Hacking YouTube to watch private videos?

Опубликовано: 30 Сентябрь 2024
на канале: Tech Raj

130,557

3.8k

This bug was found by David Schütz.
Check out his write up on his blog: https://bugs.xdavidhu.me/google/2021/...

This bug that existed in Google's backend API allowed an attacker to watch a private video on youtube without having the required permissions. The attacker can view the youtube video by stealing it one frame at a time.
This bug existed in an embedded YouTube player on Google Ads. The Google Ads feature "Moments" was exploited to steal individual thumbnails (or frames) of any private video, which can be combined to form the video.

Google awarded 5000$ reward for this discovering this bug to the author David Schütz.

Join my Discord Server:   / discord
Follow me on Instagram:   / teja.techraj
Follow on Twitter:   / techraj156

Website: https://techraj156.com
Blog: https://blog.techraj156.com