Book Image

Hands-On Bug Hunting for Penetration Testers

By : Joe Marshall, Himanshu Sharma
Book Image

Hands-On Bug Hunting for Penetration Testers

By: Joe Marshall, Himanshu Sharma

Overview of this book

Bug bounties have quickly become a critical part of the security economy. This book shows you how technical professionals with an interest in security can begin productively—and profitably—participating in bug bounty programs. You will learn about SQli, NoSQLi, XSS, XXE, and other forms of code injection. You’ll see how to create CSRF PoC HTML snippets, how to discover hidden content (and what to do with it once it’s found), and how to create the tools for automated pentesting work?ows. Then, you’ll format all of this information within the context of a bug report that will have the greatest chance of earning you cash. With detailed walkthroughs that cover discovering, testing, and reporting vulnerabilities, this book is ideal for aspiring security professionals. You should come away from this work with the skills you need to not only find the bugs you're looking for, but also the best bug bounty programs to participate in, and how to grow your skills moving forward in freelance security research.

Related Content you might be interested in

Current Title:

Small book image
Hands-On Bug Hunting for Penetration Testers
Joe Marshall | Himanshu Sharma
Sep, 2018 | 250 pages
Small book image
Bug Bounty Hunting Essentials
Carlos A Lozano | M Shahmeer Amir
Nov, 2018 | 270 pages
Small book image
Kali Linux Web Penetration Testing Cookbook
Gilberto NajeraGutierrez
Aug, 2018 | 404 pages
Small book image
Becoming the Hacker
Adrian Pruteanu
Jan, 2019 | 404 pages
Table of Contents (16 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Get in touch
Free Chapter
1
Joining the Hunt
Joining the Hunt
Technical Requirements
The Benefits of Bug Bounty Programs
What You Should Already Know – Pentesting Background
Setting Up Your Environment – Tools To Know
What You Will Learn – Next Steps
How (Not) To Use This Book – A Warning
Summary
Questions
Further Reading
2
Choosing Your Hunting Ground
Choosing Your Hunting Ground
Technical Requirements
An Overview of Bug Bounty Communities – Where to Start Your Search
The Vulnerability of Web Applications – What You Should Target
Evaluating Rules of Engagement – How to Protect Yourself
Summary
Questions
Further Reading
3
Preparing for an Engagement
Preparing for an Engagement
Technical Requirements
Attack Surface Reconnaisance – Strategies and the Value of Standardization
Summary
Questions
Further Reading
4
Unsanitized Data – An XSS Case Study
Unsanitized Data – An XSS Case Study
Technical Requirements
A Quick Overview of XSS – The Many Varieties of XSS
Testing for XSS – Where to Find It, How to Verify It
XSS – An End-To-End Example
Summary
Questions
Further Reading
5
SQL, Code Injection, and Scanners
SQL, Code Injection, and Scanners
Technical Requirements
SQLi and Other Code Injection Attacks – Accepting Unvalidated Data
Testing for SQLi With Sqlmap – Where to Find It and How to Verify It
Trawling for Bugs – Using Google Dorks and Python for SQLi Discovery
Scanning for SQLi With Arachni
NoSQL Injection – Injecting Malformed MongoDB Queries
SQLi – An End-to-End Example
Summary
Questions
Further Reading
6
CSRF and Insecure Session Authentication
CSRF and Insecure Session Authentication
Technical Requirements
Building and Using CSRF PoCs
CSRF – An End-to-End Example
Summary
Questions
Further Reading
7
Detecting XML External Entities
Detecting XML External Entities
Technical requirements
A simple XXE example
XML injection vectors
XML injection and XXE – stronger together
Testing for XXE – where to find it, and how to verify it
XXE – an end-to-end example
Summary
Questions
Further reading
8
Access Control and Security Through Obscurity
Access Control and Security Through Obscurity
Technical Requirements
Security by Obscurity – The Siren Song
Data Leaks – What Information Matters?
Low Value Data – What Doesn’t Matter
Data Leak Vectors
Unmasking Hidden Content – How to Pull the Curtains Back
Data Leakage – An End-to-End Example
Summary
Questions
Further Reading
9
Framework and Application-Specific Vulnerabilities
Framework and Application-Specific Vulnerabilities
Technical Requirements
Known Component Vulnerabilities and CVEs – A Quick Refresher
WordPress – Using WPScan
Ruby on Rails – Rubysec Tools and Tricks
Django – Strategies for the Python App
Summary
Questions
Further Reading
10
Formatting Your Report
Formatting Your Report
Technical Requirements
Reproducing the Bug – How Your Submission Is Vetted
Critical Information – What Your Report Needs
Maximizing Your Award – The Features That Pay
Example Submission Reports – Where to Look
Hackerone Hacktivity
Vulnerability Lab Archive
GitHub
Summary
Questions
Further Reading
11
Other Tools
Other Tools
Technical Requirements
Evaluating New Tools – What to Look For
Paid Versus Free Editions – What Makes a Tool Worth It?
A Quick Overview of Other Options – Nikto, Kali, Burp Extensions, and More
Summary
Questions
Further Reading
12
Other (Out of Scope) Vulnerabilities
Other (Out of Scope) Vulnerabilities
Technical Requirements
DoS/DDoS – The Denial-of-Service Problem
Sandboxed and Self-XSS – Low-Threat XSS Varieties
Non-Critical Data Leaks – What Companies Don’t Care About
Other Common No-Payout Vulnerabilities
Summary
Questions
Further Reading
13
Going Further
Going Further
Blogs
Courses
Summary
Questions
Further Reading
14
Assessment
Assessment
Chapter 1
Chapter 2
Chapter 3
Chapter 4
Chapter 5
Chapter 6
Chapter 7
Chapter 8
Chapter 9
Chapter 10
Chapter 11
Chapter 12
Chapter 13
15
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review - let other readers know what you think

Chapter 5

  1. Blind SQLi is SQLi where the results aren't visible; error-based SQLi expose sensitive information via carefully crafted SQL errors and time-based SQLi.
  2. Aggressive SQLi injections can potentially damage a database or application.
  3. Google Dorks are search queries designed to expose potentially vulnerable sites. The term comes from the hapless employee who mistakenly allows a sensitive document to be indexed by a public search engine.
  4. --timeout, checks, --scope-include-subdomains, --http-request-concurrency MAX_CONCURRENCY, and --plugin 'PLUGIN:OPTION=VALUE,OPTION2=VALUE2' are all useful configuration flags for the arachni CLI.
  5. You can generate reports from .afr files using the arachni_reporter CLI:
      arachni_reporter some_report.afr --reporter=html:outfile=my_report.html.zip

  1. The $where clause in MongoDB is particularly vulnerable to injection.
  2. If...
Previous Section
End of Section 6
Next Section