How I was able to see likes and dislikes count which is hidden by victim | YouTube #1

Hello friends, long time no see 😂

I had a long break from bug bounty so I am writing this post after a long time. Today I am going to write about one of my recent finding on Google. Let’s get started.

Introduction:
YouTube allows you to hide like/dislike count when you upload any video. This feature had multiple bugs which were submitted by Rando.

PS: I have taken permission to exploit this bug against Rando’s video to confirm the bug. Please do not blindly exploit against anyone’s video if you are able to find bypass of this.

Exploitation:

Victim:
1. Upload video
2. Edit video
3. Disable like count on video
4. Save

Attacker:
1. Visit this POST request

POST /youtubei/v1/reel/reel_item_watch HTTP/1.1
Host: m.youtube.com

{"context":......{"playerRequest":{"videoId":"zlcKT3ZzWyk"},"params":"CA8gACoAMAI%3D","disablePlayerResponse":true}}

2. Change the original video id to victim’s video id
3. Attacker is able to see like/dislike count.

PoC video: https://www.youtube.com/watch?v=8SmMttR9NyY