This Overlooked Vulnerability Can Cause Massive Damage (Live Demonstration) | Bug Bounty | 2024

[@BibleOSINT]

As I'm a beginner in bug bounty, you have explained this excellent!

[@BePracticalTech]

@@BibleOSINT Really happy that you liked it

[@BibleOSINT]

@BePracticalTech would you recommend me as beginner in bounty to look for those vulnerabities?

[@BePracticalTech]

@@BibleOSINT Definitely!

[@BibleOSINT]

​@@BePracticalTech Thank you! ❤️

[@Offsec-n4n]

what is the impact of creating multiple dashboards and how it effects to organizations and why they will pay $**** digits of bounty for this ??

[@BePracticalTech]

In this example, The local users were only supposed to create 3 dashboards and if they want to create more dashboard they either need to get the premium account or login as admin user. However, we were successfully able to bypass this restriction and able to create more than 3 dashboards so it is an access control issue. Now in real world, If an attacker is able to access premium feature without the need to get the subscription, it will be a financial loss for the organization. Hope you understand!

[@victorgomesgomes]

@@BePracticalTech You can also test under Current user limit: 5/5 to do a bypass with this current application: 6/5

[@Muby_Ajiwa]

I really like the way you teaching. Thanks you so much keep up the good work

[@BePracticalTech]

@@Muby_Ajiwa Thank you for the humble words!

[@sonamohan6194]

awesome! Really well-explained as well!!

[@BePracticalTech]

Thank you kindly!

[@the_sandman00]

Great explanation!

[@BePracticalTech]

Thank you!

[@морс-ф3д]

Brilliant!!!!!!!!!!! Thank you for sharing your great knowledge!!!!!!!

[@BePracticalTech]

Glad you enjoyed it!

[@shivakumarmv4249]

Excellent...Thanks for sharing

[@BePracticalTech]

@@shivakumarmv4249 I am really glad you liked it!

[@Unknown_feed]

Love from Nepal ❤❤

[@BePracticalTech]

@@Unknown_feed Love from 🇮🇳

[@Ch4ndan_das]

thank u so much sir for giving this use full video

[@BePracticalTech]

I am really glad that you found this video helpful!

[@vijay_sawant]

I have been watching you for a long time, and you are really a great teacher

[@BePracticalTech]

Glad to hear that!

[@i_am_your_king]

Thank you for the video I tried to enter the page to try the method, but it gives an error message. Error code 522 Connection timed out

[@BePracticalTech]

@@i_am_your_king Try again please

[@starlox0]

Awesome Video😀Understood clearly

[@BePracticalTech]

Glad it helped

[@swagat5468]

Thanks bhai 🙂❤️

[@BePracticalTech]

You're welcome!

[@a.c.5985]

Is it possible to see a real example?

[@BePracticalTech]

Sure! Here you go: corneacristian.medium.com/top-25-race-condition-bug-bounty-reports-84f9073bf9e5

[@l00pzwastaken]

Kya hal hai nice video :) good research and explanation bhai

[@BePracticalTech]

Thanks a lot :)

[@Knownsense_world_]

Thanks ❤

[@BePracticalTech]

Glad you liked it!

[@HadkerX]

Thanks

[@BePracticalTech]

No worries! Glad you liked it

[@z3r0X0r]

Thanks for give us this type really good challenge

[@BePracticalTech]

My pleasure 😊

[@vulncrax]

Keep it up 🎉

[@BePracticalTech]

Always

[@Yash.Lonewolf]

amazing

[@BePracticalTech]

Glad you liked it!

[@harshthakar2207]

Really sir this was the best video till now on race condition plz share me your linkedin❤

[@BePracticalTech]

I am really glad you liked it! Here's my linkedin: www.linkedin.com/in/faiyaz-ahmad-64457520b/

[@newuser2474]

Bro but what will be mitigation for this issue 😮

[@BePracticalTech]

To fix this issue, we need to focus on handling concurrent request as well instead of handling everything synchronously

[@Baban051]

Please explain in practical webpage

[@BePracticalTech]

This lab here replicates the same vulnerability that i found on a pentest. Unfortunately, it is now very difficult to show vulnerabilities on real production website as it is against KZbin Guidelines.

[@MubashshirShaikh-hs8oy]

make a video on burp suite full potentail

[@한국어의이름이라면강]

i wanna see this app source code

[@BePracticalTech]

Here's the source code: github.com/faiyazahmad07/rcondition_bepractical_lab/

[@한국어의이름이라면강]

@ thx alot

[@MianHizb]

Bro can you kindly just mention Race conditions in the title...thanks

[@mohammadrezafarahani9287]

Please share that code

[@BePracticalTech]

@@mohammadrezafarahani9287 Sure, Here you go: github.com/faiyazahmad07/rcondition_bepractical_lab/

[@mohammadrezafarahani9287]

Bro in this file just have one file so where is the home.ejs and login.ejs ?​@@BePracticalTech

[@mohammadrezafarahani9287]

​@@BePracticalTechdo you share login.ejs and home.ejs ?

[@ekkofed]

Alright

[@iq_rasco]

race condtion

[@SecureByBhavesh]

First