Prática de Shadowing: How I Made $30,000 Hacking Broken Access Control - Aprenda a falar inglês com vídeo

I've made over $30 ,000 from a single bug class broken access control on a single bug bounty program

and I know what you're thinking cool you found a bunch

of idols no the money didn't come from spaying low severe reports hoping

that one of them sticks it came from understanding the application better than the people who built it

and understanding how actually authentication works what does the app treat as sensitive action

and which features were built for roles I never was supposed to touch, then chaining them until a low turned into a critical.

In this video, I'm going to show you exactly how live with Real Labs, five bugs that I found and chained them into a full account takeover.

Stick around because the last one is the one that you will actually remember.

And real quick, if you're not familiar with broken access control bugs, it's very simple.

The app builds a wall around who's allowed to do what.

You are a normal user, so you shouldn't be able to read other people's data or hit an app in future or act as another account.

Broken access control is anytime that wall has a gap and that is it.

The whole game is finding those gaps and stacking them until we get a vulnerability that is worth reporting.

Now, I have actually built a lab so you can try it for yourself

and it is completely free over on Hacking Hub.

So everything I'm about to show you, you can practice the second this video ends.

If you want to go deeper, I've got a full broken access control course that breaks down this whole methodology, start to finish, and that link will be pinned in the comments.

All right, let me show you the app that we're hacking on today.

So this is the application that we have.

I know it looks super realistic.

Very proud of this lab that I put together.

You can log in quickly with the test account that you have right here, and you can just log in and it will take us to our application.

You can see we have a ton of different activities that we can do.

We can look at our recent activities, for example.

There are some data here there is records there is patients

there's teams you can see who is on your team

and you have staff

which surprisingly it says access denied we do not have access to do this

because our role as front desk does not have the permission to view this page

and we have users which is probably our different physicians site admins front desk

and so on so we have all of these

and each of these become a place where we want to attack

and find vulnerabilities obviously we have things like our profile and

so on and want to make sure we take a look at it

so this first vulnerability is your basic IDOR

and let me show you really quickly so we're going to go into records

and we're going to do our first encounter

and you can see this is like very basic numerical vulnerability

we can give it an ID for example 43 right here

and it shows us the data for another user

and every time we increment or decrease

that number it shows somebody else's data right this is what everyone thinks of

when it comes down to broken access control and a lot of times

if you're finding vulnerabilities like this one is either a dupe

or usually not a critical unless there is some PIIs or something that is screaming hey this should not be public.

This is where most people stop and just report these

and rack them up for low bounties

but don't worry we're going to come back to all these findings

that we're going to look at this video

and show you how we chain it but this is our first one super easy super simple you should already know this.

Now let's look at the next part of this this is the patient

if we click here and we do a search we can see

that it is sending a search query with whatever we put in here

so if I put in the word test for example

and somebody has the word test in it it will come

up my favorite thing to do here is just doing a single letter

so like a so everyone

that has the letter a in their name it will show up it's most common

and it works

but here's what a lot of people don't think about you will see things like clinic id

and most people are here to quickly maybe make it into a two you can see

that it's showing all of them and sometimes it may not actually work

but my favorite thing here is to do either a zero to see

if it does anything or just entirely removing that and by doing

so you can see that it shows everybody or every other clinics users

and all their different data births and email address and things like that

and it's one of the most common ways of finding vulnerabilities

where this is an eye door where I could see the data for a specific clinic

that is not mine which is seeing everybody's data think of this as

if you're doing an API call

and it's doing something like API v1 slash user slash ID you take

that id and either put that leading slash or do without it

and it leaks every user on that website sometimes you would do some bypasses there

so if there's an nginx rule for example

that just kind of stops it from happening you can do a percent 2f

and things like that that actually bypass it i have a whole video on

that i'll link it down below go watch on the channel

but that's just one of the other ones to look for

and this was another one that i looked at

because it just gave me every user's data on there

that i could actually enumerate and use as a part of my chain and later down the road.

So these are a little bit too simple, but I promise it's going to come full circle, but I want to kind of show it off before we put the whole chain together.

But let's go to the next one.

And that is our teams, which is also super interesting.

And let me show you why.

If I quickly click on team right here, this is supposed to allow me to see my own team's data, right?

So if I click on here and go to profile number one, if i go to profile number two number three

and this is number seven actually

so i can maybe do something like normal number three

that doesn't work in my case it allowed me on

that actual bug bounty program to enumerate everybody's data

but the interesting thing isn't the idol

that happens here is looking at what is being shown to

me on this screen again there was no api calls everything

that i was seeing was this it was a really ancient application

that was supposed to be internal but the cool thing was

and i would have probably missed it

and luckily with ai you You'll probably never miss this

if you're having AI actually look at all your data and your request.

100

But if you would have right -clicked on this link and you would have scrolled down to the bottom, you will see the data that is being shown to you that is visible on this screen and then some.

101

So you can see right here, I have the name right here with a password.

102

The password is PWFOX.

103

There is an email here.

104

There's a password hash.

105

The cool thing was on the password hash, it was this auth token and the MFA secret it because

106

if I have these two and

107

if you can find a way to use this auth token

108

and bypass the MFA then I can easily just take over an account

109

and become an admin and that's exactly what I did and

110

that is why this is so important for us

111

because now we only know everyone's user IDs now we know everyone's email addresses we found the vulnerability

112

that I could look at someone else's profile and

113

if I have the user ID I can go to

114

that user ID pull their password hash and maybe crack it

115

and then use the auth token at some point to see

116

if I can authorize myself into that account and

117

And that's why chaining vulnerabilities and multiple vulnerabilities together is more important than reporting them together.

118

Sure, you can report all those one by one.

119

Maybe you get 500 here, 500 there.

120

And each of those could be maybe a CVSS 5 or a 6, right?

121

And that's $2 ,000.

122

If you're finding a critical vulnerability that pays $5 ,000 to $10 ,000 and you put them all together in a bundle,

123

and you increase that CVSS score to a 9 or an 8 because of the impact that you have, then you're getting a whole lot of money for the same bucks.

124

So let me show you that in action really quick.

125

Now let's take a look at the last piece of this puzzle

126

and this is one that I wish I could make sense of it

127

but I couldn't but let's take a look either way.

128

So if we go to users here we can impersonate users

129

and if I click right here for example it will give us this access token

130

that we can take and we can log in just using this

131

but the key thing here was if I go to impersonate user number one

132

or this id number one which is the chief of medicine

133

which is more than likely the admin in this case it would tell us that this doesn't work.

134

So there's a couple of things here Let's first confirm that this functionality works.

135

So I'm going to grab this and we're going to put this at the end of the URL, go to another browser, and we're going to put this in there and boom, we're logged in as this doctor,

136

but this is the usual ID number two that we're looking at right about over here.

137

Let me go back.

138

It's this one.

139

We like this, but we love it more if we can become the admin, which probably has more functionality.

140

So what we want to do is, and this is what I showed you a little bit backwards in the original bug I noticed

141

that if I wanted to log in every time I did impersonate this token would change

142

so it's kind of impossible to guess how this is being created

143

but when I found the vulnerability within teams

144

when I would go to a profile and look at the source and at the bottom

145

this token existed I thought to myself maybe I could just use this to log in

146

and to my surprise Whereas if I actually swap it out and put that code in there,

147

it also logged in as that user based on the auth token that was leaked in their user profile.

148

Why that made sense and why it worked, I don't know.

149

Maybe the developers had a reason to do this, but it ended up working.

150

And this was one of the critical bugs, which helped me find more and more vulnerabilities by just unlocking more functionality.

151

So the key thing here wasn't just reporting all these bugs one by one.

152

I know this was really basic and really simple, but I want to kind of show the thought process of how do you map out an application?

153

How do you connect all these different functionalities?

154

How do you stop yourself from reporting a bug

155

and not just escalating it all the way through to get a critical finding?

156

In my case, I package all these into one simple bug and the title was something like IDOR leaks user auth token,

157

which then leads to account takeover using impersonation right that's a massive chain

158

that shows hey i found these different pieces of the puzzle

159

and these pieces of api i put them all together

160

and now i have a cvss of eight or nine

161

because it can arbitrarily take over any account of its own

162

and the cool thing was that

163

that endpoint for impersonation was also accessible without being logged in

164

so if you had someone's token

165

and you were not logged in it wouldn't check to see

166

if you're authorized so

167

if you had someone's token it was hardcoded it never changed

168

you always had a permanent account takeover on this application So that was it.

169

But before you go, let me just give you some really good advice, because what I just showed you, as I mentioned earlier, is the basic version.

170

First, don't make this your entire game.

171

What you just watched is a simple way to find broken access control and chain it.

172

It's a tool in your belt, not your entire focal point.

173

Only reach for it when it actually fits the company's threat model, because some programs genuinely just don't care about broken access control and you burn hours on bugs they'll never pay for.

174

So read the room first.

175

Two, the real money is in multi -org.

176

This is where it gets painful and that's exactly why it pays.

177

Picture a platform where every company it's its own tenant.

178

Now you have got to find a way to leak the org ID

179

and when it's a UUID instead of a nice clean integer, that's a bug all by itself.

180

Then you have to connect a user to that org.

181

Then maybe you can leak the address ID to pull every address.

182

Every one of those is a separate role that you have to find

183

and look you can report them one by one and get paid

184

but if you chain them and show

185

that you can leak every user's data on that platform in mass

186

that bounty is a completely different universe than the individual reports same bugs

187

but the chain is what changes

188

that number third once you get privest up to an admin

189

or someone with more access do not stop there there are

190

two things you want to explore one hit all of those newly discovered endpoints and test them for authorization.

191

Honestly, this is stupid easy now because you have something like Claude that can map him out for you in minutes.

192

But two, this is the important one and it's a little bit controversial.

193

Start looking for deeper bugs.

194

It's technically out of scope because you were never supposed to have an admin account in the first place.

195

But if you're sitting in that admin panel and you see a functionality that smells like RCE, SSRF, or even SQL injection,

196

my take is try it and ask for forgiveness later rather than walking away wondering what if.

197

Most companies actually appreciate these reports.

198

Just don't be too aggressive with it and use your judgment.

199

And one last thing, you'll probably notice I mentioned cloud and AI a few times during this video.

200

I've been messing with building a custom skill that actually hunts for broken access control bugs for me.

201

So drop a comment down below with the word AI maybe

202

if you want to see me actually build one out and let it loose on some of these labs.

203

If enough of you wanted, then that may be one of the next videos in the future

204

but all right that's it i hope you enjoyed this video the course is pinned in the comments down below

205

and if you haven't already make sure you hit

206

that subscribe button becoming a homie like this video drop a comment

207

and i'll see you all in next week's video peace

✨ Vídeo recomendado

71 frases

O que é a Técnica de Shadowing?

Shadowing é uma técnica de aprendizado de idiomas com base científica, originalmente desenvolvida para o treinamento de intérpretes profissionais. O método é simples, mas poderoso: você ouve áudio em inglês nativo e repete imediatamente em voz alta — como uma sombra seguindo o falante com 1-2 segundos de atraso. Pesquisas mostram melhora significativa na precisão da pronúncia, entonação, ritmo, sons conectados, compreensão auditiva e fluência na fala.

Técnica de shadowing: leia o guia completo passo a passo →

Prática de Shadowing: How I Made $30,000 Hacking Broken Access Control - Aprenda a falar inglês com vídeo

The most interesting hack in history just got weirder...

OWASP Top 10 Explained

how to make an extra $4-5k every month around a busy schedule (FULL BREAKDOWN)

Claude Code: The Advanced Guide (99% of Devs Skip These Features)

Python3 For Pentesting - Introduction

My 4.9-Star iOS App Is Actually a Website: Here’s How I Built It

MySQL took 21 years to fix this bug

I Cheated Until the Casino Banned Me

A Career in IT

JUST $1 For Billions of Tokens?! (DeepSeek v4 Pro)

How I Ranked 1st at Cambridge University - My Secret

Your AI broke the layout. Now what?

Contexto e Fundo

5 Frases Chave para Comunicação Diária

Guia Passo a Passo para Shadowing

O que é a Técnica de Shadowing?