- Title Page
- Copyright
- About the Author
- Foreword
- Introduction
- Part I: The Industry
- Chapter 1: Picking a Bug Bounty Program
- The State of the Industry
- Asset Types
- Social Sites and Applications
- General Web Applications
- Mobile Applications (Android, iOS, and Windows)
- APIs
- Source Code and Executables
- Hardware and IoT
- Bug Bounty Platforms
- The Pros . . .
- . . . and the Cons
- Scope, Payouts, and Response Times
- Program Scope
- Payout Amounts
- Response Time
- Private Programs
- Choosing the Right Program
- A Quick Comparison of Popular Programs
- Chapter 2: Sustaining Your Success
- Writing a Good Report
- Step 1: Craft a Descriptive Title
- Step 2: Provide a Clear Summary
- Step 3: Include a Severity Assessment
- Step 4: Give Clear Steps to Reproduce
- Step 5: Provide a Proof of Concept
- Step 6: Describe the Impact and Attack Scenarios
- Step 7: Recommend Possible Mitigations
- Step 8: Validate the Report
- Additional Tips for Writing Better Reports
- Building a Relationship with the Development Team
- Understanding Report States
- Dealing with Conflict
- Building a Partnership
- Understanding Why You’re Failing
- Why You’re Not Finding Bugs
- Why Your Reports Get Dismissed
- What to Do When You’re Stuck
- Step 1: Take a Break!
- Step 2: Build Your Skill Set
- Step 3: Gain a Fresh Perspective
- Lastly, a Few Words of Experience
- Part II: Getting Started
- Chapter 3: How the Internet Works
- The Client-Server Model
- The Domain Name System
- Internet Ports
- HTTP Requests and Responses
- Internet Security Controls
- Content Encoding
- Session Management and HTTP Cookies
- Token-Based Authentication
- JSON Web Tokens
- The Same-Origin Policy
- Learn to Program
- Chapter 4: Environmental Setup and Traffic Interception
- Choosing an Operating System
- Setting Up the Essentials: A Browser and a Proxy
- Opening the Embedded Browser
- Setting Up Firefox
- Setting Up Burp
- Using Burp
- The Proxy
- The Intruder
- The Repeater
- The Decoder
- The Comparer
- Saving Burp Requests
- A Final Note on . . . Taking Notes
- Chapter 5: Web Hacking Reconnaissance
- Manually Walking Through the Target
- Google Dorking
- Scope Discovery
- WHOIS and Reverse WHOIS
- IP Addresses
- Certificate Parsing
- Subdomain Enumeration
- Service Enumeration
- Directory Brute-Forcing
- Spidering the Site
- Third-Party Hosting
- GitHub Recon
- Other Sneaky OSINT Techniques
- Tech Stack Fingerprinting
- Writing Your Own Recon Scripts
- Understanding Bash Scripting Basics
- Saving Tool Output to a File
- Adding the Date of the Scan to the Output
- Adding Options to Choose the Tools to Run
- Running Additional Tools
- Parsing the Results
- Building a Master Report
- Scanning Multiple Domains
- Writing a Function Library
- Building Interactive Programs
- Using Special Variables and Characters
- Scheduling Automatic Scans
- A Note on Recon APIs
- Start Hacking!
- Tools Mentioned in This Chapter
- Scope Discovery
- OSINT
- Tech Stack Fingerprinting
- Automation
- Part III: Web Vulnerabilities
- Chapter 6: Cross-Site Scripting
- Mechanisms
- Types of XSS
- Stored XSS
- Blind XSS
- Reflected XSS
- DOM-Based XSS
- Self-XSS
- Prevention
- Hunting for XSS
- Step 1: Look for Input Opportunities
- Step 2: Insert Payloads
- Step 3: Confirm the Impact
- Bypassing XSS Protection
- Alternative JavaScript Syntax
- Capitalization and Encoding
- Filter Logic Errors
- Escalating the Attack
- Automating XSS Hunting
- Finding Your First XSS!
- Chapter 7: Open Redirects
- Mechanisms
- Prevention
- Hunting for Open Redirects
- Step 1: Look for Redirect Parameters
- Step 2: Use Google Dorks to Find Additional Redirect Parameters
- Step 3: Test for Parameter-Based Open Redirects
- Step 4: Test for Referer-Based Open Redirects
- Bypassing Open-Redirect Protection
- Using Browser Autocorrect
- Exploiting Flawed Validator Logic
- Using Data URLs
- Exploiting URL Decoding
- Combining Exploit Techniques
- Escalating the Attack
- Finding Your First Open Redirect!
- Chapter 8: Clickjacking
- Mechanisms
- Prevention
- Hunting for Clickjacking
- Step 1: Look for State-Changing Actions
- Step 2: Check the Response Headers
- Step 3: Confirm the Vulnerability
- Bypassing Protections
- Escalating the Attack
- A Note on Delivering the Clickjacking Payload
- Finding Your First Clickjacking Vulnerability!
- Chapter 9: Cross-Site Request Forgery
- Mechanisms
- Prevention
- Hunting for CSRFs
- Step 1: Spot State-Changing Actions
- Step 2: Look for a Lack of CSRF Protections
- Step 3: Confirm the Vulnerability
- Bypassing CSRF Protection
- Exploit Clickjacking
- Change the Request Method
- Bypass CSRF Tokens Stored on the Server
- Bypass Double-Submit CSRF Tokens
- Bypass CSRF Referer Header Check
- Bypass CSRF Protection by Using XSS
- Escalating the Attack
- Leak User Information by Using CSRF
- Create Stored Self-XSS by Using CSRF
- Take Over User Accounts by Using CSRF
- Delivering the CSRF Payload
- Finding Your First CSRF!
- Chapter 10: Insecure Direct Object References
- Mechanisms
- Prevention
- Hunting for IDORs
- Step 1: Create Two Accounts
- Step 2: Discover Features
- Step 3: Capture Requests
- Step 4: Change the IDs
- Bypassing IDOR Protection
- Encoded IDs and Hashed IDs
- Leaked IDs
- Offer the Application an ID, Even If It Doesn’t Ask for One
- Keep an Eye Out for Blind IDORs
- Change the Request Method
- Change the Requested File Type
- Escalating the Attack
- Automating the Attack
- Finding Your First IDOR!
- Chapter 11: SQL Injection
- Mechanisms
- Injecting Code into SQL Queries
- Using Second-Order SQL Injections
- Prevention
- Hunting for SQL Injections
- Step 1: Look for Classic SQL Injections
- Step 2: Look for Blind SQL Injections
- Step 3: Exfiltrate Information by Using SQL Injections
- Step 4: Look for NoSQL Injections
- Escalating the Attack
- Learn About the Database
- Gain a Web Shell
- Automating SQL Injections
- Finding Your First SQL Injection!
- Chapter 12: Race Conditions
- Mechanisms
- When a Race Condition Becomes a Vulnerability
- Prevention
- Hunting for Race Conditions
- Step 1: Find Features Prone to Race Conditions
- Step 2: Send Simultaneous Requests
- Step 3: Check the Results
- Step 4: Create a Proof of Concept
- Escalating Race Conditions
- Finding Your First Race Condition!
- Chapter 13: Server-Side Request Forgery
- Mechanisms
- Prevention
- Hunting for SSRFs
- Step 1: Spot Features Prone to SSRFs
- Step 2: Provide Potentially Vulnerable Endpoints with Internal URLs
- Step 3: Check the Results
- Bypassing SSRF Protection
- Bypass Allowlists
- Bypass Blocklists
- Escalating the Attack
- Perform Network Scanning
- Pull Instance Metadata
- Exploit Blind SSRFs
- Attack the Network
- Finding Your First SSRF!
- Chapter 14: Insecure Deserialization
- Mechanisms
- PHP
- Java
- Prevention
- Hunting for Insecure Deserialization
- Escalating the Attack
- Finding Your First Insecure Deserialization!
- Chapter 15: XML External Entity
- Mechanisms
- Prevention
- Hunting for XXEs
- Step 1: Find XML Data Entry Points
- Step 2: Test for Classic XXE
- Step 3: Test for Blind XXE
- Step 4: Embed XXE Payloads in Different File Types
- Step 5: Test for XInclude Attacks
- Escalating the Attack
- Reading Files
- Launching an SSRF
- Using Blind XXEs
- Performing Denial-of-Service Attacks
- More About Data Exfiltration Using XXEs
- Finding Your First XXE!
- Chapter 16: Template Injection
- Mechanisms
- Template Engines
- Injecting Template Code
- Prevention
- Hunting for Template Injection
- Step 1: Look for User-Input Locations
- Step 2: Detect Template Injection by Submitting Test Payloads
- Step 3: Determine the Template Engine in Use
- Escalating the Attack
- Searching for System Access via Python Code
- Escaping the Sandbox by Using Python Built-in Functions
- Submitting Payloads for Testing
- Automating Template Injection
- Finding Your First Template Injection!
- Chapter 17: Application Logic Errors and Broken Access Control
- Application Logic Errors
- Broken Access Control
- Exposed Admin Panels
- Directory Traversal Vulnerabilities
- Prevention
- Hunting for Application Logic Errors and Broken Access Control
- Step 1: Learn About Your Target
- Step 2: Intercept Requests While Browsing
- Step 3: Think Outside the Box
- Escalating the Attack
- Finding Your First Application Logic Error or Broken Access Control!
- Chapter 18: Remote Code Execution
- Mechanisms
- Code Injection
- File Inclusion
- Prevention
- Hunting for RCEs
- Step 1: Gather Information About the Target
- Step 2: Identify Suspicious User Input Locations
- Step 3: Submit Test Payloads
- Step 4: Confirm the Vulnerability
- Escalating the Attack
- Bypassing RCE Protection
- Finding Your First RCE!
- Chapter 19: Same-Origin Policy Vulnerabilities
- Mechanisms
- Exploiting Cross-Origin Resource Sharing
- Exploiting postMessage()
- Exploiting JSON with Padding
- Bypassing SOP by Using XSS
- Hunting for SOP Bypasses
- Step 1: Determine If SOP Relaxation Techniques Are Used
- Step 2: Find CORS Misconfiguration
- Step 3: Find postMessage Bugs
- Step 4: Find JSONP Issues
- Step 5: Consider Mitigating Factors
- Escalating the Attack
- Finding Your First SOP Bypass Vulnerability!
- Chapter 20: Single-Sign-On Security Issues
- Mechanisms
- Cooking Sharing
- Security Assertion Markup Language
- OAuth
- Hunting for Subdomain Takeovers
- Step 1: List the Target’s Subdomains
- Step 2: Find Unregistered Pages
- Step 3: Register the Page
- Monitoring for Subdomain Takeovers
- Hunting for SAML Vulnerabilities
- Step 1: Locate the SAML Response
- Step 2: Analyze the Response Fields
- Step 3: Bypass the Signature
- Step 4: Re-encode the Message
- Hunting for OAuth Token Theft
- Escalating the Attack
- Finding Your First SSO Bypass!
- Chapter 21: Information Disclosure
- Mechanisms
- Prevention
- Hunting for Information Disclosure
- Step 1: Attempt a Path Traversal Attack
- Step 2: Search the Wayback Machine
- Step 3: Search Paste Dump Sites
- Step 4: Reconstruct Source Code from an Exposed .git Directory
- Step 5: Find Information in Public Files
- Escalating the Attack
- Finding Your First Information Disclosure!
- Part IV: Expert Techniques
- Chapter 22: Conducting Code Reviews
- White-Box vs. Black-Box Testing
- The Fast Approach: grep Is Your Best Friend
- Dangerous Patterns
- Leaked Secrets and Weak Encryption
- New Patches and Outdated Dependencies
- Developer Comments
- Debug Functionalities, Configuration Files, and Endpoints
- The Detailed Approach
- Important Functions
- User Input
- Exercise: Spot the Vulnerabilities
- Chapter 23: Hacking Android Apps
- Setting Up Your Mobile Proxy
- Bypassing Certificate Pinning
- Anatomy of an APK
- Tools to Use
- Android Debug Bridge
- Android Studio
- Apktool
- Frida
- Mobile Security Framework
- Hunting for Vulnerabilities
- Chapter 24: API Hacking
- What Are APIs?
- REST APIs
- SOAP APIs
- GraphQL APIs
- API-Centric Applications
- Hunting for API Vulnerabilities
- Performing Recon
- Testing for Broken Access Control and Info Leaks
- Testing for Rate-Limiting Issues
- Testing for Technical Bugs
- Chapter 25: Automatic Vulnerability Discovery Using Fuzzers
- What Is Fuzzing?
- How a Web Fuzzer Works
- The Fuzzing Process
- Step 1: Determine the Data Injection Points
- Step 2: Decide on the Payload List
- Step 3: Fuzz
- Step 4: Monitor the Results
- Fuzzing with Wfuzz
- Path Enumeration
- Brute-Forcing Authentication
- Testing for Common Web Vulnerabilities
- More About Wfuzz
- Fuzzing vs. Static Analysis
- Pitfalls of Fuzzing
- Adding to Your Automated Testing Toolkit
- Index
Bug Bounty Bootcamp
The Guide to Finding and Reporting Web Vulnerabilities
Vickie Li
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.