Yaswanth Mangalagiri

 This bug is categorised as IDOR. We all share Instagram reels with our friend via DM.  Did you every try "Copy link" and share on mediums like WhatsApp or any similar apps ?  When you do that, the generated Link would be of the below URL https://www.instagram.com/reels/<REEL_ID>?igsh=<Encrypted> The igsh in the Query params of URL is an encrypted string, that would get decrypted on the Instagram servers to the User's Profile ID.  On clicking on the link, it would open the Instagram App and plays the reel and then an interruption will be by a popup like the below screenshot  The Attack... Crafting the URL ...  If you replace the <Reel_ID> (What the user intended to share) with a <Granphically_Sensitive_Content_REEL_ID> in the link and send it to users, when ever any user opens the link. It would show graphically sensitive content and then a Popup of the victim's profile. Though they didn't intend to share it.  Report timeline...

The users that have been going into the  year-wise   White hat thanks   list has significantly reduced if you check.. . You can find me four times in that list. There has been a check if it's an unlikely / rare scenario,  they just close the report and only say thanks for spending time. Image generated using Microsoft's Copilot  Bug 1: Auth Bypass:  This is my first Auth Bypass and very excited to report and aiming a  $ 20,000 as reward. A very interesting bug as Auth Bypass always ranks at the Top in the OWASP. I captured a vulnerable HTTP Request from https://business.facebook.com . It can be replayed any number of times for at most 2 hours, after the Victim has changed his password.  The report is closed because of the time-out of the session. The attack has gone in vane.  Bug 2: Disclosing if a user had been a member of Facebook group in the Past or has an active invitation.  For this exploitation, the Attacker requires User ID and ...

YouTube Community  is a feature that is only available for Channels with  1. Verified Phone numbers 2.  A significant history, more content for years. In the early June I started hunting for Security flaws on YouTube I was roaming around the features but most of the places have been found secure or already potential features had the bugs fixes in place. The Community Tab is now Posts So, I thought to exploit Youtube Community feature. I was trying to delete the Posts using IDOR attacks but it didn't work I was tired of trying various attacks but thought to compromise to the least "Privilege escalation".  The Security flaw... A user (victim) created a YT Community post, later an attacker while being an Admin of the same Channel has saved the HTTP Request that deletes a Community Post / Poll, then the attacker can replay that HTTP Request after he's demoted from Admin to Subtitle Editor  that would delete the Post / Poll. I exploited this flaw I tried after 15 ...

I was actually willing to see my name in this Page of the year 2022.  I thought I would miss but anyway I made it at the end of the year by finding this interesting security Bug. So, this bug is found in the Facebook Commerce Page.  First, The Page admin creates an Order in the Page Inbox to a user and that sends the order to the User.    The Paid checkbox can only be seen ticked when the Admin Marks the Order as paid and the User has no way to hack it. The user can mark only Received but he cannot mark Paid or Dispatched, only the Page admin has the access to do it. So after the admin has maked the order as paid the user will get the option to Mark the order as Received or Dispatched, The HTTP Request while marking the order as RECEVIED would be  I observed in the variable parameter in the message body has mark_as_received . What if I replace the received with paid. I created a new order and did that BOOM ! The order is marked as paid in the Page Admin's Inbox...

 One million views can make you earn $300 - $ 1000. So what are the deciding factors. Subscribes Total watch hours or minutes Subscriber count

Group Admin invites the User with link.   The User opens the discussion page and sees the Join Group Button  user will request to join the group and his request will be declined After the user reloads the page he'll be shown with No Content  page. But the user can send a request to join from the Discussion page.  

 Page editor cannot see the crossposting Page in the Page Settings. But he can use a HTTP Post Request to send an invitation

There's an annoying feature on Youtube it's called End Screen. When the video is about to end there would be thumbnails of videos that occupy the entire video, giving you a bad experience.  The End screen of any video can be crafted from YouTube Studio The End Screen button opens up a popup that displays radio button, that lets you choose a video that is in your uploaded vidoes.  If you video is private, it shows that The video is private and will be replace with some other video. Now if the video is unlisted it allows you to happily add it in the end screen without notifying that it's an unlisted Video.

Your requests seem to be a success but what happens if the totally out of the world scenarios. Don't get fooled by the 200 OK response for Insecure direct object reference. 

Checkout  https://ads.lithific.com YouTube has been giving Ads even on the videos that didn't reach 1k subscribers & 4k watch hours. If this is the case people will switch to a platform that doesn't even have any eligibility for monetising ads. Everyone will start their own website and start ads or promotions like done mediocre creators or influencers do

In the Facebook Page Settings, you could setup the option for Crossposting Live videos from other pages.  The Attacker's page adds a Page (Victim's Page) for crossposting their videos Victim Page's Admin accepts the approval and the default option is Crossposting videos without further approval The Attacker starts live video and selects Victim's Page in the "Crosspost to more pages" Victim visits the Crossposting page in the Page settings and and removes Attacker's Page Attacker selects "Use camera" and clicks on "Go Live". The Victim's Page starts automatically crossposting the live video of Attacker,  Bug Bounty of $500

The COVID has made everyone's life just boring and all the people are becoming mediocre.  Everyone even the news or TV hosts are creating channel on YouTube just to pay their EMIs as they have no source of income as of now since the shut down of the channels. For every 1M views the creators get atleast 2 laksh. That's a lot of sum. Isn't it? Now that everyone is creating channels just to make money whethe the video is good or bad they just upload it. Just to make money. Earlier people used to upload only to showcase their talent and get recognized for their work Now coming to my perception how I view the future of YT Channels. YT is going to delete the channels that is pure non sense. And these users will create their own website hosted on any platform and upload the videos there and then start making revenue from it.

I was testing with the Instagram Lite App. There is major difference in the APIs of the Instagram APp and the Lite App.   Bugs were found by other bug hunters in the Facebook and its Lite Version. So I gave a try to the Insta. I was mainly concerned about the privacy of other users, like invading into their privacy and something I enjoy doing. We also love invading into other people private life right? Like who they dated and also love to read their personal messages. In the Instagram App There is Mentions in the Privacy settings of Instagram that have options like: No One. Only followers etc. When the User has set the mentions to No one then any user cannot tag them in the comments of other posts across Insta. But in the Instagram Lite app, You can directly enter the user name of the user and just post the comment. I tags that account. Rewarded $500 , 25 days later since reporting the bug

  Django   deployment never fails unless it is at the Database drivers. The required version of mysqlclient isn't found. is the common error you get in  Amazon Web Services  server logs If you are here after reading my pervious post then you must have wasted days while deploying your  Django  app on ElasticBean The only reason of failure could be the installion of the mysql drivers. The regular DB driver that django installs or in your requirement.txt file is mysqlclient You try the below mysql Drivers:  mysql-python mysql-connector-python For my app  mysql-connector-python worked. Go through this site https://dev.mysql.com/downloads/connector/python/

There is always an issue with  Amazon Web Services  ElasticBean while deploying applications and always a scary part. It was a cakewalk on Heroku hosting platform but it's nightmare here and wastes days  The Rails Application   use Puma as default server, recently it has updated to 5.2.2 at the time of writing this post. During the recent deployments to AWS elasticbean all have been failing, The main reason is the Gem File isn't being obeyed.  The specified version of the Puma isn't being instaled by the AWS serves when  A revolution for server I decided to go back to Django again. You can read this post to encounter what all I encountered duint the deployments of Django Application. So going back to Rails. Everything has been installed properly except the Puma server.  I specified 4.3.2 in my Gem File but AWS was installing the 5.2.2. And all the Load Balancers have been showing the status of 502 or 400. The Server health is shown as degraded or ...

https://codingcompetitions.withgoogle.com/codejam/round/000000000043580a/00000000006d0a5c          

Solution to Google Code Jam 2021 First Problem Moons and Umbrellas   Problem can be found here  https://codingcompetitions.withgoogle.com/codejam/round/000000000043580a/00000000006d1145

  Bug Bounty has become the bread and jam for many developers and it is getting tough since the year 2014. Only the hackers with deep research can get through it and those who find XSS in a intellectual way get paid. If you find and IDOR bug they defininetly say it is already know or there are changes or it is an intentional and works as expected. But what's the truth  no one knows or they wantedly close the report. Find a bug which is difficult to exploit by others. The more easy the bug the more easy it is for them to get it rejected and throw nothing at you. But if it is more difficult to reproduce. It would be tougher for them to Reject the report. I have found pretty easy bug and it was told that it is working intented or either they marked it as duplicate.. The truth..??? No one knows. Either they wantedly marked as duplicate just to escape the payment or just it is easy and anyone can find it.

  In the Settings  of YT Studio.  The Community tab has Advanced Filters  tab, that lets you enter the "Blocked Words".  For example if you enter the word "Hello" and save. Enter the Hello in different styles like "HElLo", and it gets Held for Review. But if you append an emoji it could bypass the filter at the server  and goes for review and gets displayed in the the comment section.

  In the Facebook Page General settings, the section " Page Moderation " allows you to input a list of words that never gets displayed if someone enter them in the comments. But when a Page manager, it may be an analyst, Advertiser enter those words It gets shown in the comments.  Keeping the page managers at risk of their names getting disclosed in the comments section of any post.