วีดีโอ

Thank you 😇

Hello my friend What's the problem exactly ?

same problem, if yours work please reply

@@popo_hack 'Resource not found' instead of key

same for me

try putting before any url you're using

Hello my friend 😊 Thank you for pointing this out. English is my third language, and I understand that I may make mistakes. I’ll work on improving my pronunciation and terminology in future videos. I appreciate your feedback! Happy hack ^^

InQl is an extension provided by Portswigger community but I am not sure I understand your question about Timer and Attacker. You can check the list of all extensions supported by Burpsuite portswigger.net/bappstore

Hello my friend 😊 Please check how I wrote the code from the video and then copy it go to the Expolit Server > paste your code > Save > delivred to the victim If this doesn't work to you you might close the lab then re-do after while I hope this can help you Happy Hack ^^

@@popo_hack Hi! Thank you for the response. But I did it exactly as you told, several times. And it still doesn't work as expected :(

after few more retries it finally worked, thank you!

@mykhailodudka5324 that's so bad. You might try to log out as Wiener user and re-do it again if this solution doesn't work for you this's maybe a bug from Web Security Academy you can report them to check the problem with you. I hope you find a way my friend

@mykhailodudka5324 Ooo great news 🤗 happy for you my friend 😁 Best of luck in your learning journey

Welcome my friend 😊 thank you so much I really appreciate it 😇 Happy hack ^^

Happy for you my friend 😄If you like those kind of content don't forget to subscribe to my channel to be up to date for new coming videos 😁 Happy hack ^^

Hello my friend 😊 Yes, this lab is little bit harder than others Best of luck. If you're interesting about those kind of videos don't forget to subscribe to my channel to be up to date for new videos

Always the first in comment 😁

Thank you so much my friend 😊 I really appreciate your words. If you want to see more like this video please don't forget to subscribe to my channel to be up to date for new videos 😇

Hello friend again 😊 Actually, I don't do that kind of videos they're no legal to share. If you do an IDOR it should be always for ethical reason. You can read some writes about it where ethical hacker share their found on Hackerone.com

Hello my friend 😁 In real live you might build you own server where it is hosted on cloud. You might use NodeJs, Laravel, Django or any backend server to build it. So in this where have server that provided by Web Security Academy for a test. If you like those kind of video please don't forget to subscribe to my channel to be up to date for new videos 😁 Happy hack ^^

Many thanks for you reply I do now

@acceshopping7360 absolutely welcome my friend 😊 ask me at anytime you Happy hack ^^

Hello, my friend 😊 Actually, IDOR is one of the most famous bugs on the internet, but to find one, you need to practice more in different scenarios. It's possible to find a bug like IDOR, but it's not that easy-you might learn about other types of bugs along the way. Best of luck in your hacking journey! I hope you succeed. Happy hack ^^

Hello my friend 😁 I happy to hear that from you. I hope you learn more from my videos. I do my best to provide an easy way to teach 😊 Don't forget to subscribe to my channel to be up to date for new videos Happy hack ^^

Hello my friend 😊 I really appreciate your words 😇 I am happy that you liked my content and the way I teach. I try to make cybersecurity easy to everyone and thank you for your comment and your subscription 😁 Happy hack ^^

Thank you my friend 😁

Happy to see you my friend 🌸

Hello my friend 😄 Can you be more specified? What price is changed ? Do you mean the Total Price or Item Price ? If your answer is 'Total Price' the Total Price changed because we used the injected the chosen_dsicount to have 100% discount to get the item for free. If your answer is 'Item Price' it might be change but it has not impact in the final purchase because there's backend check of item price. If you liked the content, feel free to subscribe to the channel for more videos like this. Your support means a lot! 😁

@@popo_hack yeah already subscribed 😌. Thank you for clearing my doubt

You're welcome my friend 😊 Feel free to ask me any question you want Happy hack ^^

Thank you so much for the kind comment! I’m glad you enjoyed the breakdown and explanations. If you liked the content, feel free to subscribe to the channel for more videos like this. Your support means a lot! 😇

Happy to hear that my friend 😊

Hello my friend 😊 Thank you for you comment. Actually in real life this will be different the purpose of this video it to merge more types of attacks in one. It lets you think in different way to find bugs where the developement team might missed them. So my friend please don't forget to subscribe to my channel to be up to date for new videos 😁 Happy Hack ^^

Hello my friend 😊 Happy to see you. My next serie will be File Upload Vulnerability 😁I will do the Authentification next to that 😁

@@popo_hack looking forward to it 🧨🥳

I really appreciate your words 🙏

Hello my friend 😇 Happy to hear that, best of luck in your learning journey 😊 Please don't forget to subscribe to my channel to be up to date for new videos Happy Hack ^^

Hello my friend 😇 You're right it is a kind of IDOR vulnerability where you can make read or write on specific data. I talked more about this topic on next video you can watch it from here th-cam.com/video/QPVKbjyIOeE/w-d-xo.html So my friend if you like these kind of videos pleqse don't forget to subscribe to my channel to be up to date for new videos 😁 Happy Hack ^^

@@popo_hack love your content bro I am just revising the concept found your video very short precise and informative

Thank you so much! I’m glad you found the video helpful and precise. If you have any questions, feel free to let me know! 😊

Hello my friend 😊 Can you please provide me more details. What is the error message ? And what is the full command that you used. In that time you can check that the command Linux by wget with /git endpoint should be like: wget -r example.com/git And if you get error relate to certificats you can add --no-check-certificate flagto be like: wget -r --no-check-certificate example.com/git I am waiting you to provide me with more details so I can help you Happy hack ^^

Welcome my friend 😊 happy to hear that 🌸 don't forget to watch the full serie my friend I will upload the last lab in next week stay tune 😇

Hello my friend 😁 You're so fast my friend hhh Thank you for your motivation, happy to see you everytime I upload a new video

@@popo_hack :) your videos remind me to complete more labs haha and I really love your energy 😁

@Aquax1000 hhh thank you my man 😁 I really like your comments too you my day as always 🙏😇

Hello my friend 🤗 Happy to have you back again! Best of luck in your journey

@@popo_hack Thanks Popo I will let you know as soon as I find something interesting. Btw I'm mixing up Access control, logic Errors and Auth together but nowadays I'm having a really hard time with GrapQL as this is really something new for me

Good job my friend you're doing a great job. GraphQL is a part of API Testing you see both of my series in my channel they might help you 😊

Hello my friend 😇 In this error it means that you're not logged-in when you tested your code. Please check the your code with video. And try to test it on your own account first, if you are able to change your own email it means your code works fine if not double check it and rewrite again. If you don't have a knowledge in programming using Javascript you might have some difficulty.

Hello my friend again We use 'http' instead of 'https' in the example because the server and lab of Web Security Academy are hosted in the same host where they communicate with each other as the LOCALHOST domain (127.0.0.1) but in real life senario if you have you own server that hosted on cloud you will need to you 'https' 🤓

Thank you so much my friend I really appreciate your words and you like my content. Please don't forget to subscribe to my channel to be up to date for new videos 😁

Hello my friend 😇 Thank you for your comment. 1. Yes in real life situation attack include his server address to recieve the requests and reads the his serve's log to get the request data 2. Yes, the admin user (previliged user) has to click the link to send the request to the attacker's server This 2 thinks can only happen when application has CORS vulnerability where it leaks header and senstive data

Hello my friend 😇 First that you for your comment and your suggestion, I really appreciate those kind of ideas. The best place where you can learn more about Front-End vulnerabilities and Back-end vulnerabilities and many other topics you can check this websites: 1. Web Security Academy: portswigger.net/web-security/all-topics => this website is the same in my videos 2. TryHackMe: tryhackme.com/ => This website has more topic in Network, Mobile, OS and more 3. HackTheBox: www.hackthebox.com/ => This website is very popular where you practice you skills I home that I answered your question my friend, please don't forget to subscribe to my channel to be up to date for new videos 😊

Hello friend 😊 I am very happy with those words 🙏 I am doing my best to upload new video every week, stay tune for new videos 😊

Hello my friend 😁 You can send a body in a GET request with GraphQL, but it is not recommended because GET requests are typically expected to be idempotent and use query parameters. However, some servers may allow it for convenience, though it goes against HTTP standards.

Welcome my friend 😇 I am happy that you like my video. Don't forget to subscribe to my channel to be up to date for new videos 😀

какой пароль ,дружище,у меня киллер не подходит

@настоящийтурбовася hello my friend 😇 I translate you comment and I now I can answer you question of 'why the killer didn' t work as password' this because the password changes in each time you run the lab, so you need to write you own script as I did in the video to find the right password 😁 I hope that I answer your question my friend, please don't forget to subscribe to my channel to be up to date for new videos 😊

@@popo_hack hello my dear friend, thank you bro

@@popo_hack hello my dear friend, thank you bro

Welcome my friend 😇🙏

Hello my friend 😇 thabk you for your comment. If you get any extra messages from you browser this may you have recieved those messages from another server so maybe it cames from one of your extensions, try to clear your browser data and remove extra extensions that you don't need then try again and check 😄 I hope that answered your question, so if you like those kind of video don't forget to subscribe to my channel to be up to date for new videos 😁 Happy hack ^^

Happy to hear that my friend I hope you learn more form my vidoes. Don't forget to subscribe to be up to date for new videos 😇

@@popo_hack done bro can you make more videos on os command injection dude i try at forms but didnt get and i saw differ reports they are doing unique i am doing bro but can you request

Hello my friend again 😁 Thank you for your suggestion actually I will do an OS Command injection serie after finishing my plan of videos and this can take some time so you can search on TH-cam about this topic and you will find hundreds video talking about that topic can help you to learn more 😇

@@popo_hack thanks bro yeah i have done all the things even i watched rana khali videos i love to learn from various guys so thats why 🤗

You're welcome 😇

Thank you so much my friend 😇 I hope that you learned something from my video don't forget to watch the full serie of GraphQL to learn more 😊 Please don't forget to like the video, subscribe to my channel to be up to date for new videos 🌸

Happy to see you my friend 🤩