Have you ever thought of hacking web applications for fun and profit? How about playing with authentic, award-winning security bugs identified at some of the greatest companies? If that sounds interesting, join this unique 100% hands-on [...]
  • QABBPTBHO-QA
  • Price on request

Have you ever thought of hacking web applications for fun and profit? How about playing with authentic, award-winning security bugs identified at some of the greatest companies? If that sounds interesting, join this unique 100% hands-on training.I will discuss security bugs found in a number of bug bounty programs (including Google, Yahoo, Mozilla, Twitter and others). You will learn how bug hunters think and how to hunt for and exploit vulnerabilities effectively.To be successful in bug hunting, you need to go beyond automated scanners. If you are not afraid of going into detail and diving into full-stack exploitation, then this 100% hands-on training is for you. There is a lab exercise for each attack presented in this training + students can take the complete lab environment home after the training session.

  • browser-dependent exploitation
  • DOM-based exploitation
  • exploiting race conditions
  • remote cookie tampering
  • bypassing Content Security Policy
  • exploiting type confusion
  • exploiting parameter pollution
  • hijacking tokens via PDF
  • exploiting DB truncation
  • exploiting NoSQL injection
  • using wrappers to launch RCE
  • RCE via serialization/deserialization
  • exploiting path-relative stylesheet import
  • exploiting reflected file download (various browsers)
  • hacking AngularJS applications
  • non-standard XSS attacks
  • hacking with polyglot
  • subdomain takeover
  • REST API hacking
  • XML attacks
  • advanced clickjacking in modern browsers
  • advanced SSRF with gopher protocol
  • bypassing XSS protection with Shift_JIS encoding
  • chaining vulnerabilities for red team objectives
  • and more …

I am interested in selected QA course