The Ultimate Web Application Bug Bounty Hunting Course [3/2026, ENG]
movies, software, shows...
Files
| 01. Introduction | |||
| 1. Introduction.html | 2.77 KB | ||
| 2. What you will learn.mp4 | 26.21 MB | ||
| 2. What you will learn.vtt | 1.8 KB | ||
| 3. How I set up Burp.mp4 | 64.34 MB | ||
| 3. How I set up Burp.vtt | 11.66 KB | ||
| 02. Cross-site scripting (XSS) | |||
| 1. XSS Methodology.mp4 | 195.31 MB | ||
| 1. XSS Methodology.vtt | 27.42 KB | ||
| 10. Stored XSS into anchor href attribute with double quotes HTML-encoded.mp4 | 42.72 MB | ||
| 10. Stored XSS into anchor href attribute with double quotes HTML-encoded.vtt | 5.18 KB | ||
| 11. Reflected XSS into a JavaScript string with angle brackets HTML encoded.mp4 | 34.34 MB | ||
| 11. Reflected XSS into a JavaScript string with angle brackets HTML encoded.vtt | 4.44 KB | ||
| 12. DOM XSS in document.write sink using source location.search inside a select elem.mp4 | 49.69 MB | ||
| 12. DOM XSS in document.write sink using source location.search inside a select elem.vtt | 5.89 KB | ||
| 13. DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encod.mp4 | 33.48 MB | ||
| 13. DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encod.vtt | 4 KB | ||
| 14. Reflected DOM XSS.mp4 | 43.75 MB | ||
| 14. Reflected DOM XSS.vtt | 5.61 KB | ||
| 15. Stored DOM XSS.mp4 | 39.27 MB | ||
| 15. Stored DOM XSS.vtt | 4.75 KB | ||
| 16. Exploiting cross-site scripting to steal cookies.mp4 | 33.32 MB | ||
| 16. Exploiting cross-site scripting to steal cookies.vtt | 4.78 KB | ||
| 17. Exploiting cross-site scripting to capture passwords.mp4 | 24.83 MB | ||
| 17. Exploiting cross-site scripting to capture passwords.vtt | 3.62 KB | ||
| 18. Exploiting XSS to perform CSRF.mp4 | 55.2 MB | ||
| 18. Exploiting XSS to perform CSRF.vtt | 6.34 KB | ||
| 19. Reflected XSS into HTML context with most tags and attributes blocked.mp4 | 44.1 MB | ||
| 19. Reflected XSS into HTML context with most tags and attributes blocked.vtt | 6.69 KB | ||
| 2. XSS Links and Slides.html | 2.27 KB | ||
| 2. XSS.pdf | 1.28 MB | ||
| 20. Reflected XSS into HTML context with all tags blocked except custom ones.mp4 | 18.81 MB | ||
| 20. Reflected XSS into HTML context with all tags blocked except custom ones.vtt | 3.52 KB | ||
| 21. Reflected XSS with some SVG markup allowed.mp4 | 32.78 MB | ||
| 21. Reflected XSS with some SVG markup allowed.vtt | 4.71 KB | ||
| 22. Reflected XSS in canonical link tag.mp4 | 41.3 MB | ||
| 22. Reflected XSS in canonical link tag.vtt | 5.26 KB | ||
| 23. Reflected XSS into a JavaScript string with single quote and backslash escaped.mp4 | 29.88 MB | ||
| 23. Reflected XSS into a JavaScript string with single quote and backslash escaped.vtt | 3.8 KB | ||
| 24. Reflected XSS into a JavaScript string with angle brackets and double quotes HTM.mp4 | 31.33 MB | ||
| 24. Reflected XSS into a JavaScript string with angle brackets and double quotes HTM.vtt | 3.84 KB | ||
| 25. Stored XSS into onclick event with angle brackets and double quotes HTML-encoded.mp4 | 40.33 MB | ||
| 25. Stored XSS into onclick event with angle brackets and double quotes HTML-encoded.vtt | 5.59 KB | ||
| 26. Reflected XSS into a template literal with angle brackets, single, double quotes.mp4 | 28.4 MB | ||
| 26. Reflected XSS into a template literal with angle brackets, single, double quotes.vtt | 3.47 KB | ||
| 3. Reflected XSS into HTML context with nothing encoded.mp4 | 31.44 MB | ||
| 3. Reflected XSS into HTML context with nothing encoded.vtt | 4.14 KB | ||
| 4. Stored XSS into HTML context with nothing encoded.mp4 | 47.6 MB | ||
| 4. Stored XSS into HTML context with nothing encoded.vtt | 6.02 KB | ||
| 5. DOM XSS in document.write sink using source location.search.mp4 | 35.08 MB | ||
| 5. DOM XSS in document.write sink using source location.search.vtt | 5.74 KB | ||
| 6. DOM XSS in innerHTML sink using source location.search.mp4 | 23.63 MB | ||
| 6. DOM XSS in innerHTML sink using source location.search.vtt | 3.59 KB | ||
| 7. DOM XSS in jQuery anchor href attribute sink using location.search source.mp4 | 29.64 MB | ||
| 7. DOM XSS in jQuery anchor href attribute sink using location.search source.vtt | 3.82 KB | ||
| 8. DOM XSS in jQuery selector sink using a hashchange event.mp4 | 45.19 MB | ||
| 8. DOM XSS in jQuery selector sink using a hashchange event.vtt | 6.77 KB | ||
| 9. Reflected XSS into attribute with angle brackets HTML-encoded.mp4 | 36.53 MB | ||
| 9. Reflected XSS into attribute with angle brackets HTML-encoded.vtt | 4.82 KB | ||
| 03. Cross-site request forgery (CSRF) | |||
| 1. CSRF Methodology.mp4 | 95.05 MB | ||
| 1. CSRF Methodology.vtt | 12.85 KB | ||
| 10. SameSite Strict bypass via client-side redirect.mp4 | 58.87 MB | ||
| 10. SameSite Strict bypass via client-side redirect.vtt | 8.33 KB | ||
| 11. SameSite Strict bypass via sibling domain.mp4 | 45.53 MB | ||
| 11. SameSite Strict bypass via sibling domain.vtt | 6.39 KB | ||
| 12. SameSite Lax bypass via cookie refresh.mp4 | 30.55 MB | ||
| 12. SameSite Lax bypass via cookie refresh.vtt | 5 KB | ||
| 13. CSRF where Referer validation depends on header being present.mp4 | 23.78 MB | ||
| 13. CSRF where Referer validation depends on header being present.vtt | 3.21 KB | ||
| 14. CSRF with broken Referer validation.mp4 | 34.23 MB | ||
| 14. CSRF with broken Referer validation.vtt | 4.39 KB | ||
| 2. CSRF Links and Slides.html | 674 B | ||
| 2. CSRF.pdf | 1.2 MB | ||
| 3. CSRF vulnerability with no defenses.mp4 | 42.27 MB | ||
| 3. CSRF vulnerability with no defenses.vtt | 6.44 KB | ||
| 4. CSRF where token validation depends on request method.mp4 | 26.29 MB | ||
| 4. CSRF where token validation depends on request method.vtt | 4.11 KB | ||
| 5. CSRF where token validation depends on token being present.mp4 | 23.34 MB | ||
| 5. CSRF where token validation depends on token being present.vtt | 3.31 KB | ||
| 6. CSRF where token is not tied to user session.mp4 | 42.91 MB | ||
| 6. CSRF where token is not tied to user session.vtt | 5.81 KB | ||
| 7. CSRF where token is tied to non-session cookie.mp4 | 73.47 MB | ||
| 7. CSRF where token is tied to non-session cookie.vtt | 9.51 KB | ||
| 8. CSRF where token is duplicated in cookie.mp4 | 43.5 MB | ||
| 8. CSRF where token is duplicated in cookie.vtt | 5.73 KB | ||
| 9. SameSite Lax bypass via method override.mp4 | 30.77 MB | ||
| 9. SameSite Lax bypass via method override.vtt | 5.04 KB | ||
| 04. Open Redirect | |||
| 1. Open Redirect Methodology.mp4 | 132.83 MB | ||
| 1. Open Redirect Methodology.vtt | 17.57 KB | ||
| 2. OPEN REDIRECT.pdf | 1.18 MB | ||
| 2. Open Redirect Links and Slides.html | 619 B | ||
| 3. Open Redirect Lab 1.mp4 | 48.72 MB | ||
| 3. Open Redirect Lab 1.vtt | 8.66 KB | ||
| 4. Open Redirect Lab 2.mp4 | 41.42 MB | ||
| 4. Open Redirect Lab 2.vtt | 6.09 KB | ||
| 5. Open Redirect Lab 3.mp4 | 24.84 MB | ||
| 5. Open Redirect Lab 3.vtt | 4.65 KB | ||
| 6. Open Redirect Lab 4.mp4 | 47.95 MB | ||
| 6. Open Redirect Lab 4.vtt | 5.86 KB | ||
| 05. Bypassing Access Control | |||
| 1. Bypassing Access Control Methodology.mp4 | 95.1 MB | ||
| 1. Bypassing Access Control Methodology.vtt | 12.05 KB | ||
| 10. User ID controlled by request parameter with password disclosure.mp4 | 24.68 MB | ||
| 10. User ID controlled by request parameter with password disclosure.vtt | 3.38 KB | ||
| 11. URL-based access control can be circumvented.mp4 | 33.27 MB | ||
| 11. URL-based access control can be circumvented.vtt | 4.55 KB | ||
| 12. Method-based access control can be circumvented.mp4 | 34.86 MB | ||
| 12. Method-based access control can be circumvented.vtt | 5.87 KB | ||
| 13. Multi-step process with no access control on one step.mp4 | 29.02 MB | ||
| 13. Multi-step process with no access control on one step.vtt | 4.4 KB | ||
| 14. Referer-based access control.mp4 | 33.41 MB | ||
| 14. Referer-based access control.vtt | 4.88 KB | ||
| 2. ACCESS CONTROL.pdf | 979.24 KB | ||
| 2. Bypassing Access Control Links and Slides.html | 160 B | ||
| 3. Unprotected admin functionality.mp4 | 15.14 MB | ||
| 3. Unprotected admin functionality.vtt | 2.65 KB | ||
| 4. Unprotected admin functionality with unpredictable URL.mp4 | 21.17 MB | ||
| 4. Unprotected admin functionality with unpredictable URL.vtt | 2.66 KB | ||
| 5. User role controlled by request parameter.mp4 | 19.77 MB | ||
| 5. User role controlled by request parameter.vtt | 2.86 KB | ||
| 6. User role can be modified in user profile.mp4 | 25.11 MB | ||
| 6. User role can be modified in user profile.vtt | 4.24 KB | ||
| 7. User ID controlled by request parameter.mp4 | 25.24 MB | ||
| 7. User ID controlled by request parameter.vtt | 3.55 KB | ||
| 8. User ID controlled by request parameter, with unpredictable user IDs.mp4 | 33.51 MB | ||
| 8. User ID controlled by request parameter, with unpredictable user IDs.vtt | 4.07 KB | ||
| 9. User ID controlled by request parameter with data leakage in redirect.mp4 | 20.53 MB | ||
| 9. User ID controlled by request parameter with data leakage in redirect.vtt | 2.83 KB | ||
| 06. Server-side request forgery (SSRF) | |||
| 1. Server-side request forgery (SSRF) Methodology.mp4 | 99.56 MB | ||
| 1. Server-side request forgery (SSRF) Methodology.vtt | 12.54 KB | ||
| 2. SSRF.pdf | 1.09 MB | ||
| 2. Server-side request forgery (SSRF) Links and Slides.html | 1.59 KB | ||
| 3. Basic SSRF against the local server.mp4 | 35.47 MB | ||
| 3. Basic SSRF against the local server.vtt | 5.2 KB | ||
| 4. Basic SSRF against another back-end system.mp4 | 32.1 MB | ||
| 4. Basic SSRF against another back-end system.vtt | 4.12 KB | ||
| 5. SSRF with blacklist-based input filter.mp4 | 36.3 MB | ||
| 5. SSRF with blacklist-based input filter.vtt | 4.5 KB | ||
| 6. SSRF with filter bypass via open redirection vulnerability.mp4 | 32.82 MB | ||
| 6. SSRF with filter bypass via open redirection vulnerability.vtt | 4.45 KB | ||
| 7. Blind SSRF with out-of-band detection.mp4 | 18.27 MB | ||
| 7. Blind SSRF with out-of-band detection.vtt | 2.5 KB | ||
| 07. SQL injection | |||
| 1. SQL injection Methodology.mp4 | 113.13 MB | ||
| 1. SQL injection Methodology.vtt | 15.3 KB | ||
| 10. SQL injection attack, querying the database type and version on MySQL and MS.mp4 | 24.77 MB | ||
| 10. SQL injection attack, querying the database type and version on MySQL and MS.vtt | 2.64 KB | ||
| 11. SQL injection attack, listing the database contents on non-Oracle databases.mp4 | 56.88 MB | ||
| 11. SQL injection attack, listing the database contents on non-Oracle databases.vtt | 6.77 KB | ||
| 12. SQL injection attack, listing the database contents on Oracle.mp4 | 42.85 MB | ||
| 12. SQL injection attack, listing the database contents on Oracle.vtt | 5.94 KB | ||
| 13. Blind SQL injection with conditional responses.mp4 | 76.4 MB | ||
| 13. Blind SQL injection with conditional responses.vtt | 9.22 KB | ||
| 14. Blind SQL injection with conditional errors.mp4 | 67.74 MB | ||
| 14. Blind SQL injection with conditional errors.vtt | 7.54 KB | ||
| 15. Blind SQL injection with time delays.mp4 | 27.2 MB | ||
| 15. Blind SQL injection with time delays.vtt | 3.53 KB | ||
| 16. Blind SQL injection with time delays and information retrieval.mp4 | 54.95 MB | ||
| 16. Blind SQL injection with time delays and information retrieval.vtt | 7.17 KB | ||
| 17. Blind SQL injection with out-of-band interaction.mp4 | 36.06 MB | ||
| 17. Blind SQL injection with out-of-band interaction.vtt | 5.49 KB | ||
| 18. Blind SQL injection with out-of-band data exfiltration.mp4 | 35.53 MB | ||
| 18. Blind SQL injection with out-of-band data exfiltration.vtt | 5.58 KB | ||
| 19. SQL injection with filter bypass via XML encoding.mp4 | 28.17 MB | ||
| 19. SQL injection with filter bypass via XML encoding.vtt | 4.16 KB | ||
| 2. SQL injection Links and Slides.html | 478 B | ||
| 2. SQLI.pdf | 1 MB | ||
| 20. Visible error-based SQL injection.mp4 | 77.8 MB | ||
| 20. Visible error-based SQL injection.vtt | 9.29 KB | ||
| 3. SQL injection vulnerability in WHERE clause allowing retrieval of hidden data.mp4 | 56.95 MB | ||
| 3. SQL injection vulnerability in WHERE clause allowing retrieval of hidden data.vtt | 5.93 KB | ||
| 4. SQL injection vulnerability allowing login bypass.mp4 | 30.31 MB | ||
| 4. SQL injection vulnerability allowing login bypass.vtt | 4.35 KB | ||
| 5. SQL injection UNION attack, determining the number of columns returned.mp4 | 22.52 MB | ||
| 5. SQL injection UNION attack, determining the number of columns returned.vtt | 2.56 KB | ||
| 6. SQL injection UNION attack, finding a column containing text.mp4 | 30.22 MB | ||
| 6. SQL injection UNION attack, finding a column containing text.vtt | 3.66 KB | ||
| 7. SQL injection UNION attack, retrieving data from other tables.mp4 | 37.96 MB | ||
| 7. SQL injection UNION attack, retrieving data from other tables.vtt | 4.41 KB | ||
| 8. SQL injection UNION attack, retrieving multiple values in a single column.mp4 | 33.24 MB | ||
| 8. SQL injection UNION attack, retrieving multiple values in a single column.vtt | 4.31 KB | ||
| 9. SQL injection attack, querying the database type and version on Oracle.mp4 | 43.25 MB | ||
| 9. SQL injection attack, querying the database type and version on Oracle.vtt | 4.17 KB | ||
| 08. OS command injection | |||
| 1. OS command injection Methodology.mp4 | 34.57 MB | ||
| 1. OS command injection Methodology.vtt | 4.16 KB | ||
| 2. OS COMMAND INJECTION.pdf | 939.46 KB | ||
| 2. OS command injection Links and Slides.html | 374 B | ||
| 3. OS command injection, simple case.mp4 | 24.45 MB | ||
| 3. OS command injection, simple case.vtt | 3.18 KB | ||
| 4. Blind OS command injection with time delays.mp4 | 19.32 MB | ||
| 4. Blind OS command injection with time delays.vtt | 2.53 KB | ||
| 5. Blind OS command injection with output redirection.mp4 | 29.29 MB | ||
| 5. Blind OS command injection with output redirection.vtt | 3.75 KB | ||
| 6. Blind OS command injection with out-of-band interaction.mp4 | 18.33 MB | ||
| 6. Blind OS command injection with out-of-band interaction.vtt | 2.71 KB | ||
| 7. Blind OS command injection with out-of-band data exfiltration.mp4 | 19.37 MB | ||
| 7. Blind OS command injection with out-of-band data exfiltration.vtt | 2.75 KB | ||
| 09. Insecure Direct Object References (IDOR) | |||
| 1. Insecure Direct Object References (IDOR) Methodology.mp4 | 116.63 MB | ||
| 1. Insecure Direct Object References (IDOR) Methodology.vtt | 15.15 KB | ||
| 2. IDOR.pdf | 1.33 MB | ||
| 2. Insecure Direct Object References (IDOR) Links and Slides.html | 466 B | ||
| 3. IDOR Lab 1.mp4 | 27.07 MB | ||
| 3. IDOR Lab 1.vtt | 4.26 KB | ||
| 4. IDOR Lab 2.mp4 | 46.55 MB | ||
| 4. IDOR Lab 2.vtt | 7.82 KB | ||
| 5. IDOR Lab 3.mp4 | 41.79 MB | ||
| 5. IDOR Lab 3.vtt | 6.16 KB | ||
| 6. IDOR Lab 4.mp4 | 27.74 MB | ||
| 6. IDOR Lab 4.vtt | 3.36 KB | ||
| 10. XML external entity (XXE) injection | |||
| 1. XML external entity (XXE) injection Methodology.mp4 | 79.56 MB | ||
| 1. XML external entity (XXE) injection Methodology.vtt | 10.27 KB | ||
| 10. Exploiting XXE via image file upload.mp4 | 29.21 MB | ||
| 10. Exploiting XXE via image file upload.vtt | 4.04 KB | ||
| 2. XML external entity (XXE) injection Links and Slides.html | 666 B | ||
| 2. XXE.pdf | 1.05 MB | ||
| 3. Exploiting XXE using external entities to retrieve files.mp4 | 32.37 MB | ||
| 3. Exploiting XXE using external entities to retrieve files.vtt | 4.15 KB | ||
| 4. Exploiting XXE to perform SSRF attacks.mp4 | 32.51 MB | ||
| 4. Exploiting XXE to perform SSRF attacks.vtt | 4.45 KB | ||
| 5. Blind XXE with out-of-band interaction.mp4 | 37.5 MB | ||
| 5. Blind XXE with out-of-band interaction.vtt | 4.54 KB | ||
| 6. Blind XXE with out-of-band interaction via XML parameter entities.mp4 | 26.03 MB | ||
| 6. Blind XXE with out-of-band interaction via XML parameter entities.vtt | 4 KB | ||
| 7. Exploiting blind XXE to exfiltrate data using a malicious external DTD.mp4 | 35.67 MB | ||
| 7. Exploiting blind XXE to exfiltrate data using a malicious external DTD.vtt | 5.47 KB | ||
| 8. Exploiting blind XXE to retrieve data via error messages.mp4 | 28.96 MB | ||
| 8. Exploiting blind XXE to retrieve data via error messages.vtt | 4.15 KB | ||
| 9. Exploiting XInclude to retrieve files.mp4 | 28.12 MB | ||
| 9. Exploiting XInclude to retrieve files.vtt | 3.42 KB | ||
| 11. API Testing | |||
| 1. API Methodology.mp4 | 76.64 MB | ||
| 1. API Methodology.vtt | 11.23 KB | ||
| 2. API Links and Slides.html | 860 B | ||
| 2. API.pdf | 1.07 MB | ||
| 12. File upload vulnerabilities | |||
| 1. File upload vulnerabilities Methodology.mp4 | 83.62 MB | ||
| 1. File upload vulnerabilities Methodology.vtt | 11.78 KB | ||
| 2. FILE-UPLOADS.pdf | 1.02 MB | ||
| 2. File upload vulnerabilities Links and Slides.html | 823 B | ||
| 3. Remote code execution via web shell upload.mp4 | 39.93 MB | ||
| 3. Remote code execution via web shell upload.vtt | 5.75 KB | ||
| 4. Web shell upload via Content-Type restriction bypass.mp4 | 35.24 MB | ||
| 4. Web shell upload via Content-Type restriction bypass.vtt | 4.68 KB | ||
| 5. Web shell upload via path traversal.mp4 | 35.06 MB | ||
| 5. Web shell upload via path traversal.vtt | 4.96 KB | ||
| 6. Web shell upload via extension blacklist bypass.mp4 | 26.61 MB | ||
| 6. Web shell upload via extension blacklist bypass.vtt | 3.51 KB | ||
| 7. Web shell upload via obfuscated file extension.mp4 | 19.25 MB | ||
| 7. Web shell upload via obfuscated file extension.vtt | 3.05 KB | ||
| 8. Remote code execution via polyglot web shell upload.mp4 | 52.21 MB | ||
| 8. Remote code execution via polyglot web shell upload.vtt | 6.47 KB | ||
| 13. Java Script analysis | |||
| 1. Java Script analysis Methodology.mp4 | 62.56 MB | ||
| 1. Java Script analysis Methodology.vtt | 8.67 KB | ||
| 2. JAVASCRIPT.pdf | 1.04 MB | ||
| 2. Java Script analysis Links and Slides.html | 850 B | ||
| 3. Java Script Lab 1.mp4 | 67.27 MB | ||
| 3. Java Script Lab 1.vtt | 6.67 KB | ||
| 4. Java Script Lab 2.mp4 | 39.24 MB | ||
| 4. Java Script Lab 2.vtt | 4.91 KB | ||
| 5. Java Script Lab 3.mp4 | 63.22 MB | ||
| 5. Java Script Lab 3.vtt | 5.64 KB | ||
| 6. Java Script Lab 4.mp4 | 77.98 MB | ||
| 6. Java Script Lab 4.vtt | 8.54 KB | ||
| 14. Cross-origin resource sharing (CORS) | |||
| 1. Cross-origin resource sharing (CORS) Methodology.mp4 | 102.43 MB | ||
| 1. Cross-origin resource sharing (CORS) Methodology.vtt | 13.31 KB | ||
| 2. CORS.pdf | 1.14 MB | ||
| 2. Cross-origin resource sharing (CORS) Links and Slides.html | 181 B | ||
| 3. CORS vulnerability with basic origin reflection.mp4 | 47.3 MB | ||
| 3. CORS vulnerability with basic origin reflection.vtt | 6.39 KB | ||
| 4. CORS vulnerability with trusted null origin.mp4 | 45.46 MB | ||
| 4. CORS vulnerability with trusted null origin.vtt | 6.17 KB | ||
| 5. CORS vulnerability with trusted insecure protocols.mp4 | 44.78 MB | ||
| 5. CORS vulnerability with trusted insecure protocols.vtt | 6.81 KB | ||
| 15. Business logic vulnerabilities | |||
| 1. Business logic vulnerabilities Methodology.mp4 | 92.43 MB | ||
| 1. Business logic vulnerabilities Methodology.vtt | 12.39 KB | ||
| 10. Insufficient workflow validation.mp4 | 28.77 MB | ||
| 10. Insufficient workflow validation.vtt | 3.68 KB | ||
| 11. Authentication bypass via flawed state machine.mp4 | 25.61 MB | ||
| 11. Authentication bypass via flawed state machine.vtt | 3.98 KB | ||
| 12. Infinite money logic flaw.mp4 | 60.41 MB | ||
| 12. Infinite money logic flaw.vtt | 8.63 KB | ||
| 13. Authentication bypass via encryption oracle.mp4 | 95.31 MB | ||
| 13. Authentication bypass via encryption oracle.vtt | 11.4 KB | ||
| 2. BUSINESS-LOGIC.pdf | 771.17 KB | ||
| 2. Business logic vulnerabilities Links and Slides.html | 526 B | ||
| 3. Excessive trust in client-side controls.mp4 | 25.19 MB | ||
| 3. Excessive trust in client-side controls.vtt | 3.54 KB | ||
| 4. High-level logic vulnerability.mp4 | 35.12 MB | ||
| 4. High-level logic vulnerability.vtt | 4.49 KB | ||
| 5. Inconsistent security controls.mp4 | 16.93 MB | ||
| 5. Inconsistent security controls.vtt | 3.53 KB | ||
| 6. Flawed enforcement of business rules.mp4 | 31.81 MB | ||
| 6. Flawed enforcement of business rules.vtt | 5.11 KB | ||
| 7. Low-level logic flaw.mp4 | 61.67 MB | ||
| 7. Low-level logic flaw.vtt | 7.19 KB | ||
| 8. Inconsistent handling of exceptional input.mp4 | 34.59 MB | ||
| 8. Inconsistent handling of exceptional input.vtt | 5.81 KB | ||
| 9. Weak isolation on dual-use endpoint.mp4 | 34.18 MB | ||
| 9. Weak isolation on dual-use endpoint.vtt | 4.74 KB | ||
| 16. Registration flaws | |||
| 1. Registration flaws Methodology.mp4 | 98.3 MB | ||
| 1. Registration flaws Methodology.vtt | 13.38 KB | ||
| 2. REGISTRATION.pdf | 805.65 KB | ||
| 2. Registration flaws Slides.html | 52 B | ||
| 17. Login flaws | |||
| 1. Login flaws Methodology.mp4 | 49.28 MB | ||
| 1. Login flaws Methodology.vtt | 7.09 KB | ||
| 2. LOGIN.pdf | 738.37 KB | ||
| 2. Login flaws Slides.html | 52 B | ||
| 18. Password reset flaws | |||
| 1. Password reset flaws Methodology.mp4 | 47.58 MB | ||
| 1. Password reset flaws Methodology.vtt | 6.18 KB | ||
| 2. PASSWORD-RESET.pdf | 764.09 KB | ||
| 2. Password reset flaws Slides.html | 52 B | ||
| 3. Password reset broken logic.mp4 | 19.84 MB | ||
| 3. Password reset broken logic.vtt | 3.65 KB | ||
| 4. Password reset poisoning via middleware.mp4 | 32.92 MB | ||
| 4. Password reset poisoning via middleware.vtt | 4.6 KB | ||
| 5. Basic password reset poisoning.mp4 | 36.35 MB | ||
| 5. Basic password reset poisoning.vtt | 4.44 KB | ||
| 19. Updating account flaws | |||
| 1. Updating account Methodology.mp4 | 78.58 MB | ||
| 1. Updating account Methodology.vtt | 10.84 KB | ||
| 2. UPDATING-ACCOUNT.pdf | 802.53 KB | ||
| 2. Updating account flaws Slides.html | 52 B | ||
| 20. Developer tools flaws | |||
| 1. Developer tools Methodology.mp4 | 95.5 MB | ||
| 1. Developer tools Methodology.vtt | 13.39 KB | ||
| 2. DEVELOPER-TOOLS.pdf | 788.18 KB | ||
| 2. Developer tools flaws Slides.html | 52 B | ||
| 21. Analysis of the core application | |||
| 1. Analysis of the core application Methodology.mp4 | 97.73 MB | ||
| 1. Analysis of the core application Methodology.vtt | 13.87 KB | ||
| 2. Analysis of the core application Slides.html | 52 B | ||
| 2. CORE-FEATURES.pdf | 772.21 KB | ||
| 22. Payment feature flaws | |||
| 1. Payment feature Methodology.mp4 | 64.6 MB | ||
| 1. Payment feature Methodology.vtt | 8 KB | ||
| 2. PAYMENT-FEATURES.pdf | 808.33 KB | ||
| 2. Payment feature flaws Slides.html | 52 B | ||
| 23. Premium feature flaws | |||
| 1. Premium feature Methodology.mp4 | 32.64 MB | ||
| 1. Premium feature Methodology.vtt | 4.25 KB | ||
| 2. PREMIUM-FEATURES.pdf | 760.22 KB | ||
| 2. Premium feature flaws Slides.html | 52 B | ||
| 24. Directory Traversal | |||
| 1. Directory Traversal Methodology.mp4 | 62.88 MB | ||
| 1. Directory Traversal Methodology.vtt | 7.86 KB | ||
| 2. DIRECTORY-TRAVERSAL.pdf | 841.67 KB | ||
| 2. Directory Traversal flaws Links and Slides.html | 229 B | ||
| 3. File path traversal, simple case.mp4 | 37.48 MB | ||
| 3. File path traversal, simple case.vtt | 4.42 KB | ||
| 4. File path traversal, traversal sequences blocked with absolute path bypass.mp4 | 20.53 MB | ||
| 4. File path traversal, traversal sequences blocked with absolute path bypass.vtt | 2.68 KB | ||
| 5. File path traversal, traversal sequences stripped non-recursively.mp4 | 23.01 MB | ||
| 5. File path traversal, traversal sequences stripped non-recursively.vtt | 3.19 KB | ||
| 6. File path traversal, traversal sequences stripped with superfluous URL-decode.mp4 | 25.68 MB | ||
| 6. File path traversal, traversal sequences stripped with superfluous URL-decode.vtt | 3.46 KB | ||
| 7. File path traversal, validation of start of path.mp4 | 22.08 MB | ||
| 7. File path traversal, validation of start of path.vtt | 2.53 KB | ||
| 8. File path traversal, validation of file extension with null byte bypass.mp4 | 25.38 MB | ||
| 8. File path traversal, validation of file extension with null byte bypass.vtt | 2.98 KB | ||
| 25. Methodology to find most bugs | |||
| 1. Bug Finding Methodology.mp4 | 112.03 MB | ||
| 1. Bug Finding Methodology.vtt | 15.51 KB | ||
| 2. Bug Finding Slides.html | 52 B | ||
| 2. METHODOLOGY.pdf | 774.75 KB | ||
| 26. Mystery Labs | |||
| 1. Mystery Lab 1.mp4 | 73.03 MB | ||
| 1. Mystery Lab 1.vtt | 9 KB | ||
| 2. Mystery Lab 2.mp4 | 101.04 MB | ||
| 2. Mystery Lab 2.vtt | 11.69 KB | ||
| 3. Mystery Lab 3.mp4 | 93.09 MB | ||
| 3. Mystery Lab 3.vtt | 9.53 KB | ||
| 4. Mystery Lab 4.mp4 | 56.33 MB | ||
| 4. Mystery Lab 4.vtt | 8.16 KB | ||
| 5. Mystery Lab 5.mp4 | 66.15 MB | ||
| 5. Mystery Lab 5.vtt | 7.64 KB | ||
| 6. Mystery Lab 6.mp4 | 99.69 MB | ||
| 27. AI Automation | |||
| 1. AI Automation.mp4 | 88.06 MB | ||
| 1. webapp-bugbounty-skill.zip | 45.33 KB | ||
| ▲ 364 total files | |||
Description
Обучающие видео » Компьютерные видеоуроки и обучающие интерактивные DVD » Компьютерные сети и безопасность
The Ultimate Web Application Bug Bounty Hunting Course
Год выпуска: 3/2026
Производитель: Udemy
Сайт производителя: https://www.udemy.com/course/the-ultimate-web-application-bug-bounty-hunting-course/
Автор: Martin Voelk
Продолжительность: 13h 37m
Тип раздаваемого материала: Видеоурок
Язык: Английский
Описание: Welcome to the ultimate Web Application Bug Bounty Hunting course.
Your instructor is Martin Voelk. He is a Cyber Security veteran with 25 years of experience. Martin holds some of the highest certification incl. CISSP, OSCP, OSWP, Portswigger BSCP, CCIE, PCI ISA and PCIP. He works as a consultant for a big tech company and engages in Bug Bounty programs where he found thousands of critical and high vulnerabilities.
In this course Martin walks students through a step-by-step methodology on how to uncover web vulnerabilities. The theoretical lecture is complimented with the relevant free practical Burp labs to reinforce the knowledge. Martin is not just inserting the payload but explains each step on finding the vulnerability and why it can be exploited in a certain way. The videos are easy to follow along and replicate. This training is highly recommended for anyone who wants to become a professional Web Application Bug Bounty Hunter.
[spoiler="Содержание"]
01. Introduction
2. What you will learn (01:32)
3. How I set up Burp (08:56)
02. Cross-site scripting (XSS)
1. XSS Methodology (22:37)
3. Reflected XSS into HTML context with nothing encoded (03:22)
4. Stored XSS into HTML context with nothing encoded (04:49)
5. DOM XSS in document.write sink using source location.search (04:14)
6. DOM XSS in innerHTML sink using source location.search (03:04)
7. DOM XSS in jQuery anchor href attribute sink using location.search source (03:16)
8. DOM XSS in jQuery selector sink using a hashchange event (05:23)
9. Reflected XSS into attribute with angle brackets HTML-encoded (03:52)
10. Stored XSS into anchor href attribute with double quotes HTML-encoded (04:35)
11. Reflected XSS into a JavaScript string with angle brackets HTML encoded (03:40)
12. DOM XSS in document.write sink using source location.search inside a select elem (05:00)
13. DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encod (03:32)
14. Reflected DOM XSS (04:47)
15. Stored DOM XSS (04:05)
16. Exploiting cross-site scripting to steal cookies (04:06)
17. Exploiting cross-site scripting to capture passwords (02:50)
18. Exploiting XSS to perform CSRF (05:19)
19. Reflected XSS into HTML context with most tags and attributes blocked (05:41)
20. Reflected XSS into HTML context with all tags blocked except custom ones (02:49)
21. Reflected XSS with some SVG markup allowed (04:09)
22. Reflected XSS in canonical link tag (04:30)
23. Reflected XSS into a JavaScript string with single quote and backslash escaped (03:05)
24. Reflected XSS into a JavaScript string with angle brackets and double quotes HTM (03:18)
25. Stored XSS into onclick event with angle brackets and double quotes HTML-encoded (05:04)
26. Reflected XSS into a template literal with angle brackets, single, double quotes (02:57)
03. Cross-site request forgery (CSRF)
1. CSRF Methodology (10:58)
3. CSRF vulnerability with no defenses (05:15)
4. CSRF where token validation depends on request method (03:12)
5. CSRF where token validation depends on token being present (02:46)
6. CSRF where token is not tied to user session (05:00)
7. CSRF where token is tied to non-session cookie (08:27)
8. CSRF where token is duplicated in cookie (05:12)
9. SameSite Lax bypass via method override (04:10)
10. SameSite Strict bypass via client-side redirect (07:09)
11. SameSite Strict bypass via sibling domain (05:35)
12. SameSite Lax bypass via cookie refresh (04:08)
13. CSRF where Referer validation depends on header being present (02:53)
14. CSRF with broken Referer validation (03:52)
04. Open Redirect
1. Open Redirect Methodology (14:46)
3. Open Redirect Lab 1 (06:46)
4. Open Redirect Lab 2 (05:11)
5. Open Redirect Lab 3 (04:03)
6. Open Redirect Lab 4 (05:22)
05. Bypassing Access Control
1. Bypassing Access Control Methodology (09:45)
3. Unprotected admin functionality (02:06)
4. Unprotected admin functionality with unpredictable URL (02:17)
5. User role controlled by request parameter (02:21)
6. User role can be modified in user profile (03:25)
7. User ID controlled by request parameter (02:53)
8. User ID controlled by request parameter, with unpredictable user IDs (03:21)
9. User ID controlled by request parameter with data leakage in redirect (02:18)
10. User ID controlled by request parameter with password disclosure (02:41)
11. URL-based access control can be circumvented (03:44)
12. Method-based access control can be circumvented (04:27)
13. Multi-step process with no access control on one step (03:22)
14. Referer-based access control (04:00)
06. Server-side request forgery (SSRF)
1. Server-side request forgery (SSRF) Methodology (11:09)
3. Basic SSRF against the local server (04:24)
4. Basic SSRF against another back-end system (03:46)
5. SSRF with blacklist-based input filter (03:44)
6. SSRF with filter bypass via open redirection vulnerability (03:45)
7. Blind SSRF with out-of-band detection (02:04)
07. SQL injection
1. SQL injection Methodology (12:25)
3. SQL injection vulnerability in WHERE clause allowing retrieval of hidden data (05:35)
4. SQL injection vulnerability allowing login bypass (03:51)
5. SQL injection UNION attack, determining the number of columns returned (02:17)
6. SQL injection UNION attack, finding a column containing text (03:08)
7. SQL injection UNION attack, retrieving data from other tables (03:48)
8. SQL injection UNION attack, retrieving multiple values in a single column (03:29)
9. SQL injection attack, querying the database type and version on Oracle (03:55)
10. SQL injection attack, querying the database type and version on MySQL and MS (02:27)
11. SQL injection attack, listing the database contents on non-Oracle databases (06:11)
12. SQL injection attack, listing the database contents on Oracle (05:02)
13. Blind SQL injection with conditional responses (07:19)
14. Blind SQL injection with conditional errors (06:10)
15. Blind SQL injection with time delays (02:56)
16. Blind SQL injection with time delays and information retrieval (05:39)
17. Blind SQL injection with out-of-band interaction (04:33)
18. Blind SQL injection with out-of-band data exfiltration (04:31)
19. SQL injection with filter bypass via XML encoding (03:22)
20. Visible error-based SQL injection (08:19)
08. OS command injection
1. OS command injection Methodology (03:32)
3. OS command injection, simple case (02:57)
4. Blind OS command injection with time delays (02:17)
5. Blind OS command injection with output redirection (03:07)
6. Blind OS command injection with out-of-band interaction (02:21)
7. Blind OS command injection with out-of-band data exfiltration (02:19)
09. Insecure Direct Object References (IDOR)
1. Insecure Direct Object References (IDOR) Methodology (12:25)
3. IDOR Lab 1 (03:29)
4. IDOR Lab 2 (06:14)
5. IDOR Lab 3 (05:00)
6. IDOR Lab 4 (02:54)
10. XML external entity (XXE) injection
1. XML external entity (XXE) injection Methodology (08:58)
3. Exploiting XXE using external entities to retrieve files (03:38)
4. Exploiting XXE to perform SSRF attacks (03:48)
5. Blind XXE with out-of-band interaction (03:39)
6. Blind XXE with out-of-band interaction via XML parameter entities (02:59)
7. Exploiting blind XXE to exfiltrate data using a malicious external DTD (04:39)
8. Exploiting blind XXE to retrieve data via error messages (03:39)
9. Exploiting XInclude to retrieve files (03:02)
10. Exploiting XXE via image file upload (03:39)
11. API Testing
1. API Methodology (09:03)
12. File upload vulnerabilities
1. File upload vulnerabilities Methodology (09:31)
3. Remote code execution via web shell upload (04:52)
4. Web shell upload via Content-Type restriction bypass (04:02)
5. Web shell upload via path traversal (04:22)
6. Web shell upload via extension blacklist bypass (03:10)
7. Web shell upload via obfuscated file extension (02:32)
8. Remote code execution via polyglot web shell upload (05:23)
13. Java Script analysis
1. Java Script analysis Methodology (07:09)
3. Java Script Lab 1 (05:47)
4. Java Script Lab 2 (04:13)
5. Java Script Lab 3 (04:56)
6. Java Script Lab 4 (06:56)
14. Cross-origin resource sharing (CORS)
1. Cross-origin resource sharing (CORS) Methodology (11:21)
3. CORS vulnerability with basic origin reflection (05:18)
4. CORS vulnerability with trusted null origin (04:56)
5. CORS vulnerability with trusted insecure protocols (05:20)
15. Business logic vulnerabilities
1. Business logic vulnerabilities Methodology (09:52)
3. Excessive trust in client-side controls (02:56)
4. High-level logic vulnerability (03:33)
5. Inconsistent security controls (02:45)
6. Flawed enforcement of business rules (03:50)
7. Low-level logic flaw (06:26)
8. Inconsistent handling of exceptional input (05:25)
9. Weak isolation on dual-use endpoint (03:49)
10. Insufficient workflow validation (02:54)
11. Authentication bypass via flawed state machine (03:15)
12. Infinite money logic flaw (06:49)
13. Authentication bypass via encryption oracle (09:31)
16. Registration flaws
1. Registration flaws Methodology (10:48)
17. Login flaws
1. Login flaws Methodology (05:30)
18. Password reset flaws
1. Password reset flaws Methodology (04:59)
3. Password reset broken logic (03:04)
4. Password reset poisoning via middleware (03:47)
5. Basic password reset poisoning (03:50)
19. Updating account flaws
1. Updating account Methodology (08:51)
20. Developer tools flaws
1. Developer tools Methodology (10:46)
21. Analysis of the core application
1. Analysis of the core application Methodology (10:58)
22. Payment feature flaws
1. Payment feature Methodology (06:55)
23. Premium feature flaws
1. Premium feature Methodology (03:31)
24. Directory Traversal
1. Directory Traversal Methodology (06:46)
3. File path traversal, simple case (03:43)
4. File path traversal, traversal sequences blocked with absolute path bypass (02:07)
5. File path traversal, traversal sequences stripped non-recursively (02:32)
6. File path traversal, traversal sequences stripped with superfluous URL-decode (02:49)
7. File path traversal, validation of start of path (02:08)
8. File path traversal, validation of file extension with null byte bypass (02:43)
25. Methodology to find most bugs
1. Bug Finding Methodology (12:23)
26. Mystery Labs
1. Mystery Lab 1 (07:29)
2. Mystery Lab 2 (09:43)
3. Mystery Lab 3 (08:14)
4. Mystery Lab 4 (06:25)
5. Mystery Lab 5 (06:07)
6. Mystery Lab 6 (10:04)
27. AI Automation
1. AI Automation (10:20)
[/spoiler]
Файлы примеров: не предусмотрены
Формат видео: MP4
Видео: AVC, 1280x720, 16:9, 30fps, 1 046kbps
Аудио: AAC, 44.1kHz, 128kbps, stereo
[spoiler="Скриншоты"]
[/spoiler]
Related Torrents
| torrent name | size | uploader | age | seed | leech |
|---|---|---|---|---|---|
| 11.22 GB | unity321d | 1 week | 1 | 0 | |
| 17.82 GB | unity321d | 1 month | 11 | 0 | |
|
Udemy - The Ultimate Guide to Fasting - Intermittent and Water Fasting Posted by
freecoursewb in Other
|
3.5 GB | freecoursewb | 1 month | 17 | 2 |
| 858.1 MB | freecoursewb | 1 month | 11 | 1 | |
| 1.41 GB | DukeNukem2005 | 1 month | 2 | 5 |
All Comments