Offensive Bug Bounty - Hunter 2.0

This lecture explains how recon expands bug bounty targets by discovering subdomains and subdomains of subdomains, using Subroute to generate and export subdomain lists for targeted hunting.

Perform recon by enumerating subdomains and subdomains of subdomains using subroute.py and alt dns master. Generate, filter, and review subdomain lists for targets and opportunities with configurable threads.

Filter live subdomains by recursively listing subdomains of subdomains with subru.py, using DNS lookup threads and a target list, then save results to subdomain.txt, yielding about 1,200 Microsoft subdomains.

Learn to assess all subdomains for https status codes in an offensive bug bounty context. Apply status code checks to discover actionable insights across subdomains.

Explore error-based SQL injection techniques, focusing on stripping comments to bypass filters, balancing quotes, and using union and order by to reveal database information.

Expose sql injection tactics to bypass filtering, test vulnerability with quotes and comments, and use union all and order by to discover database structure and content.

In this lecture from offensive bug bounty hunter 2.0, learn error-based get injection techniques, testing quotes, spaces, order by, and union all select to enumerate columns and databases.

Discover blind-based sql injection techniques in get requests by balancing quotes, bypassing space and comment filters, and using union all select to reveal database information.

Explore error-based get request techniques to bypass space and quote filtering, using union select patterns to reveal database information and test column handling in SQL injections.

Demonstrates bypassing sql injection filters in get requests by balancing quotes, using case changes, and employing union all select with encoded spaces to reveal vulnerabilities.

Explore how to detect and understand SQL injection vulnerabilities through practical testing of quotes, backslashes, comment filtering, obfuscation, and union-based payloads.

Explore blind SQL injection by using union and select patterns, testing input parameters, quote handling, backslashes, and multi-column queries to reveal content.

Explore GET error-based testing with union all select payloads to detect vulnerabilities, manipulating quotes and spacing to reveal database content.

This lecture demonstrates testing an application's defenses against SQL injection by manipulating quotes, backslashes, and union select payloads to explore database responses and column counts.

Explore error-based sql injection techniques to identify column counts and reveal hidden content through quote handling and union queries.

Explore blind sql injection vulnerabilities in a lab by manipulating input parameters, testing union all select across columns, and observing how database responses reveal data.

Explore how input filters like addslashes can be bypassed to reveal sql injection opportunities, using URL encoding and union-based queries to test database responses.

Explore bypassing a custom filter in get requests, using percent encoding and quotes, testing payloads, and the ability to execute database queries on reflected columns.

Explore post-based bypass of addslashes to perform sql injection tests using burp suite, including traversing escape filters, order by, and union all select to reveal database names like security.

Examine bypassing addslashes to perform sql injection in a lab, using quotes, backslashes, percent encoding, and union all select to reveal the database name security.

Explores how SQL injection techniques interact with input filters like addslashes, using quotes and union statements to probe database structure.

Explore how MySQL real escape string defenses can be bypassed using Burp Suite to test inputs with backslashes, addslashes, quoted strings, and union queries, revealing database name and login vulnerabilities.

Examine how stacked query sql injections allow appending additional queries to existing statements, enabling malicious input to access, modify, or delete data through injected commands.

Explore GET stacked query injection techniques using string inputs to identify vulnerabilities within the offensive bug bounty framework.

Explore GET-based stacking of queries to test injection vulnerabilities in offensive bug bounty workflows within this course.

Explore how blind-based string stacking vulnerabilities arise in get requests and learn practical techniques for identifying and exploiting them in offensive bug bounty hunting.

Explore a post based stack vulnerability with a get blind based approach, testing username and password inputs, including a backslash input, to induce error messages and observe responses.

Explore post-based error-driven stack SQL injection techniques using Burp Suite repeater to test quotes, balance operations, and union all with multiple columns to modify user data and credentials.

Examine stack-based and stack-query sql injections, including blind boolean testing and substring data extraction, using burp suite repeater to test username and password parameters and simulate a password update.

This lecture demonstrates error-based SQL injection techniques, using Burp repeater to test single and double quotes, union-based payloads, stacked queries, and boolean conditions to update a password.

Explore error-based and blind sql injection techniques, including double query payloads, boolean and time-based methods, and the use of rand, ascii, substr, and sleep to infer data.

Learn how time-based blind sql injection works, testing quotes and payloads like sleep and substring, and explore order by and web shell upload attempts when server permissions allow.

Master error-based and blind SQL injection techniques on a get parameter, using quotes, spaces, and rand-based character extraction to uncover data through numeric ordering.

Explore error-based string blind SQL injection, including the use of order by clauses, single quotes, comments, and the switch between blind boolean and time-based techniques using sleep to reveal data.

Demonstrates error-based and stack-based sql injection using sort parameters and the order by clause to reveal and modify data in a users table via update and insert queries.

Explore error-based stack query injections and how faulty SQL syntax reveals vulnerabilities, with semicolon-based injections that can create, insert into, and drop tables such as new users.

Explore stack-based SQL injection by manipulating input with spaces and comments to break queries, then create and drop tables like users to reveal how attackers gain control over servers.

Explore blind, stack-based sql injections and how crafted inputs manipulate queries against a users table to reveal vulnerabilities.

Master a ten-query GET challenge by using union-based SQL injection to locate the secret key. Enumerate database schema with information_schema to reveal table and column names and retrieve the key.

In this challenge, you have 14 attempts to dump the secret key using SQL injection, testing quote closures and enumerating table and column names from information_schema.

Tackles a union-based get-challenge by querying information_schema.tables and information_schema.columns with group_concat to reveal table and column names, then uses union all select with limit 0,1 to fetch the secret key.

This lecture walks through solving challenge 57 by testing for quotes, identifying union-based sql injection, and using information_schema queries to enumerate database, tables, and columns, and retrieve data.

Tackle lesson 58's five attempts challenge by building a double query using union select and count to reveal a table name, column names, and the secret key in MySQL.

Explore double query challenges in a controlled bug bounty setting. Learn to manipulate spaces, quotes, and union techniques to reveal table and column data and identify vulnerabilities.

Learn to input an id parameter and use code to discover the table name and column names, locate the secret key, and submit it in lesson 60.

Demonstrate bypassing challenge 61 by querying a database to dump the secret key from a random table, locating table and column names, and revealing the key in five attempts.

Demonstrates a blind boolean SQL injection to recover a secret key within 130 queries, using ASCII substring techniques to extract table names from information_schema.tables.

Analyze blind boolean techniques in sql injection challenges, especially for get-based queries, and connect to the fundamentals of sql injection through the 130-query challenge.

Explains the no rate limiting vulnerability in a forgot password flow and demonstrates abusing otp delivery by intercepting requests with a proxy, using intruder and sequencer to repeat them.

Demonstrates no rate limiting through live testing of forgot password flows and mail floods, using burp suite, intruder, and sequencer with payloads to reveal vulnerabilities across sites.

Test rate limiting on a login flow by triggering OTP requests and simulating multiple attempts with Burp Suite tools, revealing vulnerabilities when OTPs flood a system.

Demonstrates testing a potential rate-limiting vulnerability on Yammer using Burp Suite, Sequencer, and Intruder; observes only a few password-reset emails, concludes no rate-limiting flaw, and reports to Microsoft for bounty.

Learn to report no rate limiting vulnerabilities in forgot password flows, detailing vulnerability name, impact, reproduction steps using Burp Suite, and a proof of concept with recommendations.

Explore how long passwords can cause cpu and memory exhaustion via hashing, reveal password length vulnerabilities, and enforce practical limits to prevent DDoS and unavailability.

Explore long password ddos attack hunting by testing sign-ups with extremely long passwords to reveal sites with no password length limits and hashing vulnerabilities that can render applications unavailable.

Offensive bug bounty hunter 2 demonstrates a long password DDoS attack against a site using Burp Suite, intercepting requests, and replacing passwords to reveal a vulnerability.

Explore the long password ddos attack by testing apps that accept more than 500 characters, observe symptoms and risks, and verify defenses via live-site interception and validation.

Learn to report vulnerabilities by detailing descriptions, impact, reproduction steps, and recommendations, plus a proof of concept, demonstrated with a DDoS-like unresponsiveness from long passwords.

Explore buffer overflow vulnerabilities that occur when applications copy user input into undersized buffers, risking arbitrary code execution, server crashes, and overflow in stack, heap, integer, and format string scenarios.

Explore stack and heap buffer overflows, including unbounded copies into fixed-size buffers, and examine integer and format string vulnerabilities like return address hijacks.

Explore how a crafted long string in an HTML alert triggers a buffer overflow in a browser, demonstrated with Brave on Linux, and how such vulnerabilities apply to other applications.

Explore Android application bug hunting with dynamic and static code analysis, runtime analysis of traffic and encryption flaws, and secure storage issues, using Burp Suite and SSL pinning bypass techniques.

Intercept mobile app traffic by configuring Burp Suite as a proxy on the emulator, using 192.168.0.10:8080, and installing the Burp CA certificate. Next videos cover Android SSL pinning bypass.

This lecture explains bypassing android ssl pinning and introduces common tools and workflows for inspecting app network traffic.

Shows live Android app hunting with real-time intercepting and forwarding of requests, testing parameter tampering and OTP flows. Reveals rate limiting gaps and unprotected call verification in the payment process.

This lecture reveals an Android app phone-number verification vulnerability and demonstrates how absent rate limiting enables call and SMS spamming using live capture, sequencer, and intruder tools.

Learn Android app hunting techniques, bypass ssl pinning on swiggy, set up a proxy, intercept and forward requests, test login, otp flows, and explore api protections against tampering and csrf.

Join Android app live hunting to uncover IDOR and parameter tampering vulnerabilities, revealing how improper access controls can expose user data, passwords, and OTP leaks in real time.

Explore account takeover via response interception in Android apps, including bypassing SSL pinning, capturing OTP tokens, and using intercepted responses to gain access.

Demonstrates no rate limiting in an Android app by replaying OTP requests, showing how an attacker can spam the server and harm users and resources.

Explore subdomain takeover by showing how DNS pointers to third-party services such as GitHub Pages or Zendesk can be exploited after service removal, enabling an attacker to claim the subdomain.

Learn to hunt hostile subdomain takeovers by enumerating subdomains, identifying inactive or removed ones pointing to third parties, and seizing control via GitHub pages with a custom domain.

Demonstrate hostile subdomain takeover by hijacking a Tumblr subdomain through cPanel settings and domain mapping.

Learn how to set up an AWS S3 bucket, host a static website, map a subdomain with Route 53, and inspect subdomain takeover risks using DNS and CNAME checks.

Demonstrates a subdomain takeover using an AWS S3 bucket by creating a bucket, uploading an index.html, enabling static website hosting, and granting public read access.

The lecture demonstrates subdomain takeover with a live Shopify example, showing how dns records like cname and a records can point to a third-party service and enable takeover.

Explore hostile subdomain takeover with a live demonstration using Cargo Collective, showing how creating an account and mapping a subdomain can lead to unauthorized control.

Identify and test target subdomains by collecting lists, running a takeover script, and analyzing dig and host results, mapping to vulnerable hosts like Tumblr, GitHub, Shopify, or a bucket.

Learn the insecure direct object reference vulnerability, its background concept, and how misused identifiers like user IDs, page IDs, or profile IDs can cause account takeover or data exposure.

Demonstrates idor live hunting 1 by changing a second user’s email via an update request, intercepting with burp, and logging in with the new email to reveal a vulnerability.

Demonstrates idor vulnerability on Woot.com by intercepting and reusing a user id with Burp Suite to edit profile details across accounts.

Explore idor live hunting by demonstrating how manipulating user IDs in profile updates can reveal an idor vulnerability on geek for geeks.org, using intercept with burpsuite.

Explore the Idor vulnerability in a dating app, demonstrating how an attacker can take over accounts by altering email and password through intercepted requests and server updates.

Demonstrates an idor vulnerability in a mobile app by intercepting and manipulating login requests with burp suite, revealing user ids and passwords through forgot login details.

Discover how to identify WordPress vulnerabilities using WPScan, CMS map, and Metasploit, covering subdomain takeover, SQL and remote code execution, user enumeration, brute force, and themes and plugins.

Learn to use WPScan to enumerate WordPress plugins and themes, update its libraries, and scan a site for plugin, theme, and overall vulnerabilities using a single command.

Learn to test WordPress xml-rpc pingback endpoints for vulnerabilities by intercepting requests in Burp Suite, enumerating supported methods like system.listMethods and blogger.getUsersBlogs, and attempting login/password combinations.

Explore how the xml-rpc ping back method enables port scanning and port enumeration, including testing WordPress endpoints and interpreting fault codes to determine open ports.

Explore using WPScan and Burp Suite on WordPress, crafting long password payloads, and reading exploit DB modules while a long password DDoS attack crashes the database.

Explore cms map for testing WordPress and other CMS, locate vulnerabilities such as arbitrary file upload, denial of service, and cross-site scripting using exploit databases.

Hunt a live WordPress site for bugs using Burp Suite and curl, verify xml-rpc and admin.php vulnerabilities, and practice manual and automated testing methods.

Explore live hunting techniques for WordPress vulnerabilities, including xml-rpc pingback, port scanning, and intruder-driven brute force, with practical demonstrations of exploiting and identifying flaws.

Explore CMS scan for WordPress and Drupal, identify xml-rpc exposure, plugin vulnerabilities, and SQL injection, with Metasploit modules and practical brute-force demonstrations.