Burpsuite Practitioner For Bug Bounty Ethical Hacking 2025

Conduct API recon to identify endpoints, methods, and parameters, then exploit an API endpoint using documentation with Burp Suite tools to delete a user.

Master API recon with Burp Suite by identifying endpoints, testing HTTP methods, content types, and authentication, and exploiting an unused API endpoint in a hands-on lab.

Explore how Burp intruder and parameter discovery tools reveal hidden endpoints and parameters, and understand mass assignment vulnerabilities that can expose admin privileges in APIs.

Explore server-side parameter pollution in a query string by testing inputs to detect truncation, parameter overflows, and potential access to non-public data and admin actions.

Learn to test server side parameter pollution in rest paths using burp suite's backslash powered scanner, and apply an allow list to manage encoding for XML or JSON structured data.

Explore how large language models handle prompts and external APIs, and how prompt injection enables unsafe actions. Map the LM API attack surface with lab scenarios.

Demonstrates chaining vulnerabilities in LLM APIs, using path traversal and OS command injection to reveal how benign API calls can reveal a secondary exploit, culminating in remote code execution.

Learn about indirect prompt injection, where prompts travel via training data or API output to manipulate language models, enabling web llm attacks and email forwarding exploits.

Learn training data poisoning and indirect prompt injection that leak sensitive data, and apply zero-trust or low-privilege models to protect publicly accessible APIs.

Explore cross-site request forgery (CSRF) vulnerabilities with no defenses, where attackers exploit cookie-based sessions to induce users to perform unintended actions like changing email or password, bypassing same-origin policy.

Understand csrf tokens and defenses like same-site cookies and referrer validation, then see how token validation depending on request method can be bypassed by switching from post to get.

Discover how CSRF protection that relies on token presence can fail, as removing the token bypasses validation, shown through a lab with an exploit server.

Learn how a CSRF token not tied to a user session enables cross-account attacks, revealing a lab vulnerability where tokens are not validated against accounts.

Explore a csrf vulnerability where the csrf token ties to a non-session cookie across frameworks. See how cookie setting and subdomain tricks enable token manipulation in an attack.

Learn how CSRF tokens duplicated in cookies enable double-submit CSRF attacks by injecting forged cookies and matching tokens, with hands-on lab exploitation for bug bounty testing.

Learn how lax same-site restrictions can be bypassed by using a method override to perform get requests that send cookies and enable CSRF exploits.

Learn how same-site strict cookies can be bypassed with client-side redirects, using gadgets to trigger legitimate secondary requests and exploit the email-change flow via post IDs to reach the account.

Exploit cross-site WebSocket hijacking via vulnerable sibling domains to exfiltrate chat history and login credentials. Leverage Burp Collaborator payloads and an exploit server to deliver the attack and reveal credentials.

Explore how to bypass same-site lax using newly issued cookies and cookie refresh to perform cross-site request forgery, leveraging OAuth social login in a practical lab.

Learn how referer header validation impacts CSRF defenses and how attackers bypass referrer-based protections by manipulating the referrer header, including no-referrer strategies, in the lab.

Demonstrates how broken referrer validation enables CSRF, builds a CSRF POC using history.pushState and unsafe referrer policy, and analyzes lab results on cross-domain requests.

Explores clickjacking (UI redressing) and how iframe overlays trick users into clicking hidden buttons, contrasts with CSRF, and discusses defense with CSRF tokens and practical lab scenarios.

explore clickjacking techniques using burp’s click bandit to prefilled form data from url parameters, and learn how get parameters can alter user submissions in a lab scenario.

Explore how frame busting scripts defend against clickjacking, and how labs simulate bypass attempts to expose frame-based vulnerabilities, including iframe handling and browser protection.

Exploit clickjacking to trigger dom-based xss by coercing user clicks on a vulnerable form, using iframes and crafted parameters to execute scripts.

Explore multi-step clickjacking by building sequential iframes, tuning pixel positions, and delivering a store view exploit to a victim, including labeling clicks 'click me first' and 'click me next'.

Learn how to prevent a clickjacking attack using server-side protections like x-frame-options and CSP, including frame-ancestors self and same origin directives.

Discover how to locate, test, and exploit GraphQL endpoints with Burp Suite, using universal queries, introspection, and endpoint discovery to access private posts in labs.

Explores an access control vulnerability in a GraphQL endpoint, revealing private user credentials through queries and introspection, and demonstrates signing in as administrator to delete a user.

Discover how to locate a hidden GraphQL endpoint and bypass introspection defenses by manipulating schema queries, including get requests and url-encoded parameters, to access protected data.

Explore bypassing GraphQL rate limits using aliases to perform multiple login attempts in one request, and leverage Burp Suite to test brute force protections in a lab.

Explore how GraphQL endpoints enable cross-site request forgery by exploiting content type handling and missing CSRF protections, with a hands-on lab using x-www-form-urlencoded post requests.

Prevent GraphQL attacks by disabling introspection for non-public APIs, match content providers, enforce JSON-encoded post queries, and implement a CSRF token mechanism to curb DDoS risk and costs.

Analyze insecure cross-origin resource sharing configurations, understand the same-origin policy, and practice exploiting CRS in a lab to retrieve the administrator's API key.

Explore cors vulnerabilities, including insecure trusted protocols, origin whitelisting pitfalls, and how null origins and subdomain misconfigurations enable cross-origin access and xss via cors.

Learn to manipulate web socket messages and handshakes with Burp Suite to uncover WebSocket vulnerabilities, including injection vulnerabilities, using intercept, replay, and repeater in a live chat scenario.

Learn to manipulate the WebSocket handshake to exploit vulnerabilities, spoofing IPs with x-forwarded-for, bypassing a flawed XSS filter by capitalizing letters to trigger WebSocket alerts.

Explore cross-site WebSocket hijacking, a CSRF-like vulnerability where lacking CSRF protection and cookie-based sessions enable exfiltration of live chat history via a WebSocket handshake using Burp collaborator.

Understand how web caches sit between users and servers, decide cache hits and misses, generate cache keys from requests, and apply rules to store static resources, web cache deception attack.

Explore constructing web cache deception attacks by identifying dynamic endpoints, testing cache vs origin responses in Burp, and exploiting static extension cache rules with dynamic resources and cache busting.

An in-depth look at path mapping discrepancies between traditional and restful URLs, and how cache behavior can misclassify dynamic endpoints as static resources in web cache deception.

Explore how delimiter discrepancies in URLs create web cache deception vulnerabilities, with examples from Java Spring, Ruby on Rails, and encoded characters, and learn practical testing with intruder.

Explore how origin server normalization enables web cache deception by testing URL path delimiters, percent encoding, and path traversal to trigger cache hits against static assets.

Explore web cache deception techniques by manipulating URL paths and encoding strategies, solve lab challenges using dot dot slash and percent-encoding, and learn to mitigate with cache control header.