舉報 
會員
Bug Bounty Hunting Essentials
Bugbountyprogramsarethedealsofferedbyprominentcompanieswhere-inanywhite-hathackercanfindbugsintheapplicationsandtheywillhavearecognitionforthesame.ThenumberofprominentorganizationshavingthisprogramhasincreasedgraduallyleadingtoalotofopportunityforEthicalHackers.ThisbookwillinitiallystartwithintroducingyoutotheconceptofBugBountyhunting.ThenwewilldigdeeperintoconceptsofvulnerabilitiesandanalysissuchasHTMLinjection,CRLFinjectionandsoon.Towardstheendofthebook,wewillgethands-onexperienceworkingwithdifferenttoolsusedforbughuntingandvariousblogsandcommunitiestobefollowed.Thisbookwillgetyoustartedwithbugbountyhuntinganditsfundamentals.
目錄(319章)
倒序
- coverpage
- Title Page
- About Packt
- Why subscribe?
- Packt.com
- Contributors
- About the authors
- About the reviewers
- Packt is searching for authors like you
- Preface
- Who this book is for
- What this book covers
- Conventions used
- Get in touch
- Reviews
- Disclaimer
- Basics of Bug Bounty Hunting
- Bug bounty hunting platforms
- HackerOne
- Bugcrowd
- Cobalt
- Synack
- Types of bug bounty program
- Public programs
- Private programs
- Bug bounty hunter statistics
- Number of vulnerabilities
- Number of halls of fame
- Reputation points
- Signal
- Impact
- Accuracy
- Bug bounty hunting methodology
- How to become a bug bounty hunter
- Reading books
- Practicing what you learned
- Reading proof of concepts
- Learning from reports
- Starting bug bounty hunting
- Learning and networking with others
- Rules of bug bounty hunting
- Targeting the right program
- Approaching the target with clarity
- Keeping your expectations low
- Learning about vulnerabilities
- Keeping yourself up-to-date
- Automating your vulnerabilities
- Gaining experience with bug bounty hunting
- Chaining vulnerabilities
- Summary
- How to Write a Bug Bounty Report
- Prerequisites of writing a bug bounty report
- Referring to the policy of the program
- Mission statement
- Participating services
- Excluded domains
- Reward and qualifications
- Eligibility for participation
- Conduct guidelines
- Nonqualifying vulnerabilities
- Commitment to researchers
- Salient features of a bug bounty report
- Clarity
- Depth
- Estimation
- Respect
- Format of a bug bounty report
- Writing title of a report
- Writing the description of a report
- Writing the proof of concept of a report
- Writing exploitability of a report
- Writing impact of a report
- Writing remediation
- Responding to the queries of the team
- Summary
- SQL Injection Vulnerabilities
- SQL injection
- Types of SQL injection vulnerability
- In-band SQLi (classic SQLi)
- Inferential SQLi (blind SQLi)
- Out-of-band SQLi
- Goals of an SQL injection attack for bug bounty hunters
- Uber SQL injection
- Key learning from this report
- Grab taxi SQL Injection
- Key learning from this report
- Zomato SQL injection
- Key learning from this report
- LocalTapiola SQL injection
- Key learning from this report
- Summary
- Cross-Site Request Forgery
- Protecting the cookies
- Why does the CSRF exist?
- GET CSRF
- POST CSRF
- CSRF-unsafe protections
- Secret cookies
- Request restrictions
- Complex flow
- URL rewriting
- Using HTTPS instead of HTTP
- CSRF – more safe protection
- Detecting and exploiting CSRF
- Avoiding problems with authentication
- XSS – CSRF's best friend
- Cross-domain policies
- HTML injection
- JavaScript hijacking
- CSRF in the wild
- Shopify for exporting installed users
- Shopify Twitter disconnect
- Badoo full account takeover
- Summary
- Application Logic Vulnerabilities
- Origins
- What is the main problem?
- Following the flow
- Spidering
- Points of interest
- Analysis
- User input
- Out-band channels
- Naming conventions
- Keywords related to technologies
- Analyzing the traffic
- Application logic vulnerabilities in the wild
- Bypassing the Shopify admin authentication
- Starbucks race conditions
- Binary.com vulnerability – stealing a user's money
- HackerOne signal manipulation
- Shopify S buckets open
- HackerOne S buckets open
- Bypassing the GitLab 2F authentication
- Yahoo PHP info disclosure
- Summary
- Cross-Site Scripting Attacks
- Types of cross-site scripting
- Reflected cross-site scripting
- Stored cross-site scripting
- DOM-based XSS
- Other types of XSS attacks
- Blind XSS
- Flash-based XSS
- Self XSS
- How do we detect XSS bugs?
- Detecting XSS bugs in real life
- Follow the flow
- Avoiding input validation controls
- Other common strings
- Bypassing filters using encoding
- Bypassing filters using tag modifiers
- Bypassing filters using dynamic constructed strings
- Workflow of an XSS attack
- HackeroneXSS
- Executing malicious JS
- Embedding unauthorized images in the report
- Redirecting users to a different website
- Key learning from this report
- Slack XSS
- Embedding malicious links to infect other users on Slack
- Key learning from this report
- TrelloXSS
- Key learning from this report
- Shopify XSS
- Key learning from this report
- Twitter XSS
- Key learning from this report
- Real bug bounty examples
- Shopify wholesale
- Shopify Giftcard Cart
- Shopify currency formatting
- Yahoo Mail stored XSS
- Google image search
- Summary
- SQL Injection
- Origin
- Types of SQL injection
- In-band SQL injection
- Inferential
- Out-of-band SQL injection
- Fundamental exploitation
- Detecting and exploiting SQL injection as if tomorrow does not exist
- Union
- Interacting with the DBMS
- Bypassing security controls
- Blind exploitation
- Out-band exploitations
- Example
- Automation
- SQL injection in Drupal
- Summary
- Open Redirect Vulnerabilities
- Redirecting to another URL
- Constructing URLs
- Executing code
- URL shorteners
- Why do open redirects work?
- Detecting and exploiting open redirections
- Exploitation
- Impact
- Black and white lists
- Open redirects in the wild
- Shopify theme install open redirect
- Shopify login open redirect
- HackerOne interstitial redirect
- XSS and open redirect on Twitter
- Summary
- Sub-Domain Takeovers
- The sub-domain takeover
- CNAME takeovers
- NS takeover
- MX takeovers
- Internet-wide scans
- Detecting possibly affected domains
- Exploitation
- Mitigation
- Sub-domain takeovers in the wild
- Ubiquiti sub-domain takeovers
- Scan.me pointing to Zendesk
- Starbucks' sub-domain takeover
- Vine's sub-domain takeover
- Uber's sub-domain takeover
- Summary
- XML External Entity Vulnerability
- How XML works
- How is an XXE produced?
- Detecting and exploiting an XXE
- Templates
- XXEs in the wild
- Read access to Google
- A Facebook XXE with Word
- The Wikiloc XXE
- Summary
- Template Injection
- What's the problem?
- Examples
- Twig and FreeMaker
- Smarty
- Marko
- Detection
- Exploitation
- Mitigation
- SSTI in the wild
- Uber Jinja2 TTSI
- Uber Angular template injection
- Yahoo SSTI vulnerability
- Rails dynamic render
- Summary
- Top Bug Bounty Hunting Tools
- HTTP proxies requests responses and traffic analyzers
- Burp Suite
- Wireshark
- Firebug
- ZAP – Zed Attack Proxy
- Fiddler
- Automated vulnerability discovery and exploitation
- Websecurify (SECAPPS)
- Acunetix
- Nikto
- sqlmap
- Recognize
- Knockpy
- HostileSubBruteforcer
- Nmap
- Shodan
- What CMS
- Recon-ng
- Extensions
- FoxyProxy
- User-Agent Switcher
- HackBar
- Cookies Manager+
- Summary
- Top Learning Resources
- Training
- Platzi
- Udemy
- GIAC
- Offensive Security
- Books and resources
- Web Application Hacker's Handbook
- OWASP Testing Guide
- Hacking 101
- The Hacker Play Book
- Exploiting Software
- CTFs and wargames
- Hack The Box
- Damn Vulnerable Web Application
- Badstore
- Metasploitable
- YouTube channels
- Web Hacking Pro Tips
- BugCrowd
- HackerOne
- Social networks and blogs
- Exploitware Labs
- Philippe Hare Wood
- PortSwigger's blog
- Meetings and networking
- LiveOverflow
- OWASP meetings
- DEFCON meetings
- 2600 meetings
- Conferences
- DEFCON
- BlackHat
- BugCON
- Ekoparty
- Code Blue
- CCC
- H2HC
- 8.8
- Podcasts
- PaulDotCom
- Summary
- Other Books You May Enjoy
- Leave a review - let other readers know what you think 更新時間：2021-06-10 18:36:23
推薦閱讀
- DevSecOps敏捷安全
- 科技安全：戰略實踐與展望
- 計算機網絡安全技術（第6版·慕課版）
- 電子支付的規制結構配置研究
- 計算機使用安全與防護
- 網絡安全技術及應用（第3版）
- 互聯網企業安全高級指南
- Mastering Reverse Engineering
- 網絡安全大數據分析與實戰
- CTF特訓營：技術詳解、解題方法與競賽技巧
- Mastering Python for Networking and Security
- 計算機網絡安全實驗指導
- 網絡空間安全法律問題研究
- 聯邦學習原理與算法
- 社會工程：防范釣魚欺詐（卷3）
- 安全網絡構建
- ATT＆CK與威脅獵殺實戰
- Real-World SRE
- 網絡安全與維護
- 網絡安全技術及應用實踐教程
- 網絡設備安全與防火墻
- 從實踐中學習Fiddler Web應用分析
- 業務安全關鍵技術與應用實踐
- Implementing AppFog
- Securing Docker
- Web滲透測試從新手到高手（微課超值版）
- 計算機病毒學
- Web滲透測試新手實操詳解
- 網絡安全防御技術與實踐
- Mastering Azure Security
