorial, but most of vulnerabilities you've talked about are not really vulnerabilities, this video should be renamed to some bug you may have in your project

[@Hardwork012]

Please upload android development full course using kotlin

[@hack_crack]

Excelente

[@sitter2207]

I don't get the first vulnerability. Since when is just clicking links dangerous ? What can a malicious js code running in browser do at worst ?

[@treebucket5382]

Lookup same-origin policy, it can allow the javascript to be run as if you were on the host website, potentially leaking tokens, cookies etc.

[@trysetyo]

great euy

[@pythonxsecurity8287]

it's easy af

[@ReligionAndMaterialismDebunked]

As Fries 🍟🤤😋? Just Kittens 😻. XD

[@AveN7ers]

Bioshock Infinite ❤

[@ayushdhokriya6488]

i found 1'

[@Natures_Doctor]

👍👍

[@pablomatos1707]

Brasil em peso😂

[@the.abdullah.nouman]

2 hours

[@rohulahadi3990]

🔥🤩

[@samgarg5228]

"Do not trust the client"

[@mrcoded7454]

First comment yay

[@massobu]

waw :000

[@ashwinkhasa]

First 🥇

[@sadaharu_tr]

I mean..... Angular exists for a reason..