How I found the $1,500 SSRF in Stripe bug bounty program

[@BugBountyReportsExplained]

Welcome to the comment section, I hope you enjoyed the video. Go here if you want to join BBRE Premium before the price goes up: bbre.dev/premium

[@francisdonald4298]

Hey bro can learning webdevelopment assist with bugbounty???? Answer please

[@sauer.voussoir]

I disabled my adblock to support your channel, it really helps me a lot to get started on this bug bounty. Your videos are very informative.

[@BugBountyReportsExplained]

Thank you!

[@bertrandfossung1216]

Thanks for sharing this bro. I learnt a lot

[@jpierce2l33t]

Nice dude! I gotta learn Go sometime, some of its syntax is confusing because I've never studied it. A lot of it is similar to C-type languages, but a lot of it isn't 🤣

[@shaarawyshaarawy8628]

Good job bro ❤️❤️🙏

[@aneeltripathy7420]

how can I open a web applications files in vsc ??

[@BugBountyReportsExplained]

You need to have the source code

[@DavenSec]

Wow that was a so nice idea to use the dns dot, congratulations man !

[@j4ck_d4niels]

Thnx for sharing awesome content

[@0xgodson119]

presentation link? 8:50

[@BugBountyReportsExplained]

Good point, the presentation is not yet available on KZbin, I'll link it as soon as it's published.

[@0xgodson119]

@@BugBountyReportsExplained ya, that's why I asked to make sure thats not public

[@chaitubhojane6137]

@@BugBountyReportsExplained I learn from u. Great lessons. You are like my ta's in uni.

[@0xgodson119]

Super Cool!

[@raff000]

Great video but I didn't understand how would you be able to extract any information from this. If you point your webhook request to the internal network how can you get any information to be redirected to you?

[@marvelmaniac_]

Its basically a blind ssrf in that case where you are able to scan internal ports and ips . (Low impact bug)

[@BugBountyReportsExplained]

Stripe gives you webhook logs and you can see http responses there

[@raff000]

@@BugBountyReportsExplained ah ok that makes sense. Thanks

[@kamilonurozkaleli]

is there any other BB reports using this method or did you just invent it? Congarts btw really smart one!

[@BugBountyReportsExplained]

I learnt this from another report a long time ago

[@Lainad27]

why the reupload?

[@BugBountyReportsExplained]

It's not a reupload. If you are signed up to my newsletter, you get access to these videos before the release on KZbin

[@monKeman495]

big brain time: trailing dot in dns

[@crusader_]

Loved it

[@saiya-jin]

If I subscribe now with the monthly subscription and stay subscribed with recurring payments, would it stay on the old price? Or does the old price offer only work for annual subscription?

[@BugBountyReportsExplained]

Yes, with the monthly subscription you also stay at the current price forever.

[@saiya-jin]

@@BugBountyReportsExplained that's great! Thanks

[@sim4n6]

Sweet