Original subtitles

1

Hello, welcome to the Web security and bug bounty course now you've already seen the promo video and

2

you kind of know what this course is about, but in this video, we want to do a full course outline

3

so that you know exactly what we're going to learn, so that you have a clear path to success and what

4

this course is going to give you.

5

Now, one thing to keep in mind is that this course isn't just for ethical hackers or penetration testers.

6

We've made this course so that anybody that's interested in Web security can learn from it.

7

So if you are a web developer that wants to improve their web security, well, this course is for you

8

as well.

9

And obviously, if you want to become a bug bounty hunter or a penetration tester, well, this course

10

is definitely for you as well.

11

All right.

12

Let's get into actually what the course is going to look like for you right off the bat.

13

We're going to start off by creating what we call our virtual.

14

This is a hacking lab to make sure that we keep our computers safe throughout the course and we can

15

do different sorts of attacks and experiments on them.

16

And this course is going to work with any type of system that you have, Linux, Windows, Mac OS,

17

everything's going to work because we're going to set up this virtual lab for you.

18

From there, we're going to learn about enumeration and information gathered.

19

This is where we actually start with the bug bounty and website penetration testing.

20

We cover numerous topics and tools that allow us to gather as much information about a certain Web site

21

as possible.

22

From there, we get into introducing you to burps.

23

And this is a very important tool of a bug hunter.

24

And it will set us up for a lot of the topics that we cover later in the course.

25

We then get into our first but and this first bug on our website, we're going to talk about a Schimel

26

injection.

27

It's one of the easier bugs to find and use.

28

So this is where we start.

29

But then we get into more complex topics.

30

For example, we're going to talk about command injections and execution.

31

This is an extremely dangerous bug where we can inject commands through an input and affect a server

32

or a system.

33

We then talk about broken authentication.

34

What happens when authentication on a Web site is not done properly?

35

Well, we can take advantage of it and we're going to show you how to do that.

36

And we're going to use different examples to things like cookie values, HTP requests, forgot password

37

page and a lot more.

38

We then get into brute force attacks even if a website is secure.

39

If we as testers have an easy and simple password set, then it's also going to be easy for us to guess

40

it using what we call brute force attacks.

41

And we're going to show you how to prevent brute force attacks as well as show you how they work.

42

We then talk about broken access control.

43

Access control enforces policy such as what user can and cannot do or intended permissions for a user.

44

When that access control is broken, well, we can take advantage of it.

45

Then we dive into what we call cross site scripting.

46

This is a very common attack and we're going to talk about all three main types of cross site scripting

47

which are stored, reflected and DOM based cross site scripting.

48

Then we dive into one of the most common ways that you can effect a system and probably one of the bigger

49

vulnerabilities that always comes up, and that is escarole injection.

50

This is where we're able to access or manipulate the database.

51

This is probably one of the most important section.

52

And again, we're going to talk about how we can use it and also how to prevent it.

53

I know we have a lot.

54

There's still a few more in this section.

55

We're going to talk about XML data and how we can use Xixi or XML external entity where it allows an

56

attacker to interfere with a website that processes XML data.

57

Finally, we talk about the idea of insufficient logging and monitoring.

58

You see, to have proper security, you need to have proper logging and monitoring to keep track of

59

all the requests and information that a page might go through, because this can help us determine whether

60

a certain attack is taking place or not.

61

If we don't know when an attack is taking place while then we're just not going to notice it.

62

So this is another important topic that we left towards the end of the course.

63

But then probably why you're taking this course.

64

And the most exciting part is right here, the bug hunting.

65

So we're going to talk about how to monetize bug hunting.

66

How can you become an independent researcher that tests Web sites and perhaps collect bug bounty?

67

Everything that we've learned in this course, we're going to show you how to you can monetize this

68

knowledge.

69

And we're going to talk to you about different platforms that you can use to start a career as a bug

70

hunter, if that's something that you want to do.

71

Finally, this course is meant for anybody with any sort of programming knowledge.

72

As a matter of fact, you can take this course without any programming knowledge.

73

We include bonus material for web.

74

Developer fundamentals, bonus material on Linux and how to use the Linux terminal and even networking.

75

The idea is to take you from zero to mastery.

76

Finally, this course, well, you're in good hands because Alexa is a penetration tester with many

77

years of experience.

78

And he's actually worked on discovering vulnerabilities for multiple companies and government systems.

79

He's going to show you from his professional standpoint how all of this work and how you can actually

80

apply this in real life.

81

It's going to be a ton of fun.

82

And the final thing I want to talk about is our community that we have.

83

When he joined this course, as always, as part of the Zurda Mastery community, you get to join our

84

private online discord where we're chatting with people every day, helping each other out, solving

85

problems, doing challenges together and feeling like you're part of a classroom.

86

You're going to find myself in it there every day chatting.

87

And we have a dedicated channel just for this course so that you get to meet other classmates.

88

All right, that's enough talk.

89

I think it's time to get started.

90

Let's dive into the course and let's learn all about Web security.