Ethical Hacking/Pentesting & Bug Bounty Hunting v2 2025

Learn how Burp Suite works as a proxy between client and server to intercept and modify requests and responses, and how to set up the lab and browser proxy.

Identify subdomains and sub-subdomains under a top level domain to expand the bug bounty scope and uncover outdated software on the main domain.

Explore how the domain name system translates hostnames to ip addresses using a and cname records, with practical examples of subdomain redirection.

Learn to identify subdomains, verify Shopify-linked ones, and perform a simulated subdomain takeover using the sublimister tool, after enumerating dns and whois checks in a controlled lab.

Discover findomain, the fastest subdomain enumeration tool for ethical hacking, with quick macOS installation via brew or binary downloads and simple command-line usage for efficient bug bounty recon.

Install and run subfinder, a fast Go subdomain enumerator with concurrency for bug bounty programs, using -d or -dL to target single or multiple domains and save results.

Explore recursive enumeration of subdomains with sub finder, revealing hundreds of sub-subdomains and assets for a target like dev.uber.com, while adjusting threads and silent output for faster, cleaner results.

Explore subdomain takeover risks with can i takeover xyz, learn to identify dangling cname records, apply fingerprints for cloud services, and use censys to verify vulnerable subdomains for responsible disclosure.

The lecture introduces an updated repository of 75 fingerprints for subdomain takeover, distinguishing old and new fingerprints to identify vulnerabilities in dangling cname records across cloud providers.

Identify AWS S3 subdomains and perform a takeover by creating a bucket named after the subdomain, enabling static website hosting, and redirecting to the target domain.

Analyze a bugcrowd report on subdomain takeover of ads.sendgrid.com, highlight bug rating (P2/P3) per vrt, and stress correct AWS S3 region handling to avoid bad requests.

Demonstrates Tumblr subdomain takeover by identifying unclaimed subdomains pointed to Tumblr, validating vulnerability, and executing a proof-of-concept. Concludes with mitigation by deleting or disabling the subdomain after bounty.

Explains subdomain enumeration using Sublister to reveal vulnerable subdomains and demonstrates a Shopify subdomain takeover workflow, including fingerprint patterns and domain claiming steps.

Observe how to perform a cargo subdomain takeover by claiming an unclaimed cargo.hacktify.in site on Cargo. Demonstrate attacker control by presenting a private site and modifying content.

Install subzy with go, supply subdomains or a target file, and scan for subdomain takeover vulnerabilities while adjusting concurrency and filtering to reveal only vulnerable domains.

Demonstrates HTML injection techniques on a lab site by injecting image tags and redirect buttons to attacker-controlled domains, revealing how input reflection enables content loading and phishing-style redirects.

Demonstrates html injection on a live website by inserting html tags like h1 and img src into a search entry, exposing vulnerability and risk to confidentiality and integrity.

Identify click jacking vulnerabilities with an automated iframe-based proof-of-concept test, quickly evaluating targets by loading them into a test page and confirming iframe rendering.

Test a target site for click jacking using security headers dot com, observe a failing grade and missing X-Frame options, and learn how to identify vulnerabilities on the go.

Identify click jacking protections by examining network headers (x-frame-options), iframe restrictions, and security headers on starbucks.in, using tools like the network tab and samy.pl.

Showcases escalating a clickjacking attack by overlaying login fields on a vulnerable site, capturing credentials, and delivering them to the attacker's server using a local PHP setup.

Demonstrates a live clickjacking exploitation against an iframe vulnerable site, creating a proof-of-concept to reveal how weak mitigations expose login credentials.

Explore clickjacking with Burp Suite's Click Bandit to automatically identify vulnerabilities and generate a proof of concept, including iframe-based demonstrations of login, logout, and delete actions.

Discover local file inclusion (lfi) vulnerabilities, distinguish them from path traversal, and learn how attackers inject inputs to read sensitive server files and possibly execute files.

Identify an LFI vulnerability on a test web app by using Burp Suite, spidering endpoints, and verifying vulnerable file parameters. Show how dot-dot-slash reveals etc/passwd.

Identify and exploit LFI vulnerabilities on live targets, using Burp Suite to crawl, repeat requests, and reveal local files like /etc/passwd and /etc/shadow.

Identify and exploit a local file inclusion vulnerability on a live website using Burp Suite, spidering, and crafted payloads to read /etc/passwd and /etc/shadow.

Learn to turn LFI into RCE by exploiting /proc/self/environ, writing a PHP shell via the user agent, and validating bug bounty risks.

Compare local file inclusion and remote file inclusion, showing how LFI reads local files and executes commands while RFI loads remote files and executes commands.

Discover broken link hijacking, a rare vulnerability where a web app loads resources from another server, enabling attackers to claim broken links and impersonate profiles with malicious content.

A security researcher demonstrates broken link hijacking by taking over a company's LinkedIn page and reports the vulnerability for a $500 reward, using blc to identify links.

Explore broken link hijacking and expired link exploitation, including external js file attacks and subdomain takeover, with a hands-on demo using the broken link checker tool (bl).

Demonstrate broken link hijacking that lets an attacker take over a company's Instagram page and redirect users to a fake account, harming reputation and potentially causing monetary losses.

Identify a broken link in a live web application and demonstrate how an attacker can take over a LinkedIn profile URL to impersonate a user, risking organizational security.

Examine a broken link hijacking case on HackerOne where a subdomain takeover of gratipay.piwik.pro occurred due to lingering Piwik Pro scripts, highlighting JavaScript discoveries and bug bounty insights.

Use a free Chrome extension to automatically identify broken links and hidden page sources on target sites, and see how attackers impersonate apps on the Play Store to exploit them.

Demonstrates a live exploitation of broken link hijacking by creating a public AWS S3 bucket, uploading poc files, and turning poc.txt into index.html to hijack links.

Compare spreadsheets and sql databases; highlight spreadsheet limitations such as unorganized data, human error, and difficulty updating large datasets, and preview moving to sql databases in upcoming videos.

Create a database udemy and a notebook table with serial number, name, and attendance, then insert records and practice select * from notebook using int and varchar.

Explore practical SQL queries by selecting records from the Notebook table, using the where clause to filter by attendance, and retrieve present or absent entries.

Perform a hands-on sql lab by creating an employee table with employee_id, employee_name, and employee_department. Insert three records and solve three queries to fetch names, IT staff, and distinct departments.

Practice SQL queries by selecting all records from the employees table, filtering for the IT department with a where clause, and retrieving distinct departments such as finance, IT, and HR.

Explore how logical operators and or use truth tables to evaluate SQL queries on an employee table, illustrating when name Harry and department IT are true.

Learn how a login query fetches user data from a database, validates username and password, and uses the AND operator to grant access, setting up later SQL injection topics.

Explore sql query breakdown and how sql injection can bypass login by using or 1=1 to trick the authentication check and reveal user data.

Learn how sql injection interferes with database queries to retrieve sensitive data, bypass authentication, and potentially execute commands on the server, revealing critical vulnerabilities.

Demonstrates a sql injection payload to bypass authentication by manipulating username and password inputs, using or one equals one and sql comments to render the query true.

Practice SQL injection on a deliberately vulnerable lab to bypass login using a payload like 'password' or one equals one, and analyze syntax errors that reveal the vulnerability.

Solve a sql injection lab from the Port Swigger web security academy, retrieve hidden data by manipulating the where clause in the product category filter, showing released and unreleased products.

Explore a live sqli data retrieval attack, showing how a balanced query retrieves all products from the target database and demonstrates the exploited vulnerability.

Learn how an SQL injection can bypass login authentication to access an administrator account, exploiting a vulnerable login function in a web security lab.

This lecture demonstrates a live SQL injection login bypass on a web application, showing how an admin login is reached with a crafted query and exposes sensitive data.

Install sqlmap from the GitHub repository, then run python sqlmap.py to verify it works. The tool automates sql injection and database decoding to identify vulnerable sites and retrieve data.

Identify and exploit sql injection on a live target using sqlmap, confirming vulnerable parameters and performing banner grabbing, then extract data from ornate_ornate.lito_user, including admin credentials.

Demonstrates using sqlmap to gain a sql shell on a live target, perform banner grabbing, and run safe, non-destructive queries against a MySQL backend.

Explore server side request forgery (ssrf), a common bug that lets attackers induce a vulnerable app to make arbitrary http requests, including internal networks and cloud metadata.

Identify SSRF vulnerabilities by crawling a target web app with Burp Suite, extracting parameters like file, and triggering attacker-controlled server interactions via Burp Collaborator.

Explore ssrf testing without a collaborator by using free third-party listeners like webhook.site, requestbin, and request catcher with burp suite to capture and analyze requests.

Explore ssrf against the server itself by exploiting loopback and localhost requests to access internal admin functionality, bypass authentication, and exfiltrate data using burp suite.

demonstrate an ssrf attack against a separate backend server by scanning an internal network, locating the admin interface on port 8080, and accessing admin privileges to delete a user.

Explore ssrf bypass using whitelist based input filters, showing embedded credentials and double-encoded path fragments to access admin interfaces and bypass anti-ssrf defenses.

Explore how to chain an open redirect into an ssrf by encoding the end parameter to bypass validation, increasing the bounty and enabling admin panel access to delete a user.

Explore ssrf exploitation using an MPEG video payload to exfiltrate sensitive files from a vulnerable web app, demonstrating unauthenticated access, payload generation, and server-side file retrieval.

Demonstrates an ssrf attack against Jira using the vulnerable consumerURI parameter, then chains it with xss to steal cookies in a live practical exploit.

Enumerate subdomains with find domain and subfinder to locate a vulnerable Jira instance, test ssrf through the consumerURI parameter, and chain ssrf with xss to exfiltrate cookies.

breaks down a Facebook SSRF bug report, tracing subdomain discovery on m-nexus, MicroStrategy Web Admin exposure, tinyurl-exploited SSRF, xss and phishing, and sensitive data exposure with a 31500 bounty.

Demonstrates replicating an ssrf vulnerability in a MicroStrategy setup by identifying a redirecting subdomain, validating urls with tinyurl, and loading an xss payload to illustrate credential theft through phishing.

Identify SSRF using PHP filters and Burp Suite, spider and intercept targets, and exfiltrate data with webhook, request catcher, or Pipedream endpoints.

The lecture demonstrates exploiting ssrf to retrieve the WordPress wp-config.php using php filters, revealing database credentials and secret keys, and using dir traversal plus alternative filters to download sensitive files.