WEB CACHE DECEPTION FOR BEGINNERS!

[@sivakumar-id3he]

Your way of explaining things with an example using labs is amazing........

[@ZaidKhan-nk7xr]

This video proves that a single video is enough to understand the concept. Great Work.😀

[@MokshitKalRa]

Di, I thought Web Cache poisning is So hard to understand because It is a P1 Vulnerability and P1 are difficult to learn but You Made My Day Today, Thanksssssss a Lot Farah Di! ❤️

[@rohitsoni9325]

Awesome! Just to add a bit more to it: Whether a page should be cached or not, also depends on a response header Vary. Do check that out to know exactly what is being used to cache the pages of the website. (Cookies, Accept-Encoding, Extensions etc.).

[@FarahHawa]

This doesn’t really matter for this attack but thank you for the info! :)

[@FarahHawa]

They don't matter for this particular attack. They are important for other cache-related attacks though.

[@mehrabhasan5773]

Your method of teaching is really helpful for beginners like me

[@sanghadiyasunil3489]

Its amazing teaching stayle. Thank you Ma'am.

[@VikasSingh-eu4gb]

Your explanation is so good please continued for other topics

[@darshanjogi5781]

Love your videos . Please make practical video on idor bug .

[@samsingh7025]

Content getting better and better 👍👍👌👌

[@donhasan4690]

Just wow learned many things from your video

[@RogueSMG]

All the basic relevant info and technical explanations in

[@prazolbista]

Mo Farah and Farah are my favorite 🥳

[@ashrafulalim1272]

you've included some good resources in the description. It's amazing :)

[@mayureshatole]

Well Explanied! Thank you

[@basantkumar-im9gq]

The procedure Of Decode is very interesting

[@15494063y]

wonderful farah

[@arjayhferrer7836]

hey farah your video is really helpful even though i've already been 3 years in bug bounty community, i still find your videos very helpful especially the most basics one i tend to forget it , do you plan creating your udemy tutorials soon?

[@xnl-h4ck3r]

Really well explained and very helpful. Thanks!

[@theprateekmahajan]

Demos were awesome...

[@shekharpopatmahadik8106]

Hello Madam we all like your way of teaching. We are requesting please make a video on the bugcrowed bug bounty where we get how to choose program , initial steps to any bug bounty and how to perform and which tools are used and os is useful for bug bounty and most important report writing for anyone of program in bugcrowed. Waiting for your reply. Thank you.

[@pixelstudios6763]

Great Content Farah ! Keep it up !

[@sandeepjadam4220]

Great explanation👍

[@gopalsinghr.]

Super useful information thanks for sharing

[@kiwinesss]

Excellent. You have yourself another subscriber :)

[@mscor4ever139]

amazing work , keep it up !

[@benjaminmunoz9136]

Thanks!

[@gf384]

Good Thanks!

[@cheffysunnythakkkar7614]

You are a rockstar

[@hordeumvulgare7195]

Good work!well explained.

[@XDms85]

Great video thank you, and the lab is very nice :D

[@FarahHawa]

Thank you! It took 2 days to figure out all the configurations 😅

[@Nothing-lh9hp]

thanks farah so much for amazing content

[@FarahHawa]

Thank you for watching ☺️

[@zeuscybersec659]

Great content as always✌🏻

[@FarahHawa]

Thank you! :)

[@amithc9429]

Thank you Farah

[@sureshkumar7753]

Nice Explanation farah.

[@FarahHawa]

Thank you!

[@AkshayKumar-nm4ci]

Nice video, Farah

[@sail6114]

Thanks for the video good work 😎🔥👍

[@amolgangurde5714]

Excellent 👌 videos

[@TheDiscourseDen-rr]

Very well explained

[@vahabbalouchzahi707]

goood farah

[@saugat55]

awesome explanation. thanks!

[@Rajsharma-6969]

Farah mam, awesome content 🔥 thanks for this

[@FarahHawa]

Thank you for watching! Glad you liked it☺️

[@abhishekrajak5481]

@Farah Hawa. can you make a video on Reflected file download

[@chandan1980-s8z]

Please make a video on aws Pentesting. It's my earnest request to you🙏🙏🙏

[@dronpatel6552]

Great explanation keep it up 😇

[@FarahHawa]

Thank you!

[@koushikkarank8875]

Nice vedio 👏

[@fonshu3806]

Thank you so much mam.

[@faique2995]

Learned something new ;)

[@pankajholariya8331]

dhyanwaad...😊

[@shahidhannure237]

Awesome

[@pentest3155]

Thanks farahh great content ! I tried to setup a lab. I used your default.vcl conf but my profile.php/test.css is not cached :(

[@davidg9469]

Hi! I'd like your opinion on the platform INE Training, I don't know if it's worth it. Have you used it? Have you known anybody who has? They're quite expensive. Cheers mate!

[@tejkhandor8568]

Hey farah, If I want to learn from the very start do you teach online ?

[@FarahHawa]

No, I don’t

[@HunterLeoGaming]

I am your new subscriber

[@pawanchandna3038]

Really good 👍 👍👍

[@suryateja9800]

Informative...

[@FarahHawa]

Glad you found it helpful!

[@123455866201Aaron]

It doesn't work for me when I replicate the lab, I inserted the config code given, it did cache when I change pass to hash for php file but when I try to insert the extension of css or other extensions, it just gave me 404 error, any idea where i went wrong? Everything seemed to work except trying to get it to cache the extension

[@Earnnewskills]

love you

[@MohitKumar-dh7eg]

Nice video

[@HunterLeoGaming]

Wow

[@SiddharthChandrasekaran]

Condition 1: return profile.php when profile.php/nonexistent.css is requested -- this looks like a software/framework specific vulnerability. Is this really a valid, unpatched attack vector today (I'll be surprised)?

[@FarahHawa]

The condition itself isn’t something exploitable. It’s the cache config + this quirk which makes it dangerous. So it’s not an “attack vector” that needs to be fixed. You can install the latest version of php and try it yourself by hosting your own web app.

[@AVARI-ti]

Eu estar apaixonado ❤️❤️❤️

[@fridayknight1387]

Hey, can I ask what is the window you opened @5:07

[@FarahHawa]

I’m not sure what you’re referring to but the repeater tab of Burp Suite is open at that second.

[@fridayknight1387]

@@FarahHawa yeah. Thank you. I just wanted to know that. Thanks!!

[@Akash_us]

Hi Farah !! Which is the best bug for very beginers to search on live websites for bounties I hope you help for noobies "_"

[@vivsvaansharma4882]

Hey, I had a doubt. Even if this info is getting stored in the browser, it is still the user's browser. How can hackers access the browser cache of the user on another laptop/pc.

[@FarahHawa]

This is the varnish cache we’re talking about, not the user’s browser cache :) Check the h1 reports in the description, you’ll understand the impact!

[@shrirangkahale]

💯

[@Test-ed8cm]

Its been a month. Are u still gonna upload in the future?

[@FarahHawa]

Yes, working on the next one right now. Thanks for being patient 🥺🥺 really appreciate it

[@jonathanhoyos8191]

@@FarahHawa Take your time to make a great Content!! Faraah

[@Joyucomedy]

Make more video in week

[@cyberpirate007]

Sweeeet

[@mikem4052]

Thank you Farah for your videos. Watching this video made me $750 (P2) from a public bug bounty program. Do you accept donations?

[@FarahHawa]

So happy to hear this... congratulations!! 🥳 Which program was it? And no, I don’t have anything set up for donations right now but I really appreciate the thought :)

[@anshxoxi8824]

Hi

[@devoidgaming2870]

MA'AM I wanted some tips on starting a career.. So i contacted you in Instagram and Twitter. plzz ma'am reply me

[@hakikihacioglu]

Why is the link to a non-existing.css file returns the html content? Does it ever happen? What is the root cause?

[@FarahHawa]

It’s a quirk that exists in PHP among other languages. You can try it yourself by setting up a basic website in PHP!

[@snehajain2390]

Yo

[@FarahHawa]

yoo

[@komradz5577]

ok again, great content but if you keep putting this Peppa pig music i will not watch ur videos. please dont put music in your videos!

[@FarahHawa]

Peppa pig 😂🤣🤣🤣

[@FarahHawa]

Ok I’ll try

[@FarahHawa]

Pls don’t stop watching 🙏🏻😄

[@komradz5577]

@@FarahHawa i have kids and all day i hear music like this on tv hehe no offense but i really cant hear you when you speak and im very interested to see what i missed and what i dont know. Thanks again!

[@cyberguy1111]

Can i try this on hackerone and other platforms ???