Website Hacking & Penetration Testing (BUG BOUNTY)

Learn to install XAMPP on Windows, set up DVWA in the htdocs directory, configure MySQL, and access the DVWA login at localhost to study web application hacking techniques.

Install the free burp suite proxy to capture web traffic and use tools like repeater for manual testing and request modification, with setup covering download and startup.

Configure burp suite proxy by setting localhost 127.0.0.1 and port 8080 in the browser, add a dot after localhost, activate intercept, and reload to capture and modify requests.

Export the Burp certificate in DER format and import it into your browser to enable HTTPS traffic capture, then reload Google.com to intercept both HTTP and HTTPS requests.

Install python 2.7 on windows to run hacking tools. Add python to the system path and verify the setup by running python from the command line.

Install and use the Vega web application vulnerability scanner to test web app security, identifying SQL injections, cross-site scripting, and other vulnerabilities with an automated, easy-to-use tool.

Switch the DVWA security level from impossible to low to make the web application hackable and test different vulnerabilities.

Learn information gathering for websites by performing whois lookups to uncover domain owner contact information, registrant data, and name servers, and understand how this data can enable social engineering.

Learn to identify the technologies a target website uses by leveraging Netcraft site report and the Wappalyzer extension, then choose testing methods for bug bounty pen testing.

Discover how to find subdomains for penetration testing and assess security across distinct scripts and services. Use Netcraft and subdomain search techniques to map subdomain inventories and identify vulnerable areas.

Learn how cross-site scripting (XSS) works by injecting JavaScript into user comments, demonstrating how unfiltered input can steal cookies and hijack user sessions.

Demonstrates stored cross-site scripting vulnerability in a sign form that stores input in a database. Shows injecting script tags and a JavaScript alert to prove stored XSS and unfiltered input.

Explore reflected cross-site scripting (XSS) vulnerabilities where user input echoed in responses is not stored, demonstrated by injecting HTML and JavaScript via crafted requests.

Learn how CSRF attacks force authenticated users to perform unintended actions by crafting URLs and exploiting get requests through social engineering to publish posts from victims’ accounts.

Demonstrate the cross-site request forgery vulnerability in DVWA by showing how missing tokens enable a password change. Use Burp Suite to intercept, modify, and reproduce the attack flow.

This lesson demonstrates how SQL injection works on a vulnerable banking app, showing how a single quote can break the MySQL query and bypass login authentication.

Learn how a sql injection vulnerability in a user id input allows manual sql injection to reveal database name, version, current user, and admin passwords.

Explore how command execution occurs when unfiltered inputs feed shell commands, including PHP vulnerabilities, examples like domain queries, and the risk of exposing sensitive data such as /etc/passwd.

demonstrate a command execution vulnerability in DVWA by testing input-based command injection, using ping and dir to verify results, and chaining commands with operators to write a file via echo.

Investigate file upload vulnerabilities using an image upload form and learn how uploading a malicious php file can execute commands on the server and compromise it.

Learn how to generate a PHP backdoor using Weevely to take control of a targeted server, including installation, usage, and commands for system info and file listing.

This lecture demonstrates brute force attacks on a DVWA login form, using Burp Suite and Intruder to capture requests and test password lists.

Learn to generate custom wordlists for password cracking with crunch, setting minimum and maximum lengths, choosing character sets, and saving the output to files for targeted brute-force scenarios.

Demonstrate a real world brute force attack on a router using the Hydra tool to test web login credentials and reveal security weaknesses when logins aren't blocked.