BUG BOUNT Y HUNTING COURSE
1 Introduction to Bug Bounty
What is a Bug Bounty Program? Popular Bug Bounty
Platforms Bugcrowd (Demo) HackerOne(Demo)
Benefits of Bug Bounty
Brief About Common Vulnerabilities Hacking Terminologies
CONTENT
TABLE OF
2
Information Gathering Basics
What is Information G athering?
Concept of Digital Footprinting What
Information to gather?
What is Whois Information
Information gathering about People & Organization
G athering Information about Websites
G oogle Dorking & GHDB
Setting Up Labs
3
DVWA Introduction & C onfiguration bWAPP
Introduction & C onfiguration
Introduction to Burp Suite
4
Introduction to Burp Suite
Steps to C onfigure (Demo)
SQL Injection
5
Introduction to SQL Writing Basic
SQL Query
Different types of comments used in SQL
BUG BOUNT Y HUNTING COURSE
SQLi Introduction & Impact
Union Based SQLi (Demo)
Boolean Based SQli
Time Based SQLi
6 Web Application Attacks
Validation Bypass (Client and Server)
IDOR Vulnerability
IDOR on bWAPP
Rate Limiting Flaw
File Upload Vulnerability
File Upload on DVWA
Live IDOR POC
Live Rate Limiting Flaw POC
7 Cross site Script
What Is C ross Site Scripting(XSS)? Stored
XSS
Stored XSS (DVWA)
Reflected XSS Reflected XSS
(DVWA)
DOM based XSS Blind
XSS
Live XSS PO C
Header Injection & URL Redirection
8
Host Header Injection methods & URL redirection
Live Host Header Injection POC
Live URL Redirection PO C
BUG BOUNT Y HUNTING COURSE
9 Client Side Attack
Understanding Session, Cookies & Session Fixation Forced
Browsing
C ross Site Request Forgery Introduction
CSRF Attack(DVWA)
Open Redirections
Personally Identifiable Information (PII) Leakage
Sensitive Information Disclosure
Live CSRF PO C
Live Sensitive Information PO C Live
Session Fixation PO C
Brute Forcing
10
Brief about Brute Force
Brute Force (DVWA)
Live OTP Brute Force PO C
Security Misconfigurations &
Exploiting Web Apps
11
Security Misconfigurations & Improper File Handling
Guessing Weak Passwords
Live SPF Record Missing PO C
Insecure CORS
12
C oncept about C ORS
File Inclusion
13
Local File Inclusion
Remote File Inclusion
File Inclusion (DVWA)
Live LFI PO C
BUG BOUNT Y HUNTING COURSE
14 Server-Side Request Forgery
What is SSRF?
Insecure Captcha
15
Brief about Insecure C aptcha
Live C aptcha Bypass PO C
Automating VAPT & Advanced Information
16 Gathering
Introduction to Automated VAPT & Advance Level
Information G athering
Documenting & Reporting Vulnerability
17
Introduction to VAPT Reporting
Conclusion
18
Conclusion of Bug Bounty
