Missing HTTP Security Headers - Bug Bounty Tips

In this video we talk about various HTTP headers that can improve or weaken the security of a site. And we discuss how serious they are in the context of Google's bug bounty program.

Chapters:
00:00 - Background Info
03:11 - Intro
03:53 - HTTP Security Header Overview
04:38 - Example #1: X-Frame-Options
06:43 - Example #2: Content-Security-Policy (CSP)
08:16 - Example #3: Strict-Transport-Security (HSTS)
10:44 - Example #4: Cross-Origin Resource Sharing (CORS)
13:12 - Example #5: Cookie Security Flags (HttpOnly)
14:25 - Summary
15:23 - Outro

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

[lukor-tech]

You know what I absolutely love?

The sheer idea, that he can sit at home, with a shirt that wasn't ironed for the google video. I am not saying he didn't try - it's just the audience more focused on the content than the creator.
I don't know how many will share the thought with me, but here it is.

Good stuff.

[saadmgdm]

Nothing makes me more happier than seeing this guy.

[Root-unonw]

Finally some browser security; this is the stuff that really needs to be taught, it’s practical and real world content. Keep these kind of videos up man.

[phillawrence]

Missing security headers are usually out scope on bug bounties program. Nice presentation is worth demonstrating.

[gFamWeb]

This seems to really boil down to: "if you can't accurately and specifically articulate how something can be exploited, it's likely not actually vulnerable"

[TheJobCompany]

here's my typo bounty submission: at 5:55 in the English subtitles there's a typo - it says "doens't" instead of "doesn't"

[harshrathod]

This is really crucial to understand that absence of a particular header doesn't mean the web application is vulnerable. Instead one should try to figure out how the absence of that header impacts the application in general or maybe chain that impact to find a realistic security flaw.

[HD_Heresy]

I'm new to Cyber Security and have been denying third party application access based on bad results from HTTP header scans, this video has helped me so much thank you!!!

[elevatecyber]

Very thought-provoking video! No one else is talking about this.

[t]

Love your videos! So much informative!

[guitarlover]

This is surely one of my favorite Channel on youtube !!!!

[SeMoDrix]

I never knew why i had hsts set up, just did it because it was good practice but never knew how it worked… very informational video, even if it was just for google!

[The-solo]

As always the video is so Informative. I'm a beginner and I'm about to start my bug bounty journey. I must say it helped me a lot.

[OmegaZ]

Very informational video, thank you as always for the nice content!! <3

[makezi]

Thank you for sharing this informative content. It's interesting to note how the previous Systems Administrator at my workplace was strongly in favor of implementing HTTP Strict Transport Security (HSTS) and advocated for team members to obtain Security+ certification. Unfortunately, his misconfigured setup contributed to some security issues, highlighting that HSTS isn't always a critical requirement for website security. This situation underscores the impact of knowledge gaps and how they can lead to misplaced pressures within teams. Additionally, thank you for sharing the YouTube video—it provided valuable insights, even though it was originally shared on Google. We truly appreciate it.

[mohitjaswal]

Amazing video. Please keep posting such real life examples of how to assess these reports generated by pen testing automation tools!!

[jesslopez]

Honestly, in the stratus of people out there being "Security Content Creators" L.O. has always come across as a passionate hacker. Even when advertising something, not trying to sell it.

I appreciate that you aren't a grifter man, because there are plenty in this field.

[oldGoatMilk]

Great video! I'm going to watch it again, a lot of good information.

[pentestical]

Great video as always, but I think one thing could be slightly incorrect. Sometimes (at least the last time I checked) authorization headers are automatically submitted by the browser. HTTP Basic Authentication credentials are cached so you don't need to fill out the prompt every time you visit a new page. A CORS misconfiguration in this case could allow data from a user authenticated with basic with to have data stolen. I think the same also applies to client certificate based auth, but I've never tested this one myself.

[sayamqazi]

5:33 This is exactly what I was trying to explain to a client that if a 3rd party npm module is being used in a static client size electron app the vulnerabilities reported by npm have ZERO impact because those only apply if the module is being using to process a user provided input in a route handler in a server app.