- 23
- 376 882
codingo
Australia
เข้าร่วมเมื่อ 1 ต.ค. 2013
Instructional videos on Information Security, and bug bounties by a top 20 bug hunter, ex penetration tester and now manager of the triage team at Bugcrowd.
Bugcrowd Researcher Templates for Bug Bounty Hunters
Learn more at: www.bugcrowd.com/blog/3-key-components-of-researcher-submission-templates/
Templates can be found open source at github.com/bugcrowd/templates
Templates can be found open source at github.com/bugcrowd/templates
มุมมอง: 17 956
วีดีโอ
Recon Fundamentals Expanded (Nahamcon 2022 Talk)
มุมมอง 2.4K2 ปีที่แล้ว
In this video I further expand on recon fundamentals with some tool examples, and a quick overview of tools to watch in 2022 (Trufflehog, Caido, and SecurityTrails SurfaceBrowser)
Why do you Duplicate so much with Bug Bounties?
มุมมอง 10K2 ปีที่แล้ว
Why do you duplicate so much when doing bug bounties? How to dupe less. ▬ Continue the discussion ▬▬▬▬▬▬▬▬ ✭ Twitter: codingo_ ✭ Patreon: www.patreon.com/codingo ✭ Facebook: codingo
Common Open Redirection Bug Bounty Mistakes
มุมมอง 6K3 ปีที่แล้ว
Let's talk about open redirections, their impact, and common mistakes made when submitting them to bug bounty programs. ▬ Continue the discussion ▬▬▬▬▬▬▬▬ ✭ Twitter: codingo_ ✭ Patreon: www.patreon.com/codingo ✭ Facebook: codingo ▬ Table of Contents ▬▬▬▬▬▬▬▬▬▬▬ 0:00 Introduction 3:52 the '@' operator 5:18 Intentional Redirects 6:41 Escalating
Hacking on Bug Bounties for a Living
มุมมอง 19K3 ปีที่แล้ว
Let's talk about what you should consider, before deciding whether or not to do Bug Bounties full time for a living. Written companion guide: www.bugcrowd.com/blog/the-shocking-truth-you-may-not-know-about-being-a-full-time-bug-hunter/ ▬ Continue the discussion ▬▬▬▬▬▬▬▬ ✭ Twitter: codingo_ ✭ Patreon: www.patreon.com/codingo ✭ Facebook: codingo ▬ Table of Contents ▬▬▬▬▬▬...
Fundamentals of Bug Bounty Recon
มุมมอง 27K3 ปีที่แล้ว
Let's discuss the fundamentals you need to properly understand recon as it relates to security. ▬ Participate in the building of content ▬▬▬ ✭ Twitch: www.twitch.tv/codingo_ ▬ Continue the discussion ▬▬▬▬▬▬▬▬ ✭ Twitter: codingo_ ✭ Patreon: www.patreon.com/codingo ✭ Facebook: codingo ▬ Table of Contents ▬▬▬▬▬▬▬▬▬▬▬ 0:00 Introduction 1:21 Active and Passive Recon 3:12 Wid...
Impostor Syndrome and How we Talk about it in Infosec
มุมมอง 2.2K3 ปีที่แล้ว
A quick discussion about impostor syndrome and some thoughts about how to better discuss it in information security. ▬ Participate in the building of content ▬▬▬ ✭ Twitch: www.twitch.tv/codingo_ ▬ Continue the discussion ▬▬▬▬▬▬▬▬ ✭ Twitter: codingo_ ✭ Patreon: www.patreon.com/codingo ✭ Facebook: codingo TOF_gYIEYWBIW5dZIVcWG842tKME9AIh
Commonly Misunderstood Bugs: Authorization Based Vulnerabilities
มุมมอง 3.6K3 ปีที่แล้ว
Let's discuss common mistakes people make when reporting Authorization based vulnerabilities. ▬ Participate in the building of content ▬▬▬ ✭ Twitch: www.twitch.tv/codingo_ ▬ Continue the discussion ▬▬▬▬▬▬▬▬ ✭ Twitter: codingo_ ✭ Patreon: www.patreon.com/codingo ✭ Facebook: codingo ▬ Table of Contents ▬▬▬▬▬▬▬▬▬▬▬ 0:00 Introduction 1:13 Video Goal and Intentions 1:41 Forg...
Recon and Corporate OSINT with DNSGrep and Rapid7 Open Data
มุมมอง 3.5K3 ปีที่แล้ว
Let's discuss the fundamentals of recon and OSINT on a corporation using the Rapid7 Open Data project, and DNSGrep for Pentesters and Bug Bounty Hunters ▬ Continue the discussion ▬▬▬▬▬▬▬▬ ✭ Twitter: codingo_ ✭ Patreon: www.patreon.com/codingo ✭ Facebook: codingo
Burp Suite BApp Management for Pentesters and Bug Bounty Hunters
มุมมอง 4.7K3 ปีที่แล้ว
Let's discuss the fundamentals of Burp Suite configuration and extension management, and why it's important for pentesters, and bug bounty hunters. ▬ Continue the discussion ▬▬▬▬▬▬▬▬ ✭ Twitter: codingo_ ✭ Patreon: www.patreon.com/codingo ✭ Facebook: codingo
Bug Bounty Fundamentals: Scope
มุมมอง 7K3 ปีที่แล้ว
Let's discuss the fundamentals of scope, why it exists, and what happens behind the scenes. ▬ Continue the discussion ▬▬▬▬▬▬▬▬ ✭ Twitter: codingo_ ✭ Patreon: www.patreon.com/codingo ✭ Facebook: codingo
Commonly Misunderstood Bugs: DDoS & DOS
มุมมอง 3.2K3 ปีที่แล้ว
Learn the difference between DDoS and DOS, and what makes for a valid bug bounty report. ▬ Continue the discussion ▬▬▬▬▬▬▬▬ ✭ Twitter: codingo_ ✭ Patreon: www.patreon.com/codingo ✭ Facebook: codingo
Discovering Cloud Assets Externally, with CloudEnum
มุมมอง 3.9K3 ปีที่แล้ว
Discovering Amazon AWS, Google Cloud, and Microsoft Azure assets, externally ▬ Continue the discussion ▬▬▬▬▬▬▬▬ ✭ Twitter: codingo_ ✭ Patreon: www.patreon.com/codingo ✭ Facebook: codingo ▬ Additional Resources ▬▬▬▬▬▬▬▬▬ ✭ hakluke/status/1350553428242493440 ✩ steemit.com/amazon/@calastinone/amazon-warns-admins-and-updates-the-aws-dashboard
What Operating System do I need to hack?
มุมมอง 3.7K3 ปีที่แล้ว
As a beginner, what operating system do you need to hack? Let's discuss. ▬ Continue the discussion ▬▬▬▬▬▬▬▬ ✭ Twitter: codingo_ ✭ Patreon: www.patreon.com/codingo ✭ Facebook: codingo ▬ Additional Resources ▬▬▬▬▬▬▬▬▬ ✭ Windows Subsystem for Linux Installation Guide for Windows 10: docs.microsoft.com/en-us/windows/wsl/install-win10 ✩ What is a Virtual Machine: vmware.com/...
Better Bug Bounty Tool Results with DNSValidator
มุมมอง 4.4K3 ปีที่แล้ว
Better Bug Bounty Tool Results with DNSValidator
Hacking Tips - Finding new Tools and Techniques Using Github
มุมมอง 17K3 ปีที่แล้ว
Hacking Tips - Finding new Tools and Techniques Using Github
Subdomain Takeovers, beyond the basics for Pentesters and Bug Bounty Hunters
มุมมอง 110K3 ปีที่แล้ว
Subdomain Takeovers, beyond the basics for Pentesters and Bug Bounty Hunters
Getting started with Github for Security Professionals and Bug Bounty Hunters
มุมมอง 9K4 ปีที่แล้ว
Getting started with Github for Security Professionals and Bug Bounty Hunters
How to Master FFUF for Bug Bounties and Pen Testing
มุมมอง 60K4 ปีที่แล้ว
How to Master FFUF for Bug Bounties and Pen Testing
Noice
CODINGO!!!!!!!!
20k people here, 2 will make it ,1% of the 1%
Thank you for so detailed explanation! I previously didn't imagine that ffuf can do such complex things! Only used it for simple fuzzing for dirs and files.
Hmm my favorite bugs
I should have watched this before I submitted what I thought was an open redirect because your first example with the "@" operator was the mistake I made. Which resulted in me having a non-appiclable. LOL. Oh well, you live and learn right? I am now using this opportunity to educate myself and understand better. Thank you always codingo!
same here bro, I too done the same mistake before 2 weeks. Have u found how to escalate it ? If yes can u share please
Sensible points.
Easy to understand, Really enjoyed the video
I'm a 51yr old paraplegic teaching myself bug bounty in order to make some extra from home someday, this video really helped me understand "out of sccope" thank you :-)
Amass enough said.
Thanks man, I really appreciate the content you cover and your perspective on things. Regarding 0:54, do we know why there are so many public dns servers giving malicious results, and what causes one that is returning good accurate results to suddenly start returning malicious results?
Indian Audience >>>>>>>>>>>>>>>>>>>>
whats your suggestions for beginner bug bounty hunters about scope? Which easy ones should i focus? Open redirect,self XSS etc. mostly not paying and out of scope.
What to do after recon? I am stuck please help..
Congratulations man !
th-cam.com/video/yPXeAZmTjCI/w-d-xo.html Web Application Penetration Testing Series
th-cam.com/video/yPXeAZmTjCI/w-d-xo.html Web Application Penetration Testing Series
what to do if the CNAME is a custom one?
I had this a ton when I went from IT administration into Cyber Security and now again approaching web application testing. It's never ending. I noticed it happen to me only within Cyber Security and I think it is because the breadth of knowledge one needs to be aware of and know is a lot, you need to know the basics at least of networking, operation systems, infrastructure and more. Even then if one has a solid foundation of all these fields then you need to learn to master security controls, defense, intelligence and exploitation on top of that. It's what makes cyber security such an incredible field but also challenging to keep a pace on. I have come to just settle into the fact that I won't know everything and even if I get to know something deeply and well, something else that I learned awhile ago may be forgotten because it is just so much knowledge. Like now digging deep into web app testing and haven't touched cloud stuff in awhile I am forgetting some of the stuff I learned. It's okay, it is just what it is.
Is it ok to focus only on a particular vulnerability
Duplicated bug hunter master here! Do you have any tips to stop finding duplicated bugs all the time?
Quality content but unfortunately rapid7 has removed public access to the project sonar datasets
Great vid as usual.
What do you think about feroxbuster
it is gonna be better if you just turn off background music
Do FFUF has command for fuzz more then one website form file command list-- not works.?
As an ex HUPLO grinder this a lot of the things you said resonate. I'm guessing you was a MTT grinder?
NLHE cash games primarily, though I did play a lot of PLO closer to when UIGEA dropped / took it away
BABYYYYYYYYYYYYY😍🥰
is it legal to do active recon in the bugbounty programs??
Some commands do not work in ubuntu as (go)
The templates project is really cool. 💪
Congratulations
Thanks, waiting for more review like this
-H and -b options have different formats: -b "Format: "NAME1=VALUE1; NAME2=VALUE2" -H ==> :"Name: Value,Name2: value2"
Amazing content!!!!! What Distro are you using?
Thank you very much I need to suggest the next lesson What after the recon . process Steps required and then reach the goal
Lol, I like that video style (walking), its relaxing!
Glad you enjoyed it! Hopefully will shoot more like that in the future
Kopi mana kopi
Thanks for doing this. Great content.
I hate duplikat
The routine of a bughunter is very exhausting, especially those who search for bugs manually, in the long run this is unsustainable. In order to have greater financial stability, I would have to invest a lot in automation, as the top bughunters do, and create content on the subject on platforms to diversify income and keep evolving.
Before working as a bug hunter, were you a professional poker player ? If someone want to start a new career as a bug hunter, how long does it take until he can start making money ?
I’m thinking it’ll take at least a year. Once you get into the security field you are golden! Even if you don’t get to Bug Bounties you can join a SOC and be a SOC Analyst and learn a bunch and possibly transfer over later
Nice beard xD
Thank-you!
I don't know if I missed it, but how can I filter the results that have lines, words or sizes greater than a specific number? For example, how do I exclude all results with size 0?
nice
Is there any left pentesterlab subs amoung your 1000 subs giveaway? :(
Long gone! I've given over $20k of it away over time though, I recommend following on twitter as they usually are done in larger giveaways there.
hindi subtitles really helped out, thanks for this vid!
You're welcome 😊
Thinks makes it Soo much easier
Bugcrowd on 🔥🔥