Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

hyperliquids data layer allows you to see everyones positions look at the power of these api calls and this is how you can get a free api key

16,476 Aufrufe • vor 7 Monaten •via X (Twitter)

0 Kommentare

Keine Kommentare verfügbar

Kommentare vom Original-Post werden hier angezeigt

Ähnliche Videos

This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on. Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly. Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing. That is why validation needs to be performed on both the client and the server side. To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used. In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers. In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.

Ghost St Badmus

217,666 Aufrufe • vor 8 Monaten

how you can use openAI codex & gpt 5.5 completely FREE (the full guide) 100% legit. no subscription, zero API cost. up to 1M+ token/day. you need just an openAI account and here's how to set it up in 5mins. openAI has a program that gives eligible developers free API usage every day in exchange for sharing API data that helps improve future models. it's not a one-time credit, your allowance refreshes daily. depending on your usage tier, you can get access to hundreds of thousands, or even millions, of free tokens every single day on supported models. here's how to activate it: 1️⃣open your API dashboard: 2️⃣go to settings → data controls 3️⃣enable data sharing for your organization or project 4️⃣make sure your account has a positive API balance 5️⃣save the settings if your account is eligible, you'll see a message confirming access to complimentary daily usage. before you turn it on, know the tradeoff: • prompts and outputs from shared projects can be used to improve openai's models • don't use it for confidential information, client work, or sensitive data • eligibility depends on your account type and settings for everyone else, it's an incredible deal. use it to: • learn AI development • build side projects • experiment with codex • test agents and automations • prototype ideas without worrying about API costs most developers burn money testing ideas. this lets you experiment at scale while spending little to nothing.

m0h

70,509 Aufrufe • vor 2 Monaten