The Ultimate Web Application Bug Bounty Hunting Course

Explore cross-site scripting methodologies, including reflected, stored, and DOM XSS. Test every parameter and header, uncover hidden inputs, and apply payloads and encodings to identify bug bounty-worthy flaws.

Explore a simple reflected cross-site scripting vulnerability in a blog's search feature, where unencoded input is reflected in HTML and triggers a JavaScript alert for web application bug bounty hunting.

Examine a dom cross-site scripting vulnerability in a jQuery selector sink triggered by a hashchange event, showing how location hash input can inject and execute a payload.

Explore reflected XSS in HTML attributes with angle-bracket encoding, learn how to break out of value attributes using quotes and inject event handlers to trigger alerts, and understand defense implications.

Analyze a stored cross-site scripting vulnerability in the anchor href attribute with double-quoted HTML encoding, demonstrated by submitting a comment that triggers a JavaScript alert.

Demonstrates reflected cross-site scripting in a JavaScript string with encoded angle brackets within a search query. Shows how to break out of a variable to execute a payload in code.

Discover how reflected dom xss can arise from untrusted user input in a source-to-sink workflow, exposing insecure eval usage and payload execution in a json response.

Explore how cross-site scripting enables a csrf attack to take over an account by exfiltrating a csrf token and changing a victim's email via dynamic payloads.

Explore reflected XSS using SVG markup, brute-forcing SVG tags and events (like animate transform) to trigger alerts, with Burp intruder and URL decoding.

Explore a lab on reflected cross-site scripting in a canonical link tag, showing how escaped input can be bypassed with an access key and onClick to trigger an alert.

Demonstrate reflected cross-site scripting in a JavaScript string by escaping the single quote and the backslash, then exploit a vulnerable script string with injected script tags to execute code.

Learn how to test reflected XSS in a JavaScript string by HTML-encoding angle brackets and double quotes, handle escaping, and bypass filters to execute a payload via Burp Repeater.

Explore a stored XSS vulnerability where input is reflected in an onclick event; learn how HTML encoding can bypass filters to trigger a JavaScript alert.

Demonstrate exploiting a reflected cross-site scripting vulnerability in a JavaScript template literal by bypassing filters and delivering payloads via unsanitized input, triggering code execution in a script tag.

Master csrf basics, including token protection, referer checks, and clickjacking defenses, and learn practical testing for get and post requests and related payloads.

Demonstrate a cross-site request forgery with no protections, where an attacker changes a victim's email via an attack server and auto-submitted requests. This enables account takeover via password reset.

Demonstrate cross-site request forgery with a token not tied to a user session, showing how an attacker reuses a csrf token to change another user's email.

Expose how a CSRF key tied to a non-session cookie enables cross-site request forgery and demonstrate a proof-of-concept attack reusing tokens across accounts via cookie injection.

Demonstrate bypassing same-site lax cookies using a method override to trigger a CSRF attack, highlighting get versus post requests and practical lab exploitation.

Learn how SameSite strict cookies defend against CSRF, analyze secure and HttpOnly attributes, and explore a client-side redirect vulnerability to bypass strict protections in a controlled lab.

Demonstrate a same-site strict bypass via a sibling domain to enable cross-site WebSocket hijacking and exfiltrate chat history and credentials using a crafted login payload.

Learn how SameSite lax cookies can be bypassed by refreshing the auth cookie within the first 120 seconds of login, enabling a CSRF attack via OAuth and a post request.

Demonstrate a CSRF vulnerability through broken referrer validation by manipulating the referer header, crafting a pushState payload, and bypassing protections with a referrer policy workaround.

Demonstrate open redirect and reflected cross-site scripting vulnerabilities, guided by robots.txt signals and a return URL parameter, with Burp to craft payloads that trigger script execution.

Analyze an open redirect vulnerability that enables local redirects. Learn how a forward slash, a tab, and a second slash bypass filters to reach external sites.

Demonstrates how an open redirect can be chained with other vulnerabilities to exfiltrate an admin access token by manipulating redirect parameters and cookies, revealing token leakage through access logs.

Explore broken access control and OWASP top ten threats, mastering horizontal and vertical privilege escalation, indirect object references, and thorough testing of unauthenticated and authenticated users across endpoints.

Identify an unprotected admin panel via robots.txt hints, access it without authentication, and delete the user Carlos to complete the lab.

Expose the unprotected admin functionality with an unpredictable URL by inspecting the source and hidden links, and use burp repeater to locate the admin path such as /admin-1EMUHN.

Explore how a forgeable admin cookie controls user roles, enabling access to the admin panel by manipulating the cookie and setting admin to true.

Explore horizontal privilege escalation through a user id parameter vulnerability, retrieving another user's API key by manipulating the id in a get request after logging in.

Explore how unpredictable queue IDs and user ID parameters enable access control bypass and reveal API keys through leaked blog posts and profile links for bug bounty learning.

Expose an access control vulnerability where the user id is controlled by a request parameter, leaking an API key in a 302 redirect during profile access.

Demonstrate bypassing URL-based access control by manipulating the original URL header to reach the admin panel, then delete a user via a crafted admin/delete request with username, using Burp Suite.

Learn how method-based access control can be circumvented by swapping session cookies and changing http methods, upgrading a normal user to admin, then testing unauthorized actions in a lab.

Examine a referer-based access control flaw in the lab, showing how relying on the referrer header can let a non-admin user replay a request and gain admin privileges.

Learn how to identify and exploit server-side request forgery (SSRF) by tricking apps to call internal resources using local URLs, bypass filters, and test with open redirects and headers.

Demonstrate basic server side request forgery against the local server by manipulating the stock check feature to access the admin interface and delete the user Carlos.

Explore server-side request forgery against internal systems by locating an internal admin interface at 1921680.118 on port 8080 and deleting a user.

Explore a SQL injection vulnerability that allows login bypass in a web app, highlighting how missing parameterized queries and prepared statements enable attackers to bypass authentication.

Explore sql injection techniques using union select to retrieve multiple values into a single column. The lab demonstrates concatenating usernames and passwords to output a single column and verify vulnerability.

Enumerate non-oracle databases by querying information_schema to list tables and columns, discover the users table, and extract usernames and passwords via union select.

Explore an Oracle SQL injection attack that lists database contents and, using all_tables and all_tab_columns, reveals the users table and extracts the username and password columns.

Explore blind sql injection with conditional responses by analyzing a tracking id cookie vulnerability, using boolean-based conditions to reveal the administrator password and demonstrate sql map automation.

Explore blind SQL injection with conditional errors using tracking id cookies, case statements, and boolean logic to reveal the administrator password via SQL map and Burp Intruder.

Explore blind SQL injection with time delays in a bug bounty context, using PostgreSQL sleep delays to prove vulnerabilities without data dumps by manipulating a tracking cookie.

Explore blind sql injection with out-of-band interaction using Burp collaborator to trigger external entity calls against an Oracle database and observe dns lookups for evidence.

Demonstrates blind sql injection with out-of-band data exfiltration, using a burp collaborator to exfiltrate the administrator password from an Oracle database.

Explore SQL injection with filter bypass via XML encoding, showing how a web application firewall can be bypassed by encoding payloads in hex entities and testing the stock check feature.

Demonstrates a visible error-based SQL injection lab, exploiting a tracking cookie vulnerability to extract the administrator password from a users table, using limit 1 to retrieve credentials.

Learn how to detect OS command injection vulnerabilities by testing inputs across parameters with safe commands like sleep, avoiding destructive actions, and comparing Linux and Windows behavior.

Explore an OS command injection vulnerability in a shopping app, where unsafely passed user input executes system commands (whoami, ls, id) via Burp Repeater, exposing potential privilege escalation.

Test blind os command injection with time delays by injecting into the email parameter via a command separator, triggering a ten second ping to 127.0.0.1 and confirming the vulnerability.

Perform a blind OS command injection lab to exfiltrate command output via out-of-band data, using nslookup with backticks to append whoami output to a collaborator domain.

Master insecure direct object references (IDOR) and missing authorization checks that enable read, update, and delete of others’ data. Identify IDs, usernames, and API parameters, and enumerate with two accounts.

Explain how IDOR vulnerabilities expose personal data by abusing sequential numeric appointment IDs, enabling access to other users’ PII and highlighting authorization flaws and brute-force risks.

Explore idor vulnerabilities and cross-site scripting on a restaurant ordering interface by brute-forcing order IDs and reflecting unsanitized input to reveal unauthenticated access and script execution.

This lab demonstrates an idor vulnerability exposing user information via a get request. Manipulating the user id in the endpoint reveals names, emails, usernames, and admin status, highlighting information disclosure.

Explore xml external entity (xxe) injection, its attack vectors, testing points in xml input and json endpoints, and practical exfiltration methods using burp collaborator and svg payloads.

Exploit xml external entity vulnerabilities (xxe) in a stock-check feature that parses xml inputs. Exfiltrate the /etc/passwd file using an external entity payload and reveal sensitive data.

Learn how to exploit external entity injection to trigger SSRF and exfiltrate secrets like access keys from an AWS EC2 metadata endpoint via an XML attack.

This lab demonstrates exploiting blind XXY via a malicious external DTD to exfiltrate data from a Linux host's /etc/hostname, using external entities and a collaborator to retrieve the information.