The Complete Web Penetration Testing & Bug Bounty Course

Install Kali Linux as a virtual machine to learn the tools used in bug bounty hunting. Skip this section if you already have Kali Linux.

Discover how virtual machines enable you to run Linux, Windows, and other operating systems for safe, recoverable testing in this course, using VirtualBox to create and rebuild environments.

Install VirtualBox on Windows and set up the extension pack, resolve the Visual C++ runtime, and configure a virtual network to connect host and guest machines for testing.

Install VirtualBox on macOS to run Linux VMs for the course, download from virtualbox.org, choose the Intel or Apple Silicon build, and install the extension pack for USB and networking.

Discover how to download and set up Kali Linux for penetration testing, compare major Linux distributions, and configure a VirtualBox lab with 64-bit support.

Learn to install Kali Linux across formats (ova, zip, vdi), unzip, import into VirtualBox, configure network, and log in with Kali or root credentials.

Troubleshoot linux installation issues on Windows by checking free space, enabling virtualization, and BIOS or Hyper-V settings, then choose VirtualBox, VMware, or ISO bare-metal installation.

Learn to install Kali Linux from a manual ISO in VirtualBox by creating a new VM, connecting the ISO, configuring language and keyboard, and completing the installation.

Solve linux installation issues on macs by using UTM instead of VirtualBox, with Intel vs M1 differences, installing Kali Linux from ISO, and configuring storage, memory, and EFI settings.

learn how to use snapshots in virtual machines to save and restore exact system states, compare checkpoints, and revert changes with snapshot one and snapshot two.

Explore Kali Linux fundamentals: navigate the desktop and terminal, adjust display resolution and keyboard settings, understand root versus user access, manage files, ensure internet connectivity, and begin mastering Linux commands.

Navigate the Linux terminal by using pwd, ls, and cd to locate positions and move between directories; create folders with mkdir and files with touch, while exploring the file system.

Move and delete files and folders in the terminal to master navigation, using cp, mv, rm, ls, cd, and less to manage documents and test folders.

Explore root privileges and permissions in Linux using Kali as an example, and learn how the root user can delete, modify, or access files with sudo or sudo su.

Explore the linux folder structure by examining key directories such as bin, dev, etc, var, tmp, home, root, proc, and media to see how binaries and configurations are organized.

Learn linux package managers and use apt to install, search, update, and upgrade tools in Kali Linux, with examples like Wireshark and bettercap.

Learn to use the nano text editor in Linux to view, edit, and save files, explore permissions, and compare nano with cat and vim across distributions.

Learn essential Linux commands like ls -la and ifconfig, and how to change the Kali or root password with passwd, including keyboard considerations and command history tips.

Explore what an EBR website is, how websites work, and learn HDMI fundamentals to support bug bounty hunting in web penetration testing.

Understand what a website is by exploring hosting, IP addresses, and domain basics. Learn how DNS maps domains to public and local IPs, supporting web testing and bug bounty work.

Explore the fundamentals of HTML, a markup language, and learn to read, write, view source, and inspect HTML using editors and browser tools.

Learn HTML basics by declaring doctype, using opening and closing tags, exploring head and body, metadata, and the role of title and utf-8 in web pages.

Explore html fundamentals by examining elements and attributes, from head and body to headers (h1–h3), paragraphs, and breaks, plus class attributes and self-closing tags like br.

Learn to build links with href and target attributes, structure forms with divs, labels, and text or password inputs, use placeholders, and inspect elements for basic pentesting demonstrations.

Learn how to use text areas, images, and basic form elements in HTML, including setting attributes like width and height, and how headers and footers organize page structure.

Explore HTML injection fundamentals by working on a vulnerable machine, including stored HTML injection. Learn hacker attack techniques and useful tools to identify and exploit weaknesses.

Install and configure beebox vulnerable web app in a VirtualBox VM, download and unzip the package, import the VM, and boot for hands-on pentesting of vulnerabilities, including OWASP top 10.

Master Burp Suite setup and browser proxy configuration, install certificates, and start intercepting web traffic to explore vulnerabilities in a buggy web app for hands-on penetration testing.

Explore html injection basics using burp suite, intercepting get and post requests, and testing input fields to reveal reflected xss and javascript payloads.

Explore stored html injection by testing via Burp Suite, intercepting GET and POST requests, and injecting iframes to reveal vulnerable pages and user data.

Explore how HDMI injection form vulnerabilities can capture usernames and passwords through a demo login form, and how ethical testing and bug bounty reporting address these issues.

Learn to discover hidden web pages with DirBuster for directory brute forcing using wordlists. Use Burp Suite to collect interactions, monitor results, and adjust threads for faster testing.

This lecture demonstrates iframe injection and hdmi injection by intercepting post requests with Burp Suite, using door buster to uncover hidden pages, and injecting html to test vulnerabilities.

Continue building the same app as we begin the php injection topic, highlighting the severity of this vulnerability and why it's essential to learn now.

Demonstrate PHP injection via Burp Suite, intercept and modify requests, execute PHP code on the server, reveal sensitive files like /etc/passwd and /etc/shadow, and spawn a shell to explore system.

Explore upload vulnerability by testing unrestricted file uploads and bypassing extension filters. Learn how bhp payloads are deployed to obtain a shell and highlight security hardening.

Learn new techniques and attacks as we continue this section, focusing on command execution and SSI vulnerabilities.

Learn to speed up web penetration testing by using Burp Suite with Foxy Proxy in Firefox, predefining Burp proxy settings and toggling intercept for live testing.

Master os command injection by triggering server-side commands, observing DNS lookups, and testing request parameters with piping and semicolon bypass to obtain a shell.

Use Commix to automate command injection testing and speed up vulnerability discovery, leveraging cookies, Burp Suite data, and in-application inputs to obtain a shell when possible.

Learn about SSI injection, a server side includes vulnerability, by examining how include and execute directives work in SSI and how an attacker can run commands on the server.

Master how to test SSI injection against filters and firewalls by tweaking parameters and comments, using trial and error to reveal what gets blocked or allowed.

Explore directory traversal basics to discover files and folders, and see how these findings can lead to bug bounty submissions.

Expose how directory traversal attacks reveal server files and folders by manipulating url parameters, using Burp Suite with a proxy to intercept requests, and exploring web server directories.

Practice directory traversal to access hidden files on a web server, using dot-dot-slash sequences to locate files and folders, and explore vulnerabilities discussed for next lecture.

Optimize directory traversal testing with the dotdotpwn tool by fuzzing against a host, using HTTP payloads, the SSL option, and a depth of six to reveal vulnerabilities efficiently.

Explore cross-site scripting vulnerabilities in web penetration testing and learn how bug bounty rewards incentivize researchers to uncover them.

Learn about reflected XSS, where injected JavaScript runs in a victim's browser via parameters, and practice payload-based testing to uncover vulnerabilities and earn bug bounty rewards.

Explore reflected ajax xss by testing an ajax json search input that echoes user input in the response. Use Burp Suite proxy to intercept requests, injecting scripts to trigger alerts.

Explore stored cross-site scripting by injecting JavaScript payloads that are saved on the server and executed in a victim's browser, testing different configurations and attack vectors.

Explore broken access control by demonstrating how URL manipulation and cookie tampering can grant admin rights, bypass logouts, and expose session management weaknesses in a web app.

learn how insecure direct object references expose broken access control through user input manipulation, enabling unauthorized secret changes and price tampering in real web app scenarios.

Explore the pacifica dot net lab to study how transcripts reveal other users' chats and passwords. Identify broken access control via transcript endpoints and parameter manipulation that expose unrelated chats.

Explore cross site request forgery (CSRF), install and set up the vulnerable machine for hands-on practice, and begin testing as you progress to more machines later.

Install and configure metasploitable 2 as a vulnerable testing environment, download from SourceForge or RepSeven, import the VM, and enable NAT networking with promiscuous mode for MSF admin.

Log in to Metasploitable and fix a misconfigured DVWA database, then explore multiple vulnerable apps like Mutillidae, DVWA, and Juice Shop to practice bug bounty testing.

Learn how cookies and session data can be forged to impersonate other users by tampering with values like the UI ID, using browser dev tools to inspect storage and cookies.

Explore cross-site request forgery (CSRF) by forging requests, observe cookie-based admin impersonation, and practice with Burp Suite and DVWA to analyze password changes and user registrations.

This lecture demonstrates a simple csrf attack using burp suite, showing how a crafted link and the repeater tool change password parameters and test admin user scenarios.

Explain csrf vulnerability and how attackers leverage a crafted link to change passwords, plus testing approaches and viewing source for secure coding.