Uploaded December 2021 | Updated September 2026, 2 weeks ago

---

Authorization and Authentication can be confusing. In this video we look at their differences, and then focus on valid and invalid authorization bugs.

LEARN ON HEXTREE (ad)
Learn hacking on Hextree: hextree.io
Watch this video and more on Hextree: app.hextree.io/courses/yt-websecurity/web-security-introduction
Join the Hextree Discord: discord.gg/xgQpCQCpvy

advertisement: this video was commissioned by the Google Vulnerablity Rewards Program for their site bughunters.google.com

watch all BHU videos here: youtube.com/playlist?list=PLY-vqlMAnJ9bGoI82H1BB8BE4A8H2OCA-

CHAPTERS
00:00 - Intro
00:33 - Authentication vs. Authentication
02:04 - Complex Systems with Permissions and Roles
02:42 - Example #1: Permission Complexity
04:16 - "Fixes" for Authorization Bugs
04:48 - Roles vs. Permissions
05:53 - What are Authorization Bugs?
06:52 - Example #2: Confusing Invalid Auth "Bugs"
08:22 - Summary

SUPPORT
Per video: patreon.com/join/liveoverflow
Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): shop.liveoverflow.com

WATCH, FOLLOW & READ
Second channel: youtube.com/LiveUnderflow
Twitch: twitch.tv/LiveOverflow
Twitter: twitter.com/LiveOverflow
Instagram: instagram.com/LiveOverflow
TikTok: tiktok.com/@liveoverflow_
LiveOverflow blog: liveoverflow.com
Hextree blog (ad): hextree.io/blog

#BugBounty #Auth #LiveOverflow

(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.