Keep Hacking at HackerOne

Explore how insecure login and weak session management enable an attacker to impersonate a user by exploiting session identifiers, illustrating the severe consequences and a practical demo.

Demonstrates how an attacker impersonates a user by exploiting insecure session management. Comparing non authenticated and authenticated session ids via a cookies manager reveals how identical ids enable unauthorized access.

Explore how metadata hides sensitive information from attackers and how passwords and credentials can reside in file comments across doc, docx, and pdf formats, demonstrated with exif tool extraction.

Demonstrates metadata extraction with exif tool on documents hosted on a domain, revealing hidden credentials and sensitive data in metadata, illustrating risk of sensitive data exposure.

Examine how login forms protect credentials by enforcing https, compare redirects from http to https, and test both login and signup flows for disclosure vulnerabilities.

Demonstrates https enforcement protects login credentials by redirecting http to https, while sign up may lack enforcement, allowing credentials to be exposed via Burp Suite during testing.

Explore insecure password changes and how failure to invalidate sessions after a password change leaves attackers with ongoing access; learn to test and enforce proper session invalidation.

Demonstrates testing for a secure password change within broken session management, showing that changing a password does not invalidate the old session, leaving attacker access intact.

Explore dictionary attack concepts and countermeasures, including captchas and login thresholds, to prevent automated password guessing. Learn how to evaluate threshold settings and report vulnerabilities ethically for rewards.

Demonstrate a dictionary attack on a web login by cycling email and password attempts, noting no captcha, and revealing when accounts remain unblocked after 15 tries.

This course presents the next five bugs that really work on HackerOne, including insecure session management, metadata leakage, credential disclosure, age cps enforcement, insecure password change, and dictionary attacks.