The Ultimate Web Application Bug Bounty Hunting Course

Explore cross-site scripting methodologies, including reflected, stored, and DOM XSS. Test every parameter and header, uncover hidden inputs, and apply payloads and encodings to identify bug bounty-worthy flaws.

Examine a dom cross-site scripting vulnerability in a jQuery selector sink triggered by a hashchange event, showing how location hash input can inject and execute a payload.

Explore reflected XSS in HTML attributes with angle-bracket encoding, learn how to break out of value attributes using quotes and inject event handlers to trigger alerts, and understand defense implications.

Analyze a stored cross-site scripting vulnerability in the anchor href attribute with double-quoted HTML encoding, demonstrated by submitting a comment that triggers a JavaScript alert.

Demonstrates reflected cross-site scripting in a JavaScript string with encoded angle brackets within a search query. Shows how to break out of a variable to execute a payload in code.

Explore reflected XSS using SVG markup, brute-forcing SVG tags and events (like animate transform) to trigger alerts, with Burp intruder and URL decoding.

Explore a stored XSS vulnerability where input is reflected in an onclick event; learn how HTML encoding can bypass filters to trigger a JavaScript alert.

Master csrf basics, including token protection, referer checks, and clickjacking defenses, and learn practical testing for get and post requests and related payloads.

Demonstrate a cross-site request forgery with no protections, where an attacker changes a victim's email via an attack server and auto-submitted requests. This enables account takeover via password reset.

Expose how a CSRF key tied to a non-session cookie enables cross-site request forgery and demonstrate a proof-of-concept attack reusing tokens across accounts via cookie injection.

Demonstrate bypassing same-site lax cookies using a method override to trigger a CSRF attack, highlighting get versus post requests and practical lab exploitation.

Learn how SameSite strict cookies defend against CSRF, analyze secure and HttpOnly attributes, and explore a client-side redirect vulnerability to bypass strict protections in a controlled lab.

Demonstrate open redirect and reflected cross-site scripting vulnerabilities, guided by robots.txt signals and a return URL parameter, with Burp to craft payloads that trigger script execution.

Analyze an open redirect vulnerability that enables local redirects. Learn how a forward slash, a tab, and a second slash bypass filters to reach external sites.

Identify an unprotected admin panel via robots.txt hints, access it without authentication, and delete the user Carlos to complete the lab.

Explore horizontal privilege escalation through a user id parameter vulnerability, retrieving another user's API key by manipulating the id in a get request after logging in.

Explore how unpredictable queue IDs and user ID parameters enable access control bypass and reveal API keys through leaked blog posts and profile links for bug bounty learning.

Demonstrate bypassing URL-based access control by manipulating the original URL header to reach the admin panel, then delete a user via a crafted admin/delete request with username, using Burp Suite.

Learn how method-based access control can be circumvented by swapping session cookies and changing http methods, upgrading a normal user to admin, then testing unauthorized actions in a lab.

Examine a referer-based access control flaw in the lab, showing how relying on the referrer header can let a non-admin user replay a request and gain admin privileges.

Learn how to identify and exploit server-side request forgery (SSRF) by tricking apps to call internal resources using local URLs, bypass filters, and test with open redirects and headers.

Explore server-side request forgery against internal systems by locating an internal admin interface at 1921680.118 on port 8080 and deleting a user.

Explore a SQL injection vulnerability that allows login bypass in a web app, highlighting how missing parameterized queries and prepared statements enable attackers to bypass authentication.

Explore blind SQL injection with conditional errors using tracking id cookies, case statements, and boolean logic to reveal the administrator password via SQL map and Burp Intruder.

Explore SQL injection with filter bypass via XML encoding, showing how a web application firewall can be bypassed by encoding payloads in hex entities and testing the stock check feature.

Demonstrates a visible error-based SQL injection lab, exploiting a tracking cookie vulnerability to extract the administrator password from a users table, using limit 1 to retrieve credentials.

Perform a blind OS command injection lab to exfiltrate command output via out-of-band data, using nslookup with backticks to append whoami output to a collaborator domain.

Master insecure direct object references (IDOR) and missing authorization checks that enable read, update, and delete of others’ data. Identify IDs, usernames, and API parameters, and enumerate with two accounts.

Explain how IDOR vulnerabilities expose personal data by abusing sequential numeric appointment IDs, enabling access to other users’ PII and highlighting authorization flaws and brute-force risks.

This lab demonstrates an idor vulnerability exposing user information via a get request. Manipulating the user id in the endpoint reveals names, emails, usernames, and admin status, highlighting information disclosure.

Exploit xml external entity vulnerabilities (xxe) in a stock-check feature that parses xml inputs. Exfiltrate the /etc/passwd file using an external entity payload and reveal sensitive data.