쉐도잉 연습: How I Made $30,000 Hacking Broken Access Control - 영상으로 영어 말하기 배우기

I've made over $30 ,000 from a single bug class broken access control on a single bug bounty program

and I know what you're thinking cool you found a bunch

of idols no the money didn't come from spaying low severe reports hoping

that one of them sticks it came from understanding the application better than the people who built it

and understanding how actually authentication works what does the app treat as sensitive action

and which features were built for roles I never was supposed to touch, then chaining them until a low turned into a critical.

In this video, I'm going to show you exactly how live with Real Labs, five bugs that I found and chained them into a full account takeover.

Stick around because the last one is the one that you will actually remember.

And real quick, if you're not familiar with broken access control bugs, it's very simple.

The app builds a wall around who's allowed to do what.

You are a normal user, so you shouldn't be able to read other people's data or hit an app in future or act as another account.

Broken access control is anytime that wall has a gap and that is it.

The whole game is finding those gaps and stacking them until we get a vulnerability that is worth reporting.

Now, I have actually built a lab so you can try it for yourself

and it is completely free over on Hacking Hub.

So everything I'm about to show you, you can practice the second this video ends.

If you want to go deeper, I've got a full broken access control course that breaks down this whole methodology, start to finish, and that link will be pinned in the comments.

All right, let me show you the app that we're hacking on today.

So this is the application that we have.

I know it looks super realistic.

Very proud of this lab that I put together.

You can log in quickly with the test account that you have right here, and you can just log in and it will take us to our application.

You can see we have a ton of different activities that we can do.

We can look at our recent activities, for example.

There are some data here there is records there is patients

there's teams you can see who is on your team

and you have staff

which surprisingly it says access denied we do not have access to do this

because our role as front desk does not have the permission to view this page

and we have users which is probably our different physicians site admins front desk

and so on so we have all of these

and each of these become a place where we want to attack

and find vulnerabilities obviously we have things like our profile and

so on and want to make sure we take a look at it

so this first vulnerability is your basic IDOR

and let me show you really quickly so we're going to go into records

and we're going to do our first encounter

and you can see this is like very basic numerical vulnerability

we can give it an ID for example 43 right here

and it shows us the data for another user

and every time we increment or decrease

that number it shows somebody else's data right this is what everyone thinks of

when it comes down to broken access control and a lot of times

if you're finding vulnerabilities like this one is either a dupe

or usually not a critical unless there is some PIIs or something that is screaming hey this should not be public.

This is where most people stop and just report these

and rack them up for low bounties

but don't worry we're going to come back to all these findings

that we're going to look at this video

and show you how we chain it but this is our first one super easy super simple you should already know this.

Now let's look at the next part of this this is the patient

if we click here and we do a search we can see

that it is sending a search query with whatever we put in here

so if I put in the word test for example

and somebody has the word test in it it will come

up my favorite thing to do here is just doing a single letter

so like a so everyone

that has the letter a in their name it will show up it's most common

and it works

but here's what a lot of people don't think about you will see things like clinic id

and most people are here to quickly maybe make it into a two you can see

that it's showing all of them and sometimes it may not actually work

but my favorite thing here is to do either a zero to see

if it does anything or just entirely removing that and by doing

so you can see that it shows everybody or every other clinics users

and all their different data births and email address and things like that

and it's one of the most common ways of finding vulnerabilities

where this is an eye door where I could see the data for a specific clinic

that is not mine which is seeing everybody's data think of this as

if you're doing an API call

and it's doing something like API v1 slash user slash ID you take

that id and either put that leading slash or do without it

and it leaks every user on that website sometimes you would do some bypasses there

so if there's an nginx rule for example

that just kind of stops it from happening you can do a percent 2f

and things like that that actually bypass it i have a whole video on

that i'll link it down below go watch on the channel

but that's just one of the other ones to look for

and this was another one that i looked at

because it just gave me every user's data on there

that i could actually enumerate and use as a part of my chain and later down the road.

So these are a little bit too simple, but I promise it's going to come full circle, but I want to kind of show it off before we put the whole chain together.

But let's go to the next one.

And that is our teams, which is also super interesting.

And let me show you why.

If I quickly click on team right here, this is supposed to allow me to see my own team's data, right?

So if I click on here and go to profile number one, if i go to profile number two number three

and this is number seven actually

so i can maybe do something like normal number three

that doesn't work in my case it allowed me on

that actual bug bounty program to enumerate everybody's data

but the interesting thing isn't the idol

that happens here is looking at what is being shown to

me on this screen again there was no api calls everything

that i was seeing was this it was a really ancient application

that was supposed to be internal but the cool thing was

and i would have probably missed it

and luckily with ai you You'll probably never miss this

if you're having AI actually look at all your data and your request.

100

But if you would have right -clicked on this link and you would have scrolled down to the bottom, you will see the data that is being shown to you that is visible on this screen and then some.

101

So you can see right here, I have the name right here with a password.

102

The password is PWFOX.

103

There is an email here.

104

There's a password hash.

105

The cool thing was on the password hash, it was this auth token and the MFA secret it because

106

if I have these two and

107

if you can find a way to use this auth token

108

and bypass the MFA then I can easily just take over an account

109

and become an admin and that's exactly what I did and

110

that is why this is so important for us

111

because now we only know everyone's user IDs now we know everyone's email addresses we found the vulnerability

112

that I could look at someone else's profile and

113

if I have the user ID I can go to

114

that user ID pull their password hash and maybe crack it

115

and then use the auth token at some point to see

116

if I can authorize myself into that account and

117

And that's why chaining vulnerabilities and multiple vulnerabilities together is more important than reporting them together.

118

Sure, you can report all those one by one.

119

Maybe you get 500 here, 500 there.

120

And each of those could be maybe a CVSS 5 or a 6, right?

121

And that's $2 ,000.

122

If you're finding a critical vulnerability that pays $5 ,000 to $10 ,000 and you put them all together in a bundle,

123

and you increase that CVSS score to a 9 or an 8 because of the impact that you have, then you're getting a whole lot of money for the same bucks.

124

So let me show you that in action really quick.

125

Now let's take a look at the last piece of this puzzle

126

and this is one that I wish I could make sense of it

127

but I couldn't but let's take a look either way.

128

So if we go to users here we can impersonate users

129

and if I click right here for example it will give us this access token

130

that we can take and we can log in just using this

131

but the key thing here was if I go to impersonate user number one

132

or this id number one which is the chief of medicine

133

which is more than likely the admin in this case it would tell us that this doesn't work.

134

So there's a couple of things here Let's first confirm that this functionality works.

135

So I'm going to grab this and we're going to put this at the end of the URL, go to another browser, and we're going to put this in there and boom, we're logged in as this doctor,

136

but this is the usual ID number two that we're looking at right about over here.

137

Let me go back.

138

It's this one.

139

We like this, but we love it more if we can become the admin, which probably has more functionality.

140

So what we want to do is, and this is what I showed you a little bit backwards in the original bug I noticed

141

that if I wanted to log in every time I did impersonate this token would change

142

so it's kind of impossible to guess how this is being created

143

but when I found the vulnerability within teams

144

when I would go to a profile and look at the source and at the bottom

145

this token existed I thought to myself maybe I could just use this to log in

146

and to my surprise Whereas if I actually swap it out and put that code in there,

147

it also logged in as that user based on the auth token that was leaked in their user profile.

148

Why that made sense and why it worked, I don't know.

149

Maybe the developers had a reason to do this, but it ended up working.

150

And this was one of the critical bugs, which helped me find more and more vulnerabilities by just unlocking more functionality.

151

So the key thing here wasn't just reporting all these bugs one by one.

152

I know this was really basic and really simple, but I want to kind of show the thought process of how do you map out an application?

153

How do you connect all these different functionalities?

154

How do you stop yourself from reporting a bug

155

and not just escalating it all the way through to get a critical finding?

156

In my case, I package all these into one simple bug and the title was something like IDOR leaks user auth token,

157

which then leads to account takeover using impersonation right that's a massive chain

158

that shows hey i found these different pieces of the puzzle

159

and these pieces of api i put them all together

160

and now i have a cvss of eight or nine

161

because it can arbitrarily take over any account of its own

162

and the cool thing was that

163

that endpoint for impersonation was also accessible without being logged in

164

so if you had someone's token

165

and you were not logged in it wouldn't check to see

166

if you're authorized so

167

if you had someone's token it was hardcoded it never changed

168

you always had a permanent account takeover on this application So that was it.

169

But before you go, let me just give you some really good advice, because what I just showed you, as I mentioned earlier, is the basic version.

170

First, don't make this your entire game.

171

What you just watched is a simple way to find broken access control and chain it.

172

It's a tool in your belt, not your entire focal point.

173

Only reach for it when it actually fits the company's threat model, because some programs genuinely just don't care about broken access control and you burn hours on bugs they'll never pay for.

174

So read the room first.

175

Two, the real money is in multi -org.

176

This is where it gets painful and that's exactly why it pays.

177

Picture a platform where every company it's its own tenant.

178

Now you have got to find a way to leak the org ID

179

and when it's a UUID instead of a nice clean integer, that's a bug all by itself.

180

Then you have to connect a user to that org.

181

Then maybe you can leak the address ID to pull every address.

182

Every one of those is a separate role that you have to find

183

and look you can report them one by one and get paid

184

but if you chain them and show

185

that you can leak every user's data on that platform in mass

186

that bounty is a completely different universe than the individual reports same bugs

187

but the chain is what changes

188

that number third once you get privest up to an admin

189

or someone with more access do not stop there there are

190

two things you want to explore one hit all of those newly discovered endpoints and test them for authorization.

191

Honestly, this is stupid easy now because you have something like Claude that can map him out for you in minutes.

192

But two, this is the important one and it's a little bit controversial.

193

Start looking for deeper bugs.

194

It's technically out of scope because you were never supposed to have an admin account in the first place.

195

But if you're sitting in that admin panel and you see a functionality that smells like RCE, SSRF, or even SQL injection,

196

my take is try it and ask for forgiveness later rather than walking away wondering what if.

197

Most companies actually appreciate these reports.

198

Just don't be too aggressive with it and use your judgment.

199

And one last thing, you'll probably notice I mentioned cloud and AI a few times during this video.

200

I've been messing with building a custom skill that actually hunts for broken access control bugs for me.

201

So drop a comment down below with the word AI maybe

202

if you want to see me actually build one out and let it loose on some of these labs.

203

If enough of you wanted, then that may be one of the next videos in the future

204

but all right that's it i hope you enjoyed this video the course is pinned in the comments down below

205

and if you haven't already make sure you hit

206

that subscribe button becoming a homie like this video drop a comment

207

and i'll see you all in next week's video peace

✨ 추천 영상

158 문장

이 영상은 누구를 위한 건가요?

영상 영어 공부를 즐기고, 실제 대화에서 자연스러운 표현을 배우고 싶은 초중급 학습자에게 완벽한 콘텐츠입니다! 특히 IELTS 스피킹 준비생이나 쉐도잉 연습을 통해 발음과 리듬을 개선하고 싶은 분들에게 추천합니다. 해킹이라는 전문 주제를 다루지만, 일상 회화에서도 자주 사용되는 표현과 논리적 이야기 구조를 배울 수 있어 실용성이 높아요.

빼놓을 수 없는 단어 & 관용구

Bug class: 버그의 종류나 범주. "Broken access control is a common bug class in cybersecurity."
Chain: 연결하다, 연쇄적으로 사용하다. "He chained small bugs into a critical vulnerability."
Dupe: 중복된 보고서. "This bug report is a dupe, so it won't get a bounty."
Stack: 쌓다, 조합하다. "Stacking vulnerabilities increases their impact."

이 표현들은 기술 분야뿐만 아니라 논리적 설명에서도 자주 쓰이니, 쉐도잉을 통해 발음과 함께 외우세요!

어떻게 발음을 제대로 따라할까요?

shadowspeaks 방식의 쉐도잉을 적용해보세요! 이 영상의 스피커는 빠르지만 명확한 발음을 가지고 있어, 리듬을 따라하기 좋습니다. 특히 "chaining them until a low turned into a critical"와 같은 문장에서 "chaining"의 [tʃeɪnɪŋ] 발음과 "critical"의 [krɪtɪkl] 강세를 주의깊게 듣고 따라하세요. 또한, "I know what you're thinking"에서의 축약형 "you're" [jʊr]을 자연스럽게 발음하는 연습을 하면, IELTS 스피킹에서 더 자연스러운 대화가 가능해질 거예요. 짧은 구절을 반복해서 쉐도잉하며, 스피커의 intonation과 pause를 정확히 모방해보세요. 이렇게 연습하면 영상 영어 공부 뿐만 아니라 실제 의사소통 능력도 크게 향상될 거예요!

이 영상의 문법

화자가 가장 많이 쓰는 문형을 영상 속 실제 표현과 함께 정리했습니다.

문형	영상 속 표현
수동태 be + 과거분사 — 누가 하는지보다 무슨 일이 일어나는지에 초점	were built · will be pinned · being shown
관계절 who / which + 절 — 사람이나 사물에 대한 추가 정보	people who built · users which is · mine which is
현재완료 have/has + 과거분사 — 과거의 일이 지금도 관련이 있을 때	I've made · have actually built

쉐도잉이란? 영어 실력을 빠르게 키우는 과학적 방법

쉐도잉(Shadowing)은 원래 전문 통역사 훈련을 위해 개발된 언어 학습 기법으로, 다언어 학자인 Dr. Alexander Arguelles에 의해 대중화된 방법입니다. 핵심 원리는 간단하지만 매우 강력합니다: 원어민의 영어를 들으면서 1~2초의 짧은 지연으로 즉시 소리 내어 따라 말하는 것——마치 '그림자(shadow)'처럼 화자를 따라가는 것입니다. 문법 공부나 수동적인 청취와 달리, 쉐도잉은 뇌와 입 근육이 동시에 실시간으로 영어를 처리하고 재현하도록 훈련합니다. 연구에 따르면 이 방법은 발음 정확도, 억양, 리듬, 연음, 청취력, 말하기 유창성을 크게 향상시킵니다. IELTS 스피킹 준비와 자연스러운 영어 소통을 원하는 분들에게 특히 효과적입니다.

섀도잉 방법: 단계별 전체 가이드 읽기 →

쉐도잉 연습: How I Made $30,000 Hacking Broken Access Control - 영상으로 영어 말하기 배우기

OWASP Top 10 Explained

JUST $1 For Billions of Tokens?! (DeepSeek v4 Pro)

The most interesting "hack" in history...

How I Escaped Help Desk Fast (Step-by-Step)

My 4.9-Star iOS App Is Actually a Website: Here’s How I Built It

Python3 For Pentesting - Introduction

I Cheated Until the Casino Banned Me

MySQL took 21 years to fix this bug

My HomeLab Monitoring Rules // feat. Checkmk

Your AI broke the layout. Now what?

Watch this before you boot up another device

🔥They Studied Your Weaknesses

이 영상은 누구를 위한 건가요?

빼놓을 수 없는 단어 & 관용구

어떻게 발음을 제대로 따라할까요?

이 영상의 문법

쉐도잉이란? 영어 실력을 빠르게 키우는 과학적 방법