Intro to Bug Bounty Hunting and Web Application Hacking

Explore how http requests work, including get, post, put, patch, and delete, and decode response codes, headers, content types, endpoints, parameters, cookies, and tokens.

Explore Kaido as a bug bounty proxy tool, compare it with Burpsuite, intercept and replay HTTP requests, use match and replace, and set a scoped Udemy and CTF io workflow.

Learn how to set up Burp Suite, configure proxy and scope, and use repeater, intruder, payloads, and decoder tools to test and fuzz web applications within a defined target.

Learn how regular expressions (regex) find patterns in strings across front-end and back-end code, test them on regex101.com, and use anchors and escaping to prevent manipulation and errors.

Explore open redirect vulnerabilities by fuzzing redirect parameters and observing 302 responses. Test how inputs redirect users to trusted or malicious sites, including browser tricks with at-sign domains.

Identify cross-site scripting by testing how user inputs reflect in the dom, and demonstrate basic payloads using script tags, event handlers, image tricks, iframes, and object tags with data attributes.

Investigate how cross-site scripting depends on rendering context by testing inputs and text areas. Learn to close tags, handle events, and encode payloads, not copy-paste, to reveal where scripts execute.

Identify cross-site scripting risks in markdown by examining headers, links, and images, then fuzz payloads and assess how markdown implementations handle JavaScript and data URIs.

Master blind XSS concepts and how payloads can trigger on backend admin pages. Learn to test inputs and headers with XSS Hunter to identify hidden XSS opportunities.

Explore practical xss filter bypass techniques through a trial-and-error approach, testing tags, case sensitivity, regex, event handlers, image sources, iframes, not closing tags, and clever workarounds to evade filters.

Discover how content security policy (CSP) thwarts XSS by restricting script and resource loading via directives like default-src, script-src, and img-src, with values such as self and none.

Investigate CSP bypass techniques by testing data-driven payloads in script sources versus object tags, and learn why certain vectors succeed where others fail.

Explains how uploading files to allowed domains can bypass a content security policy, enabling JavaScript execution via script sources.

Explore practical CSRF bypass techniques, including inspecting and manipulating CSRF tokens, testing blank or removed tokens, and reusing tokens across users to create a proof-of-concept password update.

Explore local file disclosure via path traversal, using dot dot slash to read arbitrary server files, with image endpoint examples, linux paths, and encoding tricks.

Demonstrate a local file read by modifying the file parameter and using directory traversal to access non-root files, such as the Etsy password, via an image endpoint that ignores extensions.

Master sql querying and sql injection fundamentals by learning select, where, like, order by, limit, and union to retrieve data from databases like the customers table.

Enumerate usernames and passwords using boolean-based sql injection, validating data with subqueries and a limit clause, and iterating characters to reveal account information.

Learn blind SQL injection techniques using the sleep command to reveal database names, tables, and columns, then enumerate usernames and passwords from a vulnerable web form.

Explore blind insert sql injections in a contact form, using execution-time delays to verify vulnerabilities and determine the database version.

Examine real-world SQL injection disclosures on bug bounty platforms, including Zomato’s blind injection bypassing a firewall using sleep, and vulnerable headers like the user agent.

Explore common file upload vulnerabilities and testing techniques. Learn how changing extensions and content types, uploading HTML or PHP, and path traversal enable exploits like XSS via file names.

Test file upload vulnerabilities to detect inline and blind rc, using burp repeater, curl, and brb collaborator to verify outputs via dns and uploads.

Learn how insecure direct object reference (IDOR) lets attackers fetch or alter data by manipulating object IDs in endpoints, such as user profiles, addresses, and invoices.

Understand server-side request forgery (ssrf) attacks via proxies to access internal resources, exploring blind, full, and limited responses and bypass techniques like open redirects.

Show how server-side request forgery can occur in apps, using a screenshot tool as the example. Highlight headless chrome user agents, CVEs, and internal endpoints like localhost and 8080.

Explore bypass techniques for SSRF against blacklisted resources by using alternative localhost references, IP formats, CNAMEs, and custom domains, plus ports and hex notation to access restricted hosts.

Explore SSRF bypass through flawed domain whitelisting, testing whether allowed domains must end with a string or merely contain it, using nip.io and IP tricks to reach a Tomcat instance.

Chain open redirects to expose server-side request forgery (ssrf) within domain restrictions, using real examples and attack surfaces to show how redirects can reach internal resources or external sites.

Explore server-side request forgery in an image context by forcing the app to fetch internal resources through a crafted invoice and iframe technique, revealing access to internal networks.

Explore server-side request forgery using HTML injection in PDFs to access internal resources. Learn to execute JavaScript, manipulate document.location, and redirect via iframe to test HTTP and file contexts.

Demonstrates how server-side request forgery can chain with XSS to reveal internal network access by probing locally hosted services, using favicon techniques and IP range brute-forcing.

Explore XML external entity (XXE) vulnerabilities in XML parsing and see a lab using system entities, local file access, AWS metadata, and evil DDT with Burp collaborator to exfiltrate data.