Hands-On Bug Hunting for Penetration Testers

More Information
Learn
  • Choose what bug bounty programs to engage in
  • Understand how to minimize your legal liability and hunt for bugs ethically
  • See how to take notes that will make compiling your submission report easier
  • Know how to take an XSS vulnerability from discovery to verification, and report submission
  • Automate CSRF PoC generation with Python
  • Leverage Burp Suite for CSRF detection
  • Use WP Scan and other tools to find vulnerabilities in WordPress, Django, and Ruby on Rails applications
  • Write your report in a way that will earn you the maximum amount of money
About

Bug bounties have quickly become a critical part of the security economy. This book shows you how technical professionals with an interest in security can begin productively—and profitably—participating in bug bounty programs.

You will learn about SQli, NoSQLi, XSS, XXE, and other forms of code injection. You’ll see how to create CSRF PoC HTML snippets, how to discover hidden content (and what to do with it once it’s found), and how to create the tools for automated pentesting workflows.

Then, you’ll format all of this information within the context of a bug report that will have the greatest chance of earning you cash.

With detailed walkthroughs that cover discovering, testing, and reporting vulnerabilities, this book is ideal for aspiring security professionals. You should come away from this work with the skills you need to not only find the bugs you're looking for, but also the best bug bounty programs to participate in, and how to grow your skills moving forward in freelance security research.

Features
  • Learn how to test for common bugs
  • Discover tools and methods for hacking ethically
  • Practice working through pentesting engagements step-by-step
Page Count 250
Course Length 7 hours 30 minutes
ISBN 9781789344202
Date Of Publication 11 Sep 2018
Technical Requirements
The Benefits of Bug Bounty Programs
What You Should Already Know – Pentesting Background
Setting Up Your Environment – Tools To Know
What You Will Learn – Next Steps
How (Not) To Use This Book – A Warning
Summary
Questions
Further Reading
Technical Requirements
An Overview of Bug Bounty Communities – Where to Start Your Search
The Vulnerability of Web Applications – What You Should Target
Evaluating Rules of Engagement – How to Protect Yourself
Summary
Questions
Further Reading
Technical Requirements
Attack Surface Reconnaisance – Strategies and the Value of Standardization
Summary
Questions
Further Reading
Technical Requirements
A Quick Overview of XSS – The Many Varieties of XSS
Testing for XSS – Where to Find It, How to Verify It
XSS – An End-To-End Example
Summary
Questions
Further Reading
Technical Requirements
SQLi and Other Code Injection Attacks – Accepting Unvalidated Data
Testing for SQLi With Sqlmap – Where to Find It and How to Verify It
Trawling for Bugs – Using Google Dorks and Python for SQLi Discovery
Scanning for SQLi With Arachni
NoSQL Injection – Injecting Malformed MongoDB Queries
SQLi – An End-to-End Example
Summary
Questions
Further Reading
Technical requirements
A simple XXE example
XML injection vectors
XML injection and XXE – stronger together
Testing for XXE – where to find it, and how to verify it
XXE – an end-to-end example
Summary
Questions
Further reading
Technical Requirements
Security by Obscurity – The Siren Song
Data Leaks – What Information Matters?
Low Value Data – What Doesn’t Matter
Data Leak Vectors
Unmasking Hidden Content – How to Pull the Curtains Back
Data Leakage – An End-to-End Example
Summary
Questions
Further Reading
Technical Requirements
Known Component Vulnerabilities and CVEs – A Quick Refresher
WordPress – Using WPScan
Ruby on Rails – Rubysec Tools and Tricks
Django – Strategies for the Python App
Summary
Questions
Further Reading
Technical Requirements
Reproducing the Bug – How Your Submission Is Vetted
Critical Information – What Your Report Needs
Maximizing Your Award – The Features That Pay
Example Submission Reports – Where to Look
Hackerone Hacktivity
Vulnerability Lab Archive
GitHub
Summary
Questions
Further Reading
Technical Requirements
Evaluating New Tools – What to Look For
Paid Versus Free Editions – What Makes a Tool Worth It?
A Quick Overview of Other Options – Nikto, Kali, Burp Extensions, and More
Summary
Questions
Further Reading
Technical Requirements
DoS/DDoS – The Denial-of-Service Problem
Sandboxed and Self-XSS – Low-Threat XSS Varieties
Non-Critical Data Leaks – What Companies Don’t Care About
Other Common No-Payout Vulnerabilities
Summary
Questions
Further Reading

Authors

Joe Marshall

Joseph Marshall is a web application developer and freelance writer with credits from The Atlantic, Kirkus Review, and the SXSW film blog. He also enjoys moonlighting as a freelance security researcher, working with third-party vulnerability marketplaces such as Bugcrowd and HackerOne. His background and education include expertise in development, nonfiction writing, linguistics, and instruction/teaching. He lives in Austin, TX.