Muutke küpsiste eelistusi

Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities [Pehme köide]

4.50/5 (210 hinnangut Goodreads-ist)
  • Formaat: Paperback / softback, 416 pages, kõrgus x laius: 235x178 mm
  • Ilmumisaeg: 07-Dec-2021
  • Kirjastus: No Starch Press,US
  • ISBN-10: 1718501544
  • ISBN-13: 9781718501546
Teised raamatud teemal:
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web VulnerabilitiesSuurem pilt
  • Formaat: Paperback / softback, 416 pages, kõrgus x laius: 235x178 mm
  • Ilmumisaeg: 07-Dec-2021
  • Kirjastus: No Starch Press,US
  • ISBN-10: 1718501544
  • ISBN-13: 9781718501546
Teised raamatud teemal:
Püsilink: https://www.kriso.ee/db/9781718501546.html
Märksõnad:
Teaches you how to hack web applications, including learning how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them. You’ll also learn how to navigate bug bounty programs set up by companies to reward security professionals for finding bugs in their web applications.

"A comprehensive guide designed to prepare any application security tester for participation in bug bounty programs. Beginning with a thorough overview of how to get started in the bug bounty industry, the book then dives into how to prevent, exploit, and escalate specific vulnerabilities before concluding with in-depth techniques for the experienced hacker"--

Arvustused

"A really good book for getting started in Bug Bounty, out at a time when something like this was really needed. You can take as many ethical hacking courses as you want, but when it comes to bug bounty, there is so much information and tools it can be imitating to start . . . This really should be the first book read by ANYONE looking to start in the bug bounty game." Alex/Muldwych, The Security Noob

"Bug Bounty Bootcamp should be on every hacker's shelf. Vickie Li answers an important question: 'So you found your first flaw, what's next?' By explaining how to write a bug report and interact with clients, she presents a wonderful guide on starting your security career." Andrew Orr, Associate Editor, The Mac Observer

"I have enjoyed Bug Bounty Bootcamp over the past few weeks and this is great for bug bounty beginners like myself. Anyone who is interested in learning more about different web vulnerabilities, bug bounty platforms, how the internet works, and how to make money making the web safer this is the book for you. Thanks to Vickie for writing such a great book!" The Digital Empress, YouTuber and Blogger

"Bug Bounty Bootcamp by Vickie Li is a thorough and masterful explanation for how to find bugs and responsibly report them. It is written so clearly, and provides such useful step-by-step instructions that as I was reading it, I was tempted to start hunting for bugs myself." Cynthia Brumfield, President, DCT-Associates

"Bug Bounty Bootcamp is a great resource for those who want to participate in Bug Bounties because it not only teaches you about the technical aspects, but helps you develop a methodology and sustain your testing. Some technology knowledge is assumed, but it does a solid job of describing the relevant vulnerability types from first principles, so it can be a strong resource for those new to the security space. The writing style is clear and to the point." David Tomaschik, Security Engineer at Google, Blogger at System Overlord

"I highly suggest reading Bug Bounty Bootcamp." @HolyBugx

"Pure GEM. Learned a lot of things from her book." Aakash Choudhary, @LearnerHunter

"Loved the book. Well written, clear, concise, and easy to follow. Everyone from the beginner bug hunter to the seasoned pro will find a nugget, some nuggets or just pure nuggets of amazing information, tips and advice." Douglas Campbell, Advanced Reviewer

"The only book you need to get started in bug bounty is @vickieli7's book coming out from @nostarch, Bug Bounty Bootcamp. It's a detailed how-to with lots of technical how-to steps." Metacurity, Top Infosec News Destination, @Metacurity

"The new go-to resource for a beginner in web app hacking . . . I recommend this book before anything else for a beginner trying to learn web security. Vickie provides an excellent delivery of breaking down complex concepts that makes it easy to comprehend. Also, the step by step guidance of exploiting a vulnerability is fantastic to refer back to . . . If you are a complete beginner and feel confused or lost in all of the information out there then stop, grab this book, read through it once, then use it as your guide." AntiRuse, @AntiRuse, Blogger

"Definitely recommend it!" Michael, @DoAbarrel_Troll

"Bug Bounty Bootcamp is *the* book for everyone in Information Technology, not just those interested in bug bounties . . . This easy-to-read guide breaks down complicated topics into a simple progression through technical concepts. From a foundational overview of the industry and how to get started, the reader progresses from Cross Site Scripting all the way through to API hacking and use of Fuzzers. Vickie Li has done a tremendous service to information security by sharing her expert understanding of bug hunting in a highly accessible way. Recommended reading for all IT professionals, new or veteran." Jess Vachon, Advanced Reviewer

"Vicki Lis book took me from knowing nothing about bug bounties, to finding my first bug. Li goes over the process of bug bounties, writing reports, and how to make relationships with companies. Li also has expert techniques that will help your automate your hacking experience and even hacking android apps." Anthony Ware, Advanced Reviewer

"For anyone interested in bug detection of web services, this book is for you. It takes an approach that is enjoyable for all levels. It covers the essentials for understanding web servers and why the assortment of vulnerabilities exists with steps in what to look for in approaching those security risks. Its not going to make you an expert overnight, but it will set you on the path towards success, bypassing the common mistakes where others have fallen." Riley A., Advanced Reviewer

"Step-by-step instructions to achieve your first bug bounty and a great book to reference as a security professional. This book will give insight to how bug bounty programs operate and provide resources to learn programming, security tools, and breakdown OWASP top 10 vulnerabilities." Jessica W., Advanced Reviewer

"Since reading The Web Application Hacker's Handbook a few years ago, I haven't seen that much web security knowledge organized in one place as in Bug Bounty Bootcamp. Vickie did a fantastic job of covering many different vulnerability classes that are important for offensively testing web applications. Explanations are made so that beginners would understand them but I was also able to find some inspirations each time I looked at the book when testing a specific vulnerability class. I highly recommend Bug Bounty Bootcamp for everyone who wants to learn about web security." Bug Bounty Reports Explained, YouTuber and Advanced Reviewer

"A great companion to @yaworsk's earlier book, Real-World Bounty Hunting (also by @nostarch), and deserves a place on your bookshelf." @jub0bs

"An informative and well-written guide that should be of interest to anyone considering a career in API hacking through bug bounty hunting." Dana Epp, Security Boulevard

Foreword xix
Introduction xxi
Who This Book Is For xxiii
What Is In This Book xxii
Happy Hacking! xxiv
PART I THE INDUSTRY
1(30)
1 Picking A Bug Bounty Program
3(12)
The State of the Industry
4(1)
Asset Types
4(1)
Social Sites and Applications
5(1)
General Web Applications
5(1)
Mobile Applications (Android, iOS, and Windows)
6(1)
APIs
6(1)
Source Code and Executables
7(1)
Hardware and IoT
7(1)
Bug Bounty Platforms
8(1)
The Pros
8(1)
And the Cons
9(1)
Scope, Payouts, and Response Times
9(1)
Program Scope
9(1)
Payout Amounts
10(1)
Response Time
11(1)
Private Programs
11(1)
Choosing the Right Program
12(1)
A Quick Comparison of Popular Programs
13(2)
2 Sustaining Your Success
15(16)
Writing a Good Report
16(1)
Step 1 Craft a Descriptive Title
16(1)
Step 2 Provide a Clear Summary
16(1)
Step 3 Include a Severity Assessment
16(2)
Step 4 Give Clear Steps to Reproduce
18(1)
Step 5 Provide a Proof of Concept
18(1)
Step 6 Describe the Impact and Attack Scenarios
19(1)
Step 7 Recommend Possible Mitigations
19(1)
Step 8 Validate the Report
20(1)
Additional Tips for Writing Better Reports
20(1)
Building a Relationship with the Development Team
21(1)
Understanding Report States
21(2)
Dealing with Conflict
23(1)
Building a Partnership
23(1)
Understanding Why You're Failing
24(1)
Why You're Not Finding Bugs
24(2)
Why Your Reports Get Dismissed
26(1)
What to Do When You're Stuck
27(1)
Step 1 Take a Break!
28(1)
Step 2 Build Your Skill Set
28(1)
Step 3 Gain a Fresh Perspective
28(1)
Lastly, a Few Words of Experience
29(2)
PART II GETTING STARTED
31(78)
3 How the Internet Works
33(12)
The Client-Server Model
34(1)
The Domain Name System
34(1)
Internet Ports
35(1)
HTTP Requests and Responses
36(2)
Internet Security Controls
38(1)
Content Encoding
38(1)
Session Management and HTTP Cookies
39(1)
Token-Based Authentication
40(1)
JSON Web Tokens
41(2)
The Same-Origin Policy
43(1)
Learn to Program
44(1)
4 Environmental Setup and Traffic Interception
45(16)
Choosing an Operating System
46(1)
Setting Up the Essentials: A Browser and a Proxy
46(1)
Opening the Embedded Browser
47(1)
Setting Up Firefox
47(2)
Setting Up Burp
49(2)
Using Burp
51(1)
The Proxy
52(2)
The Intruder
54(2)
The Repeater
56(1)
The Decoder
57(1)
The Comparer
58(1)
Saving Burp Requests
58(1)
A Final Note on Taking Notes
58(3)
5 Web Hacking Reconnaissance
61(48)
Manually Walking Through the Target
62(1)
Google Dorking
62(3)
Scope Discovery
65(1)
WHOIS and Reverse WHOIS
65(1)
IP Addresses
66(1)
Certificate Parsing
67(1)
Subdomain Enumeration
68(1)
Service Enumeration
69(1)
Directory Brute-Forcing
70(1)
Spidering the Site
71(3)
Third-Party Hosting
74(1)
GitHub Recon
75(2)
Other Sneaky OSINT Techniques
77(1)
Tech Stack Fingerprinting
78(2)
Writing Your Own Recon Scripts
80(1)
Understanding Bash Scripting Basics
80(3)
Saving Tool Output to a File
83(1)
Adding the Date of the Scan to the Output
84(1)
Adding Options to Choose the Tools to Run
84(1)
Running Additional Tools
85(3)
Parsing the Results
88(2)
Building a Master Report
90(2)
Scanning Multiple Domains
92(4)
Writing a Function Library
96(1)
Building Interactive Programs
97(3)
Using Special Variables and Characters
100(2)
Scheduling Automatic Scans
102(2)
A Note on Recon APIs
104(1)
Start Hacking!
104(1)
Tools Mentioned in This
Chapter
105(1)
Scope Discovery
105(1)
OSINT
106(1)
Tech Stack Fingerprinting
106(1)
Automation
107(2)
PART III WEB VULNERABILITIES
109(224)
6 Cross-Site Scripting
111(20)
Mechanisms
112(3)
Types of XSS
115(1)
Stored XSS
115(1)
Blind XSS
116(1)
Reflected XSS
117(1)
DOM-Based XSS
117(2)
Self-XSS
119(1)
Prevention
119(1)
Hunting for XSS
120(1)
Step 1 Look for Input Opportunities
120(2)
Step 2 Insert Payloads
122(3)
Step 3 Confirm the Impact
125(1)
Bypassing XSS Protection
126(1)
Alternative JavaScript Syntax
126(1)
Capitalization and Encoding
126(1)
Filter Logic Errors
127(1)
Escalating the Attack
128(1)
Automating XSS Hunting
129(1)
Finding Your First XSS!
129(2)
7 Open Redirects
131(12)
Mechanisms
131(2)
Prevention
133(1)
Hunting for Open Redirects
133(1)
Step 1 Look for Redirect Parameters
133(1)
Step 2 Use Google Dorks to Find Additional Redirect Parameters
134(1)
Step 3 Test for Parameter-Based Open Redirects
135(1)
Step 4 Test for Referer-Based Open Redirects
135(1)
Bypassing Open-Redirect Protection
136(1)
Using Browser Autocorrect
136(1)
Exploiting Flawed Validator Logic
137(1)
Using Data URLs
138(1)
Exploiting URL Decoding
138(2)
Combining Exploit Techniques
140(1)
Escalating the Attack
140(1)
Finding Your First Open Redirect!
141(2)
8 Clickjacking
143(12)
Mechanisms
144(5)
Prevention
149(1)
Hunting for Clickjacking
150(1)
Step 1 Look for State-Changing Actions
150(1)
Step 2 Check the Response Headers
151(1)
Step 3 Confirm the Vulnerability
151(1)
Bypassing Protections
151(2)
Escalating the Attack
153(1)
A Note on Delivering the Clickjacking Payload
154(1)
Finding Your First Clickjacking Vulnerability!
154(1)
9 Cross-Site Request Forgery
155(20)
Mechanisms
156(3)
Prevention
159(2)
Hunting for CSRFs
161(1)
Step 1 Spot State-Changing Actions
161(1)
Step 2 Look for a Lack of CSRF Protections
161(1)
Step 3 Confirm the Vulnerability
162(1)
Bypassing CSRF Protection
163(1)
Exploit Clickjacking
163(1)
Change the Request Method
164(1)
Bypass CSRF Tokens Stored on the Server
165(2)
Bypass Double-Submit CSRF Tokens
167(1)
Bypass CSRF Referer Header Check
168(2)
Bypass CSRF Protection by Using XSS
170(1)
Escalating the Attack
170(1)
Leak User Information by Using CSRF
170(1)
Create Stored Self-XSS by Using CSRF
171(1)
Take Over User Accounts by Using CSRF
172(1)
Delivering the CSRF Payload
173(1)
Finding Your First CSRF!
174(1)
10 Insecure Direct Object References
175(12)
Mechanisms
175(2)
Prevention
177(1)
Hunting for IDORs
178(1)
Step 1 Create Two Accounts
178(1)
Step 2 Discover Features
178(1)
Step 3 Capture Requests
179(1)
Step 4 Change the IDs
180(1)
Bypassing IDOR Protection
181(1)
Encoded IDs and Hashed IDs
181(1)
Leaked IDs
182(1)
Offer the Application an ID, Even If It Doesn't Ask for One
182(1)
Keep an Eye Out for Blind IDORs
183(1)
Change the Request Method
183(1)
Change the Requested File Type
184(1)
Escalating the Attack
184(1)
Automating the Attack
185(1)
Finding Your First IDOR!
185(2)
11 SQL Injection
187(18)
Mechanisms
188(1)
Injecting Code into SQL Queries
189(2)
Using Second-Order SQL Injections
191(1)
Prevention
192(3)
Hunting for SQL Injections
195(1)
Step 1 Look for Classic SQL Injections
195(1)
Step 2 Look for Blind SQL Injections
196(2)
Step 3 Exfiltrate Information by Using SQL Injections
198(1)
Step 4 Look for NoSQL Injections
199(2)
Escalating the Attack
201(1)
Learn About the Database
201(1)
Gain a Web Shell
202(1)
Automating SQL Injections
202(1)
Finding Your First SQL Injection!
203(2)
12 Race Conditions
205(8)
Mechanisms
206(1)
When a Race Condition Becomes a Vulnerability
207(3)
Prevention
210(1)
Hunting for Race Conditions
210(1)
Step 1 Find Features Prone to Race Conditions
210(1)
Step 2 Send Simultaneous Requests
210(1)
Step 3 Check the Results
211(1)
Step 4 Create a Proof of Concept
211(1)
Escalating Race Conditions
212(1)
Finding Your First Race Condition!
212(1)
13 Server-Side Request Forgery
213(18)
Mechanisms
213(2)
Prevention
215(1)
Hunting for SSRFs
216(1)
Step 1 Spot Features Prone to SSRFs
216(2)
Step 2 Provide Potentially Vulnerable Endpoints with Internal URLs
218(1)
Step 3 Check the Results
218(2)
Bypassing SSRF Protection
220(1)
Bypass Allowlists
220(1)
Bypass Blocklists
221(3)
Escalating the Attack
224(1)
Perform Network Scanning
224(2)
Pull Instance Metadata
226(1)
Exploit Blind SSRFs
227(1)
Attack the Network
228(1)
Finding Your First SSRF!
229(2)
14 Insecure Deserialization
231(16)
Mechanisms
232(1)
PHP
232(9)
Java
241(3)
Prevention
244(1)
Hunting for Insecure Deserialization
244(1)
Escalating the Attack
245(1)
Finding Your First Insecure Deserialization!
246(1)
15 XML External Entity
247(14)
Mechanisms
247(2)
Prevention
249(1)
Hunting for XXEs
250(1)
Step 1 Find XML Data Entry Points
250(1)
Step 2 Test for Classic XXE
251(1)
Step 3 Test for Blind XXE
252(1)
Step 4 Embed XXE Payloads in Different File Types
253(1)
Step 5 Test for Xlnclude Attacks
254(1)
Escalating the Attack
254(1)
Reading Files
255(1)
Launching an SSRF
255(1)
Using Blind XXEs
256(2)
Performing Denial-of-Service Attacks
258(1)
More About Data Exfiltration Using XXEs
259(1)
Finding Your First XXE!
260(1)
16 Template Injection
261(14)
Mechanisms
262(1)
Template Engines
262(1)
Injecting Template Code
263(2)
Prevention
265(1)
Hunting for Template Injection
266(1)
Step 1 Look for User-Input Locations
266(1)
Step 2 Detect Template Injection by Submitting Test Payloads
266(2)
Step 3 Determine the Template Engine in Use
268(1)
Escalating the Attack
268(1)
Searching for System Access via Python Code
269(1)
Escaping the Sandbox by Using Python Built-in Functions
270(3)
Submitting Payloads for Testing
273(1)
Automating Template Injection
273(1)
Finding Your First Template Injection!
274(1)
17 Application Logic Errors And Broken Access Control
275(8)
Application Logic Errors
276(2)
Broken Access Control
278(1)
Exposed Admin Panels
278(1)
Directory Traversal Vulnerabilities
279(1)
Prevention
279(1)
Hunting for Application Logic Errors and Broken Access Control
280(1)
Step 1 Learn About Your Target
280(1)
Step 2 Intercept Requests While Browsing
280(1)
Step 3 Think Outside the Box
280(1)
Escalating the Attack
281(1)
Finding Your First Application Logic Error or Broken Access Control!
281(2)
18 Remote Code Execution
283(12)
Mechanisms
284(1)
Code Injection
284(2)
File Inclusion
286(1)
Prevention
287(1)
Hunting for RCEs
288(1)
Step 1 Gather Information About the Target
289(1)
Step 2 Identify Suspicious User Input Locations
289(1)
Step 3 Submit Test Payloads
289(1)
Step 4 Confirm the Vulnerability
290(1)
Escalating the Attack
291(1)
Bypassing RCE Protection
291(2)
Finding Your First RCE!
293(2)
19 Same-Origin Policy Vulnerabilities
295(12)
Mechanisms
296(1)
Exploiting Cross-Origin Resource Sharing
297(1)
Exploiting postMessage()
298(2)
Exploiting JSON with Padding
300(2)
Bypassing SOP by Using XSS
302(1)
Hunting for SOP Bypasses
302(1)
Step 1 Determine If SOP Relaxation Techniques Are Used
302(1)
Step 2 Find CORS Misconfiguration
303(1)
Step 3 Find postMessage Bugs
304(1)
Step 4 Find JSONP Issues
305(1)
Step 5 Consider Mitigating Factors
305(1)
Escalating the Attack
305(1)
Finding Your First SOP Bypass Vulnerability!
306(1)
20 Single-Sign-On Security Issues
307(16)
Mechanisms
308(1)
Cooking Sharing
308(1)
Security Assertion Markup Language
309(3)
OAuth
312(4)
Hunting for Subdomain Takeovers
316(1)
Step 1 List the Target's Subdomains
316(1)
Step 2 Find Unregistered Pages
316(1)
Step 3 Register the Page
317(1)
Monitoring for Subdomain Takeovers
318(1)
Hunting for SAML Vulnerabilities
319(1)
Step 1 Locate the SAML Response
319(1)
Step 2 Analyze the Response Fields
319(1)
Step 3 Bypass the Signature
319(1)
Step 4 Re-encode the Message
320(1)
Hunting for OAuth Token Theft
320(1)
Escalating the Attack
321(1)
Finding Your First SSO Bypass!
321(2)
21 Information Disclosure
323(10)
Mechanisms
324(1)
Prevention
324(1)
Hunting for Information Disclosure
325(1)
Step 1 Attempt a Path Traversal Attack
325(1)
Step 2 Search the Wayback Machine
326(1)
Step 3 Search Paste Dump Sites
327(1)
Step 4 Reconstruct Source Code from an Exposed .git Directory
328(3)
Step 5 Find Information in Public Files
331(1)
Escalating the Attack
332(1)
Finding Your First Information Disclosure!
332(1)
PART IV EXPERT TECHNIQUES
333(48)
22 Conducting Code Reviews
335(12)
White-Box vs. Black-Box Testing
336(1)
The Fast Approach: grep Is Your Best Friend
336(1)
Dangerous Patterns
336(2)
Leaked Secrets and Weak Encryption
338(2)
New Patches and Outdated Dependencies
340(1)
Developer Comments
340(1)
Debug Functionalities, Configuration Files, and Endpoints
340(1)
The Detailed Approach
341(1)
Important Functions
341(1)
User Input
342(2)
Exercise: Spot the Vulnerabilities
344(3)
23 Hacking Android Apps
347(8)
Setting Up Your Mobile Proxy
348(1)
Bypassing Certificate Pinning
349(1)
Anatomy of an APK
350(1)
Tools to Use
351(1)
Android Debug Bridge
351(1)
Android Studio
352(1)
Apktool
352(1)
Frida
353(1)
Mobile Security Framework
353(1)
Hunting for Vulnerabilities
353(2)
24 API Hacking
355(14)
What Are APIs?
355(2)
REST APIs
357(1)
SOAP APIs
358(1)
GraphQL APIs
358(3)
API-Centric Applications
361(1)
Hunting for API Vulnerabilities
362(1)
Performing Recon
362(2)
Testing for Broken Access Control and Info Leaks
364(1)
Testing for Rate-Limiting Issues
365(1)
Testing for Technical Bugs
366(3)
25 Automatic Vulnerability Discovery Using Fuzzers
369(12)
What Is Fuzzing?
370(1)
How a Web Fuzzer Works
370(1)
The Fuzzing Process
371(1)
Step 1 Determine the Data Injection Points
371(1)
Step 2 Decide on the Payload List
372(1)
Step 3 Fuzz
372(2)
Step 4 Monitor the Results
374(1)
Fuzzing with Wfuzz
374(1)
Path Enumeration
374(2)
Brute-Forcing Authentication
376(1)
Testing for Common Web Vulnerabilities
377(1)
More About Wfuzz
378(1)
Fuzzing vs. Static Analysis
378(1)
Pitfalls of Fuzzing
378(1)
Adding to Your Automated Testing Toolkit
379(2)
Index 381
Vickie Li is a developer and security researcher experienced in finding and exploiting vulnerabilities in web applications. She has reported vulnerabilities to firms such as Facebook, Yelp and Starbucks and contributes to a number of online training programs and technical blogs.