[Udemy] The Ultimate Web Application Bug Bounty Hunting Course [3/2026, ENG]

01. Introduction
2. What you will learn (01:32)
3. How I set up Burp (08:56)
02. Cross-site scripting (XSS)
1. XSS Methodology (22:37)
3. Reflected XSS into HTML context with nothing encoded (03:22)
4. Stored XSS into HTML context with nothing encoded (04:49)
5. DOM XSS in document.write sink using source location.search (04:14)
6. DOM XSS in innerHTML sink using source location.search (03:04)
7. DOM XSS in jQuery anchor href attribute sink using location.search source (03:16)
8. DOM XSS in jQuery selector sink using a hashchange event (05:23)
9. Reflected XSS into attribute with angle brackets HTML-encoded (03:52)
10. Stored XSS into anchor href attribute with double quotes HTML-encoded (04:35)
11. Reflected XSS into a JavaScript string with angle brackets HTML encoded (03:40)
12. DOM XSS in document.write sink using source location.search inside a select elem (05:00)
13. DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encod (03:32)
14. Reflected DOM XSS (04:47)
15. Stored DOM XSS (04:05)
16. Exploiting cross-site scripting to steal cookies (04:06)
17. Exploiting cross-site scripting to capture passwords (02:50)
18. Exploiting XSS to perform CSRF (05:19)
19. Reflected XSS into HTML context with most tags and attributes blocked (05:41)
20. Reflected XSS into HTML context with all tags blocked except custom ones (02:49)
21. Reflected XSS with some SVG markup allowed (04:09)
22. Reflected XSS in canonical link tag (04:30)
23. Reflected XSS into a JavaScript string with single quote and backslash escaped (03:05)
24. Reflected XSS into a JavaScript string with angle brackets and double quotes HTM (03:18)
25. Stored XSS into onclick event with angle brackets and double quotes HTML-encoded (05:04)
26. Reflected XSS into a template literal with angle brackets, single, double quotes (02:57)
03. Cross-site request forgery (CSRF)
1. CSRF Methodology (10:58)
3. CSRF vulnerability with no defenses (05:15)
4. CSRF where token validation depends on request method (03:12)
5. CSRF where token validation depends on token being present (02:46)
6. CSRF where token is not tied to user session (05:00)
7. CSRF where token is tied to non-session cookie (08:27)
8. CSRF where token is duplicated in cookie (05:12)
9. SameSite Lax bypass via method override (04:10)
10. SameSite Strict bypass via client-side redirect (07:09)
11. SameSite Strict bypass via sibling domain (05:35)
12. SameSite Lax bypass via cookie refresh (04:08)
13. CSRF where Referer validation depends on header being present (02:53)
14. CSRF with broken Referer validation (03:52)
04. Open Redirect
1. Open Redirect Methodology (14:46)
3. Open Redirect Lab 1 (06:46)
4. Open Redirect Lab 2 (05:11)
5. Open Redirect Lab 3 (04:03)
6. Open Redirect Lab 4 (05:22)
05. Bypassing Access Control
1. Bypassing Access Control Methodology (09:45)
3. Unprotected admin functionality (02:06)
4. Unprotected admin functionality with unpredictable URL (02:17)
5. User role controlled by request parameter (02:21)
6. User role can be modified in user profile (03:25)
7. User ID controlled by request parameter (02:53)
8. User ID controlled by request parameter, with unpredictable user IDs (03:21)
9. User ID controlled by request parameter with data leakage in redirect (02:18)
10. User ID controlled by request parameter with password disclosure (02:41)
11. URL-based access control can be circumvented (03:44)
12. Method-based access control can be circumvented (04:27)
13. Multi-step process with no access control on one step (03:22)
14. Referer-based access control (04:00)
06. Server-side request forgery (SSRF)
1. Server-side request forgery (SSRF) Methodology (11:09)
3. Basic SSRF against the local server (04:24)
4. Basic SSRF against another back-end system (03:46)
5. SSRF with blacklist-based input filter (03:44)
6. SSRF with filter bypass via open redirection vulnerability (03:45)
7. Blind SSRF with out-of-band detection (02:04)
07. SQL injection
1. SQL injection Methodology (12:25)
3. SQL injection vulnerability in WHERE clause allowing retrieval of hidden data (05:35)
4. SQL injection vulnerability allowing login bypass (03:51)
5. SQL injection UNION attack, determining the number of columns returned (02:17)
6. SQL injection UNION attack, finding a column containing text (03:08)
7. SQL injection UNION attack, retrieving data from other tables (03:48)
8. SQL injection UNION attack, retrieving multiple values in a single column (03:29)
9. SQL injection attack, querying the database type and version on Oracle (03:55)
10. SQL injection attack, querying the database type and version on MySQL and MS (02:27)
11. SQL injection attack, listing the database contents on non-Oracle databases (06:11)
12. SQL injection attack, listing the database contents on Oracle (05:02)
13. Blind SQL injection with conditional responses (07:19)
14. Blind SQL injection with conditional errors (06:10)
15. Blind SQL injection with time delays (02:56)
16. Blind SQL injection with time delays and information retrieval (05:39)
17. Blind SQL injection with out-of-band interaction (04:33)
18. Blind SQL injection with out-of-band data exfiltration (04:31)
19. SQL injection with filter bypass via XML encoding (03:22)
20. Visible error-based SQL injection (08:19)
08. OS command injection
1. OS command injection Methodology (03:32)
3. OS command injection, simple case (02:57)
4. Blind OS command injection with time delays (02:17)
5. Blind OS command injection with output redirection (03:07)
6. Blind OS command injection with out-of-band interaction (02:21)
7. Blind OS command injection with out-of-band data exfiltration (02:19)
09. Insecure Direct Object References (IDOR)
1. Insecure Direct Object References (IDOR) Methodology (12:25)
3. IDOR Lab 1 (03:29)
4. IDOR Lab 2 (06:14)
5. IDOR Lab 3 (05:00)
6. IDOR Lab 4 (02:54)
10. XML external entity (XXE) injection
1. XML external entity (XXE) injection Methodology (08:58)
3. Exploiting XXE using external entities to retrieve files (03:38)
4. Exploiting XXE to perform SSRF attacks (03:48)
5. Blind XXE with out-of-band interaction (03:39)
6. Blind XXE with out-of-band interaction via XML parameter entities (02:59)
7. Exploiting blind XXE to exfiltrate data using a malicious external DTD (04:39)
8. Exploiting blind XXE to retrieve data via error messages (03:39)
9. Exploiting XInclude to retrieve files (03:02)
10. Exploiting XXE via image file upload (03:39)
11. API Testing
1. API Methodology (09:03)
12. File upload vulnerabilities
1. File upload vulnerabilities Methodology (09:31)
3. Remote code execution via web shell upload (04:52)
4. Web shell upload via Content-Type restriction bypass (04:02)
5. Web shell upload via path traversal (04:22)
6. Web shell upload via extension blacklist bypass (03:10)
7. Web shell upload via obfuscated file extension (02:32)
8. Remote code execution via polyglot web shell upload (05:23)
13. Java Script analysis
1. Java Script analysis Methodology (07:09)
3. Java Script Lab 1 (05:47)
4. Java Script Lab 2 (04:13)
5. Java Script Lab 3 (04:56)
6. Java Script Lab 4 (06:56)
14. Cross-origin resource sharing (CORS)
1. Cross-origin resource sharing (CORS) Methodology (11:21)
3. CORS vulnerability with basic origin reflection (05:18)
4. CORS vulnerability with trusted null origin (04:56)
5. CORS vulnerability with trusted insecure protocols (05:20)
15. Business logic vulnerabilities
1. Business logic vulnerabilities Methodology (09:52)
3. Excessive trust in client-side controls (02:56)
4. High-level logic vulnerability (03:33)
5. Inconsistent security controls (02:45)
6. Flawed enforcement of business rules (03:50)
7. Low-level logic flaw (06:26)
8. Inconsistent handling of exceptional input (05:25)
9. Weak isolation on dual-use endpoint (03:49)
10. Insufficient workflow validation (02:54)
11. Authentication bypass via flawed state machine (03:15)
12. Infinite money logic flaw (06:49)
13. Authentication bypass via encryption oracle (09:31)
16. Registration flaws
1. Registration flaws Methodology (10:48)
17. Login flaws
1. Login flaws Methodology (05:30)
18. Password reset flaws
1. Password reset flaws Methodology (04:59)
3. Password reset broken logic (03:04)
4. Password reset poisoning via middleware (03:47)
5. Basic password reset poisoning (03:50)
19. Updating account flaws
1. Updating account Methodology (08:51)
20. Developer tools flaws
1. Developer tools Methodology (10:46)
21. Analysis of the core application
1. Analysis of the core application Methodology (10:58)
22. Payment feature flaws
1. Payment feature Methodology (06:55)
23. Premium feature flaws
1. Premium feature Methodology (03:31)
24. Directory Traversal
1. Directory Traversal Methodology (06:46)
3. File path traversal, simple case (03:43)
4. File path traversal, traversal sequences blocked with absolute path bypass (02:07)
5. File path traversal, traversal sequences stripped non-recursively (02:32)
6. File path traversal, traversal sequences stripped with superfluous URL-decode (02:49)
7. File path traversal, validation of start of path (02:08)
8. File path traversal, validation of file extension with null byte bypass (02:43)
25. Methodology to find most bugs
1. Bug Finding Methodology (12:23)
26. Mystery Labs
1. Mystery Lab 1 (07:29)
2. Mystery Lab 2 (09:43)
3. Mystery Lab 3 (08:14)
4. Mystery Lab 4 (06:25)
5. Mystery Lab 5 (06:07)
6. Mystery Lab 6 (10:04)
27. AI Automation
1. AI Automation (10:20)