Hands-On Bug Hunting for Penetration Testers

By : Himanshu Sharma, Joe Marshall

4 (2)

Buy this Book

Hands-On Bug Hunting for Penetration Testers

4 (2)

By: Himanshu Sharma, Joe Marshall

Buy this Book

Overview of this book

Bug bounties have quickly become a critical part of the security economy. This book shows you how technical professionals with an interest in security can begin productively—and profitably—participating in bug bounty programs. You will learn about SQli, NoSQLi, XSS, XXE, and other forms of code injection. You’ll see how to create CSRF PoC HTML snippets, how to discover hidden content (and what to do with it once it’s found), and how to create the tools for automated pentesting work?ows. Then, you’ll format all of this information within the context of a bug report that will have the greatest chance of earning you cash. With detailed walkthroughs that cover discovering, testing, and reporting vulnerabilities, this book is ideal for aspiring security professionals. You should come away from this work with the skills you need to not only find the bugs you're looking for, but also the best bug bounty programs to participate in, and how to grow your skills moving forward in freelance security research.

Preface

Who this book is for

What this book covers

To get the most out of this book

Get in touch

Free Chapter

Joining the Hunt

Technical Requirements

The Benefits of Bug Bounty Programs

What You Should Already Know – Pentesting Background

Setting Up Your Environment – Tools To Know

What You Will Learn – Next Steps

How (Not) To Use This Book – A Warning

Summary

Questions

Further Reading

Choosing Your Hunting Ground

Technical Requirements

An Overview of Bug Bounty Communities – Where to Start Your Search

The Vulnerability of Web Applications – What You Should Target

Evaluating Rules of Engagement – How to Protect Yourself

Summary

Questions

Further Reading

Preparing for an Engagement

Technical Requirements

Attack Surface Reconnaisance – Strategies and the Value of Standardization

Summary

Questions

Further Reading

Unsanitized Data – An XSS Case Study

Technical Requirements

A Quick Overview of XSS – The Many Varieties of XSS

Testing for XSS – Where to Find It, How to Verify It

XSS – An End-To-End Example

Summary

Questions

Further Reading

SQL, Code Injection, and Scanners

Technical Requirements

SQLi and Other Code Injection Attacks – Accepting Unvalidated Data

Testing for SQLi With Sqlmap – Where to Find It and How to Verify It

Trawling for Bugs – Using Google Dorks and Python for SQLi Discovery

Scanning for SQLi With Arachni

NoSQL Injection – Injecting Malformed MongoDB Queries

SQLi – An End-to-End Example

Summary

Questions

Further Reading

CSRF and Insecure Session Authentication

Technical Requirements

Building and Using CSRF PoCs

CSRF – An End-to-End Example

Summary

Questions

Further Reading

Detecting XML External Entities

Technical requirements

A simple XXE example

XML injection vectors

XML injection and XXE – stronger together

Testing for XXE – where to find it, and how to verify it

XXE – an end-to-end example

Summary

Questions

Further Reading

Framework and Application-Specific Vulnerabilities

Technical Requirements

Known Component Vulnerabilities and CVEs – A Quick Refresher

WordPress – Using WPScan

Ruby on Rails – Rubysec Tools and Tricks

Django – Strategies for the Python App

Summary

Questions

Further Reading

Formatting Your Report

Technical Requirements

Reproducing the Bug – How Your Submission Is Vetted

Critical Information – What Your Report Needs

Maximizing Your Award – The Features That Pay

Example Submission Reports – Where to Look

Hackerone Hacktivity

Vulnerability Lab Archive

GitHub

Summary

Questions

Further Reading

Other Tools

Technical Requirements

Evaluating New Tools – What to Look For

Paid Versus Free Editions – What Makes a Tool Worth It?

A Quick Overview of Other Options – Nikto, Kali, Burp Extensions, and More

Summary

Questions

Further Reading

Other (Out of Scope) Vulnerabilities

Technical Requirements

DoS/DDoS – The Denial-of-Service Problem

Sandboxed and Self-XSS – Low-Threat XSS Varieties

Non-Critical Data Leaks – What Companies Don’t Care About

Other Common No-Payout Vulnerabilities

Summary

Questions

Further Reading

Going Further

Blogs

Courses

Summary

Questions

Further Reading

Assessment

Chapter 1

Chapter 2

Chapter 3

Chapter 4

Chapter 5

Chapter 6

Chapter 7

Chapter 8

Chapter 9

Chapter 10

Chapter 11

Chapter 12

Chapter 13

Other Books You May Enjoy

Leave a review - let other readers know what you think

Customer Reviews

4 (2)

5 star

50%

4 star

3 star

50%

2 star

1 star

Critical Information – What Your Report Needs

Although report information will vary based on what the vulnerability is (you might stumble upon encoded-but-decodable sensitive material, which would mean that you wouldn't have any Payload information to submit), there is a common set of fields you will always need:

The location (URL) of the vulnerability
The vulnerability type
When it was found
How it was found (automated/manual, tool)
How to reproduce it
How the bug can be exploited

We've had examples throughout this book of each of these fields, but there are two in particular that deserve greater mention. The location URL is clear, as well as the type, time, method, and all direct information, but ensuring the bug in the report is reproducible and that there's a compelling attack scenario detailing the horrific things it has done, leaving the bug un-patched...