WEB CACHE DECEPTION FOR BEGINNERS!

Hi! I'm a pentester and a bug bounty hunter who's learning everyday and sharing useful resources as I move along. Subscribe to my channel because I'll be sharing my knowledge in new videos regularly.

SIGN UP ON Intigriti:

BUY ME A COFFEE:

SOCIAL MEDIA:

TIME STAMPS:

00:00 Introduction
00:56 What is Cache?
01:24 Which files are cached?
01:52 Lab Demo
03:08 Path Confusion
04:06 The Bug
05:42 Attackers Exploitation
06:29 Summarizing Conditions
06:53 Instructions for the lab

INSTRUCTIONS TO SET UP VARNISH WITH YOUR APP:

CONFIG CODE:

sub vcl_recv {
return (pass);
}
return (hash);
}
}

RESOURCES FOR WEB CACHE DECEPTION:

HACKERONE REPORTS:

[ZaidKhan-nkxr]

This video proves that a single video is enough to understand the concept. Great Work.😀

[sivakumar-idhe]

Your way of explaining things with an example using labs is

[ChillTamizha]

Very useful content keep post cybersecurity content like this ❤

[MokshitKalRa]

Di, I thought Web Cache poisning is So hard to understand because It is a P1 Vulnerability and P1 are difficult to learn but You Made My Day Today, a Lot Farah Di!
❤️

[samsingh]

Content getting better and better 👍👍👌👌

[mehrabhasan]

Your method of teaching is really helpful for beginners like me

[rohitsoni]

Awesome!
Just to add a bit more to it:
Whether a page should be cached or not, also depends on a response header Vary. Do check that out to know exactly what is being used to cache the pages of the website. (Cookies, Accept-Encoding, Extensions etc.).

[sanghadiyasunil]

Its amazing teaching stayle. Thank you Ma'am.

[ashrafulalim]

you've included some good resources in the description. It's amazing :)

[donhasan]

Just wow learned many things from your video

[Aaron]

It doesn't work for me when I replicate the lab, I inserted the config code given, it did cache when I change pass to hash for php file but when I try to insert the extension of css or other extensions, it just gave me 404 error, any idea where i went wrong? Everything seemed to work except trying to get it to cache the extension

[VikasSingh-eugb]

Your explanation is so good please continued for other topics

[darshanjogi]

Love your videos . Please make practical video on idor bug .

[arjayhferrer]

hey farah your video is really helpful even though i've already been 3 years in bug bounty community, i still find your videos very helpful especially the most basics one i tend to forget it, do you plan creating your udemy tutorials soon?

[kiwinesss]

Excellent. You have yourself another subscriber :)

[abhishekrajak]

@Farah Hawa. can you make a video on Reflected file download

[RogueSMG]

All the basic relevant info and technical explanations in <10 mins! What else do people even need? A cut from your bounties?

[davidg]

Hi! I'd like your opinion on the platform INE Training, I don't know if it's worth it. Have you used it? Have you known anybody who has? They're quite expensive. Cheers mate!

[xnl-hckr]

Really well explained and very helpful. Thanks!

[shekharpopatmahadik]

Hello Madam we all like your way of teaching. We are requesting please make a video on the bugcrowed bug bounty where we get how to choose program, initial steps to any bug bounty and how to perform and which tools are used and os is useful for bug bounty and most important report writing for anyone of program in bugcrowed.

Waiting for your reply.

Thank you.