Practical Bug Bounty

0:00:00 - Intro
0:03:00 - Keeper Security Sponsorship
0:03:48 - Course Introduction
0:10:02 - Importance of Web App Security
0:16:26 - Web App Security Standards and Best Practices
0:29:57 - Bug Bounty Hunting vs Penetration Testing
0:40:16 - Phases of a Web App Pentest
0:57:36 - CryptoCat Introduction
0:59:19 - Understanding Scope, Ethics, Code of Conduct, etc.
1:13:29 - Common Scoping Mistakes
1:37:59 - Installing VMWare / VirtualBox
1:41:14 - Installing Linux
1:50:20 - Lab Installation
1:57:36 - Web Technologies
2:02:14 - HTTP & DNS
2:05:47 - Fingerprinting Web Technologies
2:18:00 - Directory Enumeration and Brute Forcing
2:38:07 - Subdomain Enumeration
2:55:43 - Burp Suite Overview
3:34:35 - Introduction to Authentication
3:36:11 - Brute-force Attacks
3:43:11 - Attacking MFA
3:48:38 - Authentication Challenge Walkthrough
3:58:38 - Intro to Authorization
3:59:48 - IDOR - Insecure Direct Object Reference
4:06:15 - Introduction to APIs
4:11:04 - Broken Access Control
4:19:33 - Testing with Autorize
4:27:02 - Introduction to LFI/RFI
4:28:39 - Local File Inclusion Attacks
4:32:59 - Remote File Inclusion Attacks
4:40:37 - File Inclusion Challenge Walkthrough
4:45:05 - Conclusion

📱Social Media📱
___________________________________________

💸Donate💸
___________________________________________
Like the channel? Please consider supporting me on Patreon:

Hacker Books:

My Build:

My Recording Equipment:

[Erubius]

Taking the PJWT (the relevant cert for this course) tomorrow! Massively excited to put what I’ve learned to the test!

[samha]

TCM is recommended to anyone with little to no knowledge about cybersecurity in general. I’m preparing for OSCP and didn’t know where to start but tcm made is super easy.

[jasperthetom]

This free video covers a lot more topics than a course. I really appreciate what you guys are doing. I really like watching your videos. Love from India Sir.

[siddharthraychaudhuri]

Thanks, guys. I bought the Pnpt and a 3 month membership mainly for this course, during the sale. Thought I'd be able to complete it too with PNPT. Kinda overestimated myself and am still working through PEH. 10th March my monthly subscription ends, and I don't think I can afford it anymore. Was really sad that this one will remain incomplete. At least now I know that even if my subscription ends, I can still cover some part of the curriculum because of this upload.😢

[martinlastname]

Currently doing the PNPT. Enjoying it. More so than the PEN-200

[burd.]

I"ve got a subscription to TCM Academy but I just wanted to show some love here. You guys are awesome. Thanks for all you do for the community

[زيادساميخلف]

Best course for a bug bounty I have seen for now

[husseindhooma]

Thank you, Heath, for providing us with this amazing information, we all need to learn the Practical aspects of Bug Bounty especially for some of us that would like to earn some extra cash.

[dhruvildesai]

Thank you, Heath, for providing us with this amazing information!

[bikramshiwakoti]

Can't believe this premium content available for free

[MFoster]

Awesome, I'm doing this on the TCM website right now. :)

[TravelWithMufaa]

Hey.... Dear,
Can I run this BugBounty-v1.1 LAB on my Windows OS...???

[Resh]

Awesome video guys, thanks. Ill be coming over to your website to take some training soon.

[PandaXpress]

Question - what makes an "automated tool"? Wouldn't brute forcing count as an automated tool? Great video by the way, thanks.

[szicario]

im really weak in web apps compared to network, this is incredibly helpful. Thank you. Is the TCM course for practical bug bounty more in depth than this youtube video?

[andrewthurstenson]

If anyone else ran into an error when setting up the lab stating "'172.20.0.4' is not allowed to connect to this MySQL server in /var/www/html/db.php". I was able to resolve this by removing the volumes for the mysql container, bb-db, in the compose file

[mihajlofrancic]

Using curl on APIs in room 5 returns generic error, regardless if I copy the command from the room or try with credentials from tutorial (those creds are not visible to me).
{"status":"error", "message":"Required fields missing"}
Tried resetting the lab and db with init.php still nothing. Time stamp: 4:12:28

Edit: For anyone that has this problem, json username and password fields were missing double quotes

[soanzin]

I have a doubt. IF the scope says that automation tools are not allowed, is this related only for vuln scanners or to all other tools, like directory/asset discovery. Tools like ffuf, gobuster, etc.

[ibtesamRicky]

Thanks always for the free content. Can we get the Detection engineering for beginners course content please? Thank you!

[meh.]

@16:40 I thought the dog snoring in the background was mine.