Bug Bounties: WhiteHat Hacking for Fun and Profit

Configure Burp with your browser to intercept traffic by setting a proxy listener on port 8080, installing Burp's certificate, and enabling manual proxy settings.

Learn to use Burp Suite's target, proxy, and spider tabs to map a site, intercept and modify traffic, and manually verify vulnerabilities to avoid false positives.

Explore burp suite's spider, intruder, repeater, and decoder tabs for live scanning, payload customization, and automated testing. Analyze session cookies, brute-force credentials, and repeat requests to test vulnerabilities.

Explore how Burp Suite and related tools decode values, analyze cookies, configure proxies, and simulate interception to understand web app security and ethical testing.

Gather header information to identify a website’s tech stack, including third-party libraries and outdated components, using scanning or manual analysis to reveal versions and possible disclosures.

Learn to use Google dorks for information gathering by leveraging advanced Google searching, site:, filetype:, inurl:, intitle:, and other operators to reveal publicly available data.

Learn how to gather information using Google Docs and search techniques, exploring indexed files, file types, and search operators to reveal exposed assets.

Inspect publicly accessible text files on a site to uncover juicy endpoints, assess disclosure risks, and report responsibly.

Learn how double information gathering and brute force directory discovery reveal accessible directories and files, enabling discovery of internal components and potential weak access controls.

Learn how to download a website's source code to your local system, configure the project, and browse the site offline with downloaded files, images, and data.

Learn to use WhatWeb in the terminal to gather information about a website, including technologies like WordPress and Apache, cookies, IP addresses, redirects, geographic data, and exploits for outdated versions.

Subdomains are distinct content sections under the same domain, such as blogs on blogs.example, and the lecture covers enumeration and access risks.

Learn to enumerate subdomains for bug bounty testing, using tools and search engines to discover internal and exposed subdomains and assess misconfigurations for ethical penetration testing.

Demonstrates how the harvester collects emails, subdomains, hostnames, and banners from public sources and search engines. Users set a target domain, limit results, and run queries to reveal visible information.

Explore how the Wayback Machine preserves past website versions and supports information gathering from public sources by showing historical screenshots and dates.

Explore vhosts discovery as discussed in the review, and understand how this topic relates to the bug bounty context.

Get familiar with nmap by performing simple scans to identify live hosts, open ports, and running services, including Windows systems, for basic vulnerability assessment.

Explore how diverse nmap scans reveal port states, including connect and stealth (syn) scans, plus icmp probes, showing open, closed, or filtered results.

Explore different types of nmap scans in a practical demo, including connect and stealth scans, port probing, and basic host availability checks via icmp and port states.

Expose banners with Nmap to scan networks, reveal application and service details, and assess potential access to servers in a bug bounty context.

Install the bwapp application on your local host, configure the database (root, no password, bwapps), then explore vulnerabilities at different security levels, including DML injection, header injection, and authentication bypass.

Explore testing for HSTS and enforcing transport security by inspecting SSL configurations, upgrading connections to secure protocols, and verifying strict security rules across websites.

Explore how robots.txt governs crawler access, reveal misconfigurations, and show how attackers can access unprotected files and endpoints to harvest data for bounties.

Explore brute force attacks by testing usernames and passwords with payloads and automated tools, observe login responses, and configure minimum and maximum ranges.

Explore how hidden html tags and hidden input fields can be manipulated to alter form submissions, prices, or subscriptions.

Explore how cookies store user identifiers, how attributes like the secure flag and domain scope protect tokens, and how misconfigurations can lead to interception or cross-site scripting risks.

Learn how cookie-based session IDs and login behavior can enable session fixation and account takeovers, and how to test these session management flaws for bug bounty programs.

Learn to identify broken authentication flaws, including inadequate lockout after failed logins, brute force risks, and password guessing, and to assess login and password reset defenses.

Learn how idor vulnerabilities occur when applications use user-supplied input to access objects without proper validation. Attackers can read other users' database entries, files, or passwords, exposing sensitive data.

Learn how idor vulnerabilities allow accessing another user's resources by modifying request parameters, and how proper authorization checks guard resources in web apps.

Explore how directory traversal attacks exploit unsafeguarded inputs to access arbitrary files and directories, bypassing access controls and potentially exposing config files, source code, and system data.

Explore clickjacking techniques by framing a site in an iframe, using transparent buttons to redirect users to malicious sites, and learn to detect and prevent with X-Frame-Options and same-origin checks.

Explores CORS (cross-origin resource sharing) in browsers, detailing preflight requests and access-control headers. It highlights insecure configurations like wildcard origins that enable data leakage.

Explore html injection as an input validation vulnerability that lets attackers modify page content, inject malicious payloads, create links, and steal cookies through redirects and JavaScript.