HACKING OAuth 2.0 FOR BEGINNERS!

I'm a pentester and a bug bounty hunter who's learning everyday and sharing useful resources as I move along. Subscribe to my channel because I'll be sharing my knowledge in new videos regularly.
SIGN UP ON Intigriti:
go.intigriti.com/farah
BUY ME A COFFEE:
www.buymeacoffee.com/farahhawa
TIME STAMPS:
00:00:45 - What is OAuth 2.0?
00:01:05 - Uses of OAuth 2.0
00:01:30 - Entities in OAuth 2.0
00:02:09 - Types of Flows of OAuth 2.0
00:02:30 - Authorization Code Grant Flow
00:04:11 - Implicit Grant Flow
00:05:11 - Practical Exploitation
00:05:36 - Reusing Access Tokens
00:07:05 - redirect_uri Not Validated
00:08:52 - CSRF
SOCIAL MEDIA:
Follow me on Twitter: / farah_hawaa
Follow me on Instagram: / farah_hawaa
Connect with me on LinkedIn: / farah-hawa-a012b8162
OAuth 2.0 LAB:
github.com/koenbuyens/Vulnera...
OAuth 2.0 RESOURCES:
www.digitalocean.com/communit...
tools.ietf.org/html/rfc6749
auth0.com/docs/api-auth/which...
alexbilbie.com/guide-to-oauth...
• LevelUp 0x02 - Hacking...
Video editor: www.fiverr.com/pixelstudios1

[@Vinayak123-q8p]

amazing, this could be probably one of the biggest information that i have ever been given..the way how you explain is an amazing..we need such playlist more and more in upcoming days

[@shubhamghosh2228]

Farah you are doing great! Very informative video. You taught so many things in just 10minutes.

[@yosoffmalik9135]

You are good with knowledge and theoretical stuff, your videos gets me into reals basics of topics

[@devvishack641]

Aweeome . Just awesome . For noobs like me who are just starting in bug bounty . This is the place where we can learn basics in depth. Thanks . Please keep posting more such practical videos .

[@albertobarbieri8280]

Your videos are amazing. Simply to understand and very explicative.

[@m.waheedanwar7105]

Beautifully explained hope to get more knowledge from you girl.More power to you

[@muizzraheem5937]

Have been having issues comprehending Oauth, this video is a problem solver thanks farah ❤️

[@FarahHawa]

You’re welcome 😊

[@ahaytman]

Great work Farah !!!

[@soufianeamed217]

Yaw Farah This Is Just Awesome, Brief And Useful That's Why I Love What You Are Doing, Keep It Up And Stay Safe .

[@sohamprince1]

Awesome.. loved the way you teach the concepts and the labs!! Keep it up!

[@medioclick]

once again simple and good explanation.

[@mylyf6684]

I learned something today.💯 Thanks.

[@raselmir1285]

Great job. Thanks man. Now I am clear.

[@solodancer617]

Very good video, presentation is understanding quiet easily.

[@killcode6717]

Thanks for the tutorials

[@rayancrasta7460]

Shez doing a great job on youtube cuz to get sponsors within just

[@cheffysunnythakkkar7614]

thank you so much dear for such a wonderful explanation

[@swapnilpotbhare888]

Excellent, and very good command over Knowledge

[@ishikasharma1103]

Really a good video!

[@pussycat0x676]

Awesome work :D

[@balapraneeth9708]

Spot on!!. Simply amazing. Thanks for sharing :)

[@pakflutterdeveloper]

Excellent work :)

[@RakeshWaghela]

awesome video, keep it up. you earned a sub !

[@FarahHawa]

Thanks for the sub!

[@abhinavkishoregv273]

nice explanation. Thank you

[@vishalkothari8065]

So if i want to get details of a user on client side of the application using an ajax call and display those same details to the user then it is an authorisation code grant example right?

[@NinjaTech1337]

Great Teaching Style. Loved Your Contents.🤗

[@vasuyadav9171]

Hi Farah can you please tell the impact of the csrf one and reuse of token and also there severity category? Btw nice video

[@hannanjamil1060]

Great work Farah!

[@balveersinghbhatia]

Nice work thanks for this video

[@AmanGupta-ho4rh]

I am getting warning as: Warning: missing space before text for line 14 of jade file "/usr/src/app/views/login.jade" And not able to authorize the request. can someone help me with it please :) ?

[@abhisheksanmare6835]

hello mam. I have encountered that while signing again, the website is sending an OTP to my previous device, not on my number in the new device. I once had an account on that website that was deleted due to inactivity. is it a flaw to be explored?

[@ahjee718]

Thank you for this video! Is it possible for you to do a tutorial on how to create a live web server similar to the one you showed in this video that captures vulnerabilities like the OAuth access token?

[@SageTheProfessor]

Thank you Farah. Very useful explanation and amazing demos. Keep up the great work.

[@phitran5164]

Nice video, thanks you so much

[@MohitSharma-xf9wp]

Very much appreciated

[@chinna_]

Awesome ...!!

[@ravichhetri8918]

Hi Farah, Do you take session on the bypass techniques for Saml, Oauth ,oidc..I am very much interested.

[@the_linux_guy1515]

People were getting jealous of Bugcrowd sponsoring ...now Intigriti has sponsored ...and soon Hackerone will ...to hell with them 😂😂...keep up the good work 👍🔥

[@graycybermonk3068]

No one jealous. all are belong in hacker world.

[@renganathanofficial]

@@graycybermonk3068 HAHA STOP KIDDING BUDDY

[@Clo326]

Sooper videos

[@vijaykannanhere]

Much Appreicated . :)

[@fypage.]

Wow 10k congrats your channel has grown so fast earlier this year I had like 1 or 2k subs

[@Sniperrkr]

Thank you!

[@chinmay128]

can you make a video on your journey of how you became a hacker i want to learn to do all of this stuff but really don't know where to start with .please make a video on it. and if you can refer to any video on youtube .i mean for learning.

[@SumitSingh-xu4qs]

great explain sister

[@vaibhav114]

How old are you? Don't think you are out of school yet. But, amazing grasp of the subject. Kudos!!

[@wiz2398]

Bhai yeh kittiiiee Awesome hai.. 😍😘

[@theintrovert894]

😘❤️❤️🔥🔥

[@adityasadhukhan8438]

Can you help me with resources to study about advanced SQL

[@adminhackstar3333]

Make an video on best course for beginners in ethical hacking

[@jayeshprajapati1396]

Can you make a video on your cyber security journey ?? ............................................................... Video is good👍👍

[@susovangarai6731]

Good for beginner like me 👍 .... Please make an advanced level video also

[@boneytech3965]

Can you Please upload more about oAuth Vulnerability In websites with more detail.

[@omerfarooqdemir9907]

which ubuntu distribution are you using

[@cyber__hawk5555]

Which lab are you using ?

[@mukoshmanob9240]

Plzz make a videp about recon

[@gyansoni2667]

Such a nice explanation 👍

[@himanshushekharpandey1519]

awesome explanation as always :)

[@winklerrr]

Where did you find your information? :)

[@prasantabanerjee1184]

excellent 🤗

[@graycybermonk3068]

Hi, I am your big follower. I have started new in this bounty. Can you tell what about Automated Scans? Every where I got out of scope this Automated Scans. Please I need some help.

[@FarahHawa]

Basically, programs mark automated scans as out-of-scope findings because they create too much noise on the server and result in the discovery of bugs that are known or false positives. It's best to not rely on automated scans for bug bounties.

[@graycybermonk3068]

@@FarahHawa thank for very good reply. Takr my respect. You are like my sister. Really I am appreciate to you and your channel. I started bug bounty. But I am not getting any path how to start. What kind of toolsa I will use? Can you help me little bit. Really I am stuck. Thanks for your reply and respect.

[@gulhameed1270]

what if we replace the state parameter value with other account state value,and the account logged in ?. is it still consider as OAuth missconfiguration?

[@FarahHawa]

Yes!

[@gulhameed1270]

@@FarahHawa Thank you!

[@aadarshverma6913]

Make more videos please I love them and I want to be just like you

[@nayeem9358]

Awesome

[@prashantkumar2963]

what is your ug course?

[@kalyanidudhekar3655]

Farah this helps me a lot but can u plzz make a vedio on subdomain takeover

[@cimihan4816]

kzbin.info/www/bejne/bGjGmYmhppiaZq8

[@joharraza5231]

Excellent work. Very informative. But please don't use music. 👍

[@sudiptapandit4880]

Isn't OAuth is for authorization part only? the 'Sign in with' buttons use OpenID Connect protocol not OAuth. Although nowadays people use these terms interchangeably .

[@FarahHawa]

OpenID Connect is a layer that's built on top of OAuth... you can check this here developer.okta.com/blog/2019/10/21/illustrated-guide-to-oauth-and-oidc

[@sudiptapandit4880]

@@FarahHawa Thanks for clarifying

[@faique2995]

awesome

[@cyber_tech_404]

Love u bro

[@amarshaikh2147]

Thanks it's good info for developers as well to improve there application security 🔒🔒🔒 thanks ❤❤❤❤ again.

[@pankajholariya8331]

thx

[@merchant1998]

Hello, I need your help please

[@Manik-Atri-Short]

Please make hindi vedio

[@mr.heretic8192]

Hey appreciate your skill & teaching skills..... I've cleared my 12th, please advise me what should i do to get cyper security

[@vikasmeshram2515]

Apne hacking kaha se sikha ??

[@sn0xsecurity696]

are GAJAB lots of love dear stay safe but kabhi video thoda hindi meh bhi bana dena toh aapke susbcribers bhi jada jldi grow karenge hope u got it my point and thanks for this video. by @MR CYBERTRON YT

[@cyberUF]

Hey I learn lot from You ! Can you create how we exploit dom based xss or any dom based issue

[@Bosssssss77777]

Please Make Playlist On Bwapp,Dvwa

[@rishad6324]

wow. you are just amazing.

[@hassan12141]

Great job+great content I really appreciate her work❤

[@FarahHawa]

her* Thank you!

[@hassan12141]

@@FarahHawa noted👍

[@bharathpatel1757]

Hi dhidhi . I'm completely a zero level beginner intrested in learning about ethical hacking and I was on search of finding people who could suggest me possible ways of learning things from beginning and I found your profile in linkedin . Please could you suggest me some youtube tutorial for learning hacking from very basic level .

[@FarahHawa]

kzbin.info/door/PiN9NPjIer8Do9gUFxKv7A , kzbin.info/door/QN2DsjnYH60SFBIA6IkNwg and kzbin.info/door/CZDt7MuC3Hzs6IH4xODLBw are all great

[@bharathpatel1757]

@@FarahHawa thank you ! So much

[@dsdgaming2242]

Wow. Such a beauty and skills is just

[@ganeshnishitha4425]

nice sister

[@vikasmeshram2515]

I also want to study but didn't found something better.

[@whyrohit4197]

Just wanted to know the specs of your laptop..?? And if you're comfortable,i want to know that..... How you make thumbnails😰😰😰😰😰its looks damn! Cool! :'??

[@FarahHawa]

8gb ram, i5 processor. I do have another laptop with better specs but this one does it for me on most days. Thanks, I use Canva to make thumbnails :)

[@jakianam9554]

You should add subtitles

[@RelaxMusic2zero23]

the best source(it may piad too) learn hacking and related, and where you learn all these things

[@shubhamsoni8093]

Great work Farah! So you're from Commerce background how did you come to hacking?

[@hikefka8001]

👏👏👩‍💻🧙‍♀

[@anabakhtar3774]

Really informativel video Farah 💯

[@FarahHawa]

So glad it helped!!

[@ansanbinoy5949]

😍😘

[@sachinmaurya3259]

Love to watch your videos and also learn a lot from your video:)

[@FarahHawa]

That's great! Thank you for watching!

[@rutwikhiwalkar9583]

Not a fan of the background music Farah. Great video tbh!

[@playforpassion7111]

Can someone explain the impact of reusing access tokens?

[@unknown_3293]

☕☕☕☕

[@l1f07bscs0035]

an awesome detailed written guide here decatechlabs.com/oauth2-explained-and-how-oauth2-works-oauth-in-action

[@JasonGomes140294]

Well Explained!!! Why do you use ubuntu instead of kali linux??

[@FarahHawa]

thank you! I use both, but the lab required Docker and that's set up on my Ubuntu box.

[@JasonGomes140294]

@@FarahHawa ohk nice. Waiting for the next series of vdos. keep 'em coming

[@itszabbs1740]

Nice video . You have helped me a lot .

[@gowthamvyasmalkari4511]

Awesome 😊😊.Nice video. I too wanna to become bug bounty hunter. Which topics should I start to read in web application hackers handbook? and which topics just to leave? Please answer.

[@gowthamvyasmalkari4511]

Please make a videos on this.Thank u

[@FarahHawa]

Everything up till chapter 13 is mostly relevant

[@gowthamvyasmalkari4511]

@@FarahHawa how much time do u think for a beginner to a bug hunter by the resources u mentioned in the first videos. How many years took it for u ?

[@FarahHawa]

@@gowthamvyasmalkari4511 you can do it in a few months tbh. I was doing a little bit of coding, reading handbook, labs and blogs everyday. Give 1-2 hours to each resource and you can be done in 2-3 months if you're a fast learner.

[@AkashHamal0x01]

@@FarahHawa hi farah u havent hunted a single bug .U will face massive trolling

[@jvr8360]

nesj

[@amolgangurde5714]

Nice explanation, keep sharing 👌