Learn Bug Bounty Hunting & Web Security Testing From Scratch

欢迎来到我的漏洞赏金狩猎和网络安全测试综合课程。本课程假设您没有任何先验知识，它从零开始，逐步带您进入高级水平，能够发现任何 Web 应用程序中的大量错误或漏洞（包括 OWASP 前 10 名）它使用的技术或运行它的云服务器。

本课程实用性很强，但不会忽视理论，我们将从基础开始，教您网站的工作原理、使用的技术以及这些技术如何协同工作以产生我们日常使用的这些漂亮而实用的平台。然后我们将立即开始黑客攻击和漏洞搜索。通过发现安全漏洞和漏洞，您将通过示例学习所有内容，而不是枯燥乏味的讲座。

本课程分为多个部分，每个部分旨在从 OWASP 最常见的 10 个安全威胁中教您一个常见的安全漏洞或漏洞。每个部分都将带您通过一些动手示例来教您安全错误或漏洞的原因以及如何在从简单到高级的多种场景中发现它。您还将学习绕过过滤器和安全措施的高级技术。在此过程中，我还将向您介绍不同的黑客和安全概念、工具和技术。一切都将通过示例和动手实践来教授，不会有无用或无聊的讲座！

在课程结束时，我将带您完成两个小时的渗透测试或错误搜索，向您展示如何结合您获得的知识并将其应用于现实生活场景中，以发现真实网站中的错误和漏洞！我将向您展示我如何接近目标、分析目标并将其拆开，以发现大多数人认为安全的功能中的错误和漏洞！

如前所述，您将学到的不仅仅是如何在本课程中发现安全漏洞，这里列出了本课程将涵盖的主要安全漏洞和漏洞

Learn how to discover bugs / vulnerabilities like experts | OWASP top 10 + more | No prior knowledge required

Published 10/2022
MP4 | Video: h264, 1280×720 | Audio: AAC, 44.1 KHz, 2 Ch
Genre: eLearning | Language: English | Duration: 96 lectures (10h 59m) | Size: 8.1 GB

What you’ll learn

95+ videos to teach you bug hunting & security testing from scratch.
80+ hands-on real-life examples – from simple to advanced.
Discover the most common web application bugs and vulnerabilities.
Discover bugs from the OWASP top 10 most common security threats.
Bypass filters & security on all of the covered bugs & vulnerabilities.
2 Hour LIVE bug hunt / pentest on a real web application at the end of the course.
My approach to bug hunting and web application penetration testing.
The bug hunter / hacker mentality.
Efficiency use Burp Suite to discover bugs and vulnerabilities.
Discover sensitive & hidden information, paths, files, endpoints and subdomains
Gather information about websites & applications
Essential topics to bounty hunting.
HTTP methods & status codes.
Cookies & cookie manipulation
HTML basics for bug hunting.
XML basics for bug hunting.
Javascript basics for bug hunting.
Read & analyse headers, requests and responses
Discover information disclosure vulnerabilities.
Discover broken access control vulnerabiltiies.
Discover path / directory traversal vulnerabilities.
Discover CSRF vulnerabilities.
Discover IDOR vulnerabilities
Discover OAUTH 2.0 vulnerabilities
Discover Injection vulnerabilities.
Discover Command Injection vulnerabilities
Discover HTML Injection vulnerabilities
Discover XSS vulnerabilities (Reflected, Stored & DOM).
Advanced XSS discovery & bypass techniques
Discover SQL Injection vulnerabilities.
Discover Blind SQL Injection vulnerabilities.
Discover Time-based blind SQL Injection vulnerabilities.
Discover SSRF vulnerabilities.
Discover blind SSRF vulnerabilities.
Discover XXE vulnerabilities.
The Burp Suite Proxy.
The Burp Suite Repeater.
The Burp Suite Filter
The Burp Suite Intruder.
The Burp Suite Collaborator.

Requirements

Basic IT Skills
No prior knowledge required in bug hunting, hacking or programming.
Computer with a minimum of 4GB ram/memory.
Operating System: Windows / Apple Mac OS / Linux.

Description

Welcome to my comprehensive course on Bug Bounty Hunting & Web Security Testing course. This course assumes you have NO prior knowledge, it starts with you from scratch and takes you step-by-step to an advanced level, able to discover a large number of bugs or vulnerabilities (including the OWASP top 10) in any web application regardless of the technologies used in it or the cloud servers that it runs on.

This course is highly practical but doesn’t neglect the theory, we’ll start with basics to teach you how websites work, the technologies used and how these technologies work together to produce these nice and functional platforms that we use everyday. Then we’ll start hacking and bug hunting straight away. You’ll learn everything by example, by discovering security bugs and vulnerabilities, no boring dry lectures.

The course is divided into a number of sections, each aims to teach you a common security bug or vulnerability from the OWASP top 10 most common security threats. Each section takes you through a number of hands-on examples to teach you the cause of the security bug or vulnerability and how to discover it in a number of scenarios, from simple to advanced. You’ll also learn advanced techniques to bypass filters and security measures. As we do this I will also introduce you to different hacking and security concepts, tools and techniques. Everything will be taught through examples and hands-on practicals, there will be no useless or boring lectures!

At the end of the course I will take you through a two hour pentest or bug hunt to show you how to combine the knowledge that you acquired and employ it in a real-life scenario to discover bugs and vulnerabilities in a real website! I will show you how I approach a target, analyse it, and take it apart to discover bugs and vulnerabilities in features that most would think are secure!

As mentioned you’ll learn much more than just how to discover security bugs in this course, but here’s a list of the main security bugs and vulnerabilities that will be covered in the course

Information Disclosure.

IDOR (Insecure Direct Object Reference).

Broken Access Control.

Directory / Path Traversal.

Cookie Manipulation.

CSRF (Client-Side Request Forgery).

OAUTH 2.0.

Injection Vulnerabilities.

Command Injection.

Blind Command Injection.

HTML Injection.

XSS (Cross-Site Scripting).

Reflected, Stored & DOM Based XSS.

Bypassing Security Filters.

Bypassing CSP (Content Security Policy).

SQL Injection.

Blind SQLi.

Time-based Blind SQLi.

SSRRF (Server-Side Request Forgery).

Blind SSRF.

XXE (XML External Entity) Injection.

Topics

Information gathering.

End point discovery.

HTTP Headers.

HTTP status codes.

HTTP methods.

Input parameters.

Cookies.

HTML basics for bug hunting.

Javascript basics for bug hunting.

XML basics for bug hunting.

Filtering methods.

Bypassing blacklists & whitelists.

Bug hunting and research.

Hidden paths discovery.

Code analyses.

You’ll use the following tools to achieve the above

Ferox Buster.

WSL.

Dev tools.

Burp Suite

Basics.

Burp Proxy.

Intruder (Simple & Cluster-bomb).

Repeater.

Collaborator.

With this course you’ll get 24/7 support, so if you have any questions you can post them in the Q&A section and we’ll respond to you within 15 hours.

Checkout the curriculum and the course teaser for more info!

Who this course is for
Anybody looking to become a bug bounty hunter.
Anybody interested in web application hacking / penetration testing.
Anybody interested in learning how to secure websites & web applications from hackers.
Web developers so they can create secure web application & secure their existing ones.
Web admins so they can secure their websites.