It Takes a Village to Learn: How to Love Web Vulnerabilities with OnlyHacks
Source: YouTube · Hack The Box · published Mar 5, 2025 · 1:56:00
The video demonstrates a collaborative web application security assessment using a Tinder-like app on Hack The Box, focusing on identifying vulnerabilities through structured, beginner-friendly methods. Hosts JX and Gar walk through the process of logging in, exploring app functionality, and using Burp Suite for manual and automated testing, emphasizing foundational techniques over advanced attacks.
Key Takeaways:
• The importance of starting with basic, controlled inputs and understanding request/response flow before diving into complex attacks 17:23-17:49.
• Directory enumeration and status code analysis as key techniques to identify hidden resources or misconfigurations 33:09-35:12.
• Recognizing potential IDOR (Insecure Direct Object Reference) vulnerabilities by testing URL parameters with known values 37:28-37:48.
• Using Burp Suite’s Intruder for automated fuzzing with predefined wordlists to test for exposed endpoints 34:00-34:58.
This session highlights how beginners can approach web application security systematically, using tools and real-world challenges to build confidence and skills.
Sources:
- 17:23-17:49 Discussion on foundational web app testing principles and request analysis.
- 33:09-35:12 Explanation of directory enumeration and status code deviations as vulnerability indicators.
- 37:28-37:48 Identification of potential IDOR vulnerabilities through parameter testing.
- 34:00-34:58 Demonstration of Burp Suite’s Intruder tool for automated fuzzing and endpoint testing.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 2 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[Music] [Music] he [Music] hello hello hi Welcome to our second stream of it takes a village my name is JX and with me I have gar let's see we're still waiting for people to uh populate this but I if it's your first time here and you're just joining uh it takes a village is where uh a beginner and a pro if I'm pointing the right way uh join forces to tackle the Box content um G do you want to kind of give a little bit about yourself since and I'll do a little bit after that but I you're kind of like the star in my eyes I don't know about that that's a lot that's that's a lot a lot to carry for sure what's up y good to see you second one like like Jack said this is our second it takes a village stream happy to be here I'm gar uh I'm a pentester of all the things my bread and butter is defin…