Turning a $500 bounty into $30,000+

📚 Purchase my Bug Bounty Course here 👉🏼 bugbounty.nahamsec.training
💵 Support the Channel:
You can support the channel by becoming a member and get access exclusive content, behind the scenes, live hacking session and more!
☕️ Buy Me Coffee:
www.buymeacoffee.com/nahamsec
JOIN DISCORD:
discordapp.com/invite/ucCz7uh
🆓 🆓 🆓 $200 DigitalOcean Credit:
m.do.co/c/3236319b9d0b
💬 Social Media
- / nahamsec
- / nahamsec
- twitch.com/nahamsec
- / nahamsec1
#bugbounty #ethicalhacking #infosec #cybersecurity #redteam #webapp

[@NahamSec]

Come hangout with us on Discord! discordapp.com/invite/ucCz7uh
Remember my example is simplified for the sake of this video and I did have to jump through a few hoops like: a small filter bypass, CSP, and finding a legacy API endpoint in order to get my account takeover to work. The next time you find an XSS find a way to gain access to your "victim's" account without just trying to leak their current session/cookies.
P.S.: Course update is underway!

[@jeanvanoudtshoorn9587]

Hi,thanx for the great channel.i am new to hackerone,i have a question,i have a server mis config bug,but dont know under what to report it as there is no description for it under reports.please help?

[@Muthu.D]

Try to make videos about SSTI and SQLi. All are finding SQLi in cookie,param and login page. I can’t understand how the SQLi works in some areas. Please make a video about SSTI and SQLi.

[@H3xOv3rflow]

Yes really needed that @NahamSec

[@onikumabackspace]

I would love to have you opinion on wether i as a beginner should learn one vulnerability first and look for it anywhere, or i should pick a target and learn how to look for many vulnerabilities there.

[@benjaminmiller5930]

Good stuff and I can actually understand the way you explain stuff.

[@giodevJS]

Thanks, your videos are really well explained. Learning with your videos is a time saver in some research’s.

[@NahamSec]

Thanks for watching

[@mr.picklesworth]

How do you like the 8bitdo keyboard? I've been thinking about getting one.

[@comosaycomosah]

I see you have hella notion notifications lol same same....hey you got any cool templates for notion or anything? Hacky things lol? Check lists? Im a sucker for a good checklist lol

[@shriyanssudhi4545]

I have got a stored XSS, but you need to be an admin to inject payload. Any tips on this 😕

[@z-root8955]

very informative video thanks :)

[@user-sc2yr7xk6h]

Hii, Can you share the links for 5 week program? I totally lost.

[@robinmarte7990]

Fire video bro

[@salehlardhi4635]

Thanks bro ❤

[@bashirkabiruzarewa]

Thats a cool escalation, Thanks for the continues contribution to the community👏🙏,

[@NahamSec]

Thanks for watching!

[@king_Joah]

Am new to this game any direction because I don't knw wey to start from and those 100+ pages books aren't helping

[@Muby_Ajiwa]

Please Sir make a video on Business Logic Error vulnerability

[@MarcelN1980]

Hey, will you do an update of the course materials? If so, when? :)

[@NahamSec]

Very soon! There will be multiple updates. I have finished recording update 1.

[@MarcelN1980]

@@NahamSec Thanks a lot! Can we help in any way? :)

[@user-fp7fs9xl2t]

Great Content ...

[@bountyproofs]

Information Disclosure --> It is popular and it has so many different types

[@MUHAMMADZEESHAN-mx4yg]

Is "US Dept Of Defense" paid bug bounty program or free?

[@rctech1237]

Wow sir keep it up , present

[@MarkFoudy]

Hey Nahmsec! Hope you are well!

[@NahamSec]

Hi 👋🏽

[@ashifnewaz9348]

give us top 5 bugs finding tutorials..

[@shuvokumarsaha8478]

Awesome 🥰

[@silenttravelerRahul]

need some video on RCE on latest app

[@fredenj-wr6qb]

It would be great to create SSRF content

[@X-RayBBH]

ey Naham you just got rickrolled by coffin haha

[@brutexploiter]

Great!!

[@danishbhat1536]

nice one

[@naumanalam5572]

Add some videos about SQLi , how ,where to find, how to identify and exploitation.

[@ultmate948]

I would love if you could make your voice louder as it is a bit hard to hear from my side

[@NahamSec]

Will take a look at audio settings! Thanks for flagging!

[@alpernaee]

Deep Dive RCE or SQLi

[@mihad0x1]

Business Logic Flaw 🤓🤓🤓🤓🤓🤓

[@Adarsh.-.]

RCE naham

[@Linnocks]

IDOR

[@kmm4026]

You always talk about money, and I think you are trying to attract viewers because you know that they need money. You follow the same method as financial speculation videos and stock exchanges in attracting victims. The topic of Bounty Bugs is very difficult and requires knowledge and time to learn, and not in this way that you present and simplify it in order to attract views.

[@monKeman495]

Can you guys validate this is this a valid bug:
If there is a email change feature in application after login. In here by putting victim email instead of sending link to unregistered email we getting link on attacker email (base email ) is this a valid case or some case there is no verification email. We click on link and get registered?
With victim email

[@nux4857]

It's not a valid bug

[@sigma-yn3qd]

This dude still selling bs about big bounty come on man do your stuff and stop try to sell lies to people that wants to get a career cause you damn know very well that bug bounty unless you have another job and a lot of time do not pay shit