Packt+ | Advance your knowledge in tech

Explore Products

Best Sellers

New Releases

Books

Videos

Audiobooks

Free Learning

Bug Bounty Hunting Essentials

You're reading from Bug Bounty Hunting Essentials Quick-paced guide to help white-hat hackers get through bug bounty programs

Product type Paperback

Published in Nov 2018

Publisher

ISBN-13 9781788626897

Length 270 pages

Edition 1st Edition

Tools

Android

Concepts

Bug Bounty

Authors (2):

Shahmeer Amir

Carlos A. Lozano

View More author details

Table of Contents (15) Chapters

Preface

1. Basics of Bug Bounty Hunting FREE CHAPTER

2. How to Write a Bug Bounty Report

3. SQL Injection Vulnerabilities

4. Cross-Site Request Forgery

5. Application Logic Vulnerabilities

6. Cross-Site Scripting Attacks

7. SQL Injection

8. Open Redirect Vulnerabilities

9. Sub-Domain Takeovers

10. XML External Entity Vulnerability

11. Template Injection

12. Top Bug Bounty Hunting Tools

13. Top Learning Resources

14. Other Books You May Enjoy

Leave a review - let other readers know what you think

Sub-domain takeovers in the wild

In the following sections, we will review some examples of reports about sub-domain takeovers.

Ubiquiti sub-domain takeovers

On February 6 2017, a bug bounty hunter called madrobot published a report about domain takeover in Ubiquiti.

madrobot discovered that one of Ubiquiti's subdomains was pointing to the following Google IP address:

216.58.203.243    moderator.ubnt.com216.58.203.243    ghs.google.com216.58.203.243    ghs.l.google.com

The DNS register for the sub-domain was illustrated in the follow-up evidence, as shown in the following screenshot:

So, when the user entered the sub-domain moderator.ubnt.com from the web browser, it showed Google's page instead, as shown in the following screenshot:

As we can see, any user can claim the sub-domain for themselves and use it to damage Ubiquiti.

Note

If you want to read more about this bug, visit the following link: https://hackerone.com/reports/181665.

Scan.me pointing to Zendesk

On February 16 2016, a security researcher...

The rest of the chapter is locked

Register for a free Packt account to unlock a world of extra content!

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at €18.99/month. Cancel anytime

Authors (2)

Shahmeer Amir

Shahmeer Amir

Shahmeer Amir is ranked as the third most accomplished bug hunter worldwide and has helped more than 400 organizations, including Facebook, Microsoft, Yahoo, and Twitter, resolve critical security issues in their systems. Following his vision of a safer internet, Shahmeer Amir is the founder and CEO of a cyber security start-up in Pakistan, Veiliux, aiming to secure all kinds of organizations. Shahmeer also holds relevant certifications in the field of cyber security from renowned organizations such as EC-Council, Mile2, and ELearn Security. By profession, Shahmeer is an electrical engineer working on different IoT products to make the lives of people easier.

See other products by Shahmeer Amir

Carlos A. Lozano

Carlos A. Lozano

Carlos A. Lozano is a security consultant with more than 15 years' experience in various security fields. He has worked as a penetration tester, but most of his experience is with security application assessments. He has assessed financial applications, ISC/SCADA systems, and even low-level applications, such as drivers and embedded components. Two years ago, he started on public and private bug bounty programs and focused on web applications, source code review, and reversing projects. Also, Carlos works as Chief Operations Officer at Global CyberSec, an information security firm based in Mexico, with operations in the USA and Chile.

See other products by Carlos A. Lozano

Other recommended products

Related to this chapter

Hands-On Application Penetration Testing with Burp Suite

Hands-On Application Penetration Testing with Burp Suite

Using Burp Suite, you can quickly build proof of concepts, extract data via an exploit, attack multiple end points in an application and even begin to script complex multi stage attacks. This book will provide a hands-on coverage on how you can get started with executing an application penetration test and be sure of the results.

Feb 2019 12h 12m

Hands-On Bug Hunting for Penetration Testers

Hands-On Bug Hunting for Penetration Testers

Bug bounties have quickly become a critical part of the security economy. This book shows you how technical professionals with an interest in security can begin productively—and profitably—participating in bug bounty programs.

Sep 2018 8h 20m

Burp Suite Cookbook

Burp Suite Cookbook

The purpose of the Burp Suite Cookbook is to provide web application penetration testers with hands-on examples of how to use Burp Suite to perform web assessments. The book gives detailed screenshots demonstrating how to perform various attacks in Burp including Cross-site Scripting (XSS), SQL Injection, Cross-site Request Forgery, XML External Entity (XXE), and many more.

Sep 2018 11h 56m

ASP.NET Core 5 Secure Coding Cookbook

ASP.NET Core 5 Secure Coding Cookbook

There are various ways to fix an ASP.NET Core web application security flaw. However, very few books share expert advice relating to which approaches work best for ASP.NET Core apps – unlike this book. The ASP.NET Core Secure Coding Cookbook is your guide to tackling the most common ASP.NET Core web application vulnerabilities.

Jul 2021 10h 48m

Learning Python Web Penetration Testing

Learning Python Web Penetration Testing

This book will walk you through the web application penetration testing methodology, showing you how to write your own tools with Python for every main activity in the process. It will show you how to test for security vulnerabilities in web applications just like security professionals and hackers do.

Jun 2018 4h 36m

Kali Linux Web Penetration Testing Cookbook

Kali Linux Web Penetration Testing Cookbook

Kali Linux is the most popular open-source penetration toolkit used for effective web penetration testing. This book will teach you, in the form of step-by-step recipes, how to detect a wide array of vulnerabilities, exploit them to analyze their consequences, and ultimately buffer attackable surfaces so applications are more secure.

Aug 2018 13h 28m

Mastering Kali Linux for Web Penetration Testing

Mastering Kali Linux for Web Penetration Testing

Kali Linux 2016.2 is the next generation of Back Track 5, which is one of the best open-source penetration tool kits. Mastering Kali Linux for Web Penetration Testing will assist you in responsibly exposing identifying, and disclosing weaknesses and flaws in web applications at all stages of development.

Jun 2017 11h 16m

SQL Injection Strategies

SQL Injection Strategies

Web Application Security is a relevant aspect nowadays. Many operations and transactions happen every day on the Worldwide Web, often relying on Databases. SQL Injection Strategies will both show you SQL injection in action, alongside defensive measures. The book also deals with SQL Injection scenarios in the IoT and mobile environments

Becoming the Hacker

Becoming the Hacker

Adrian Pruteanu adopts the mindset of both a defender and an attacker in this practical guide to web application testing. By giving key insights into attack vectors and defenses, Becoming the Hacker builds your ability to analyze from both viewpoints and create robust defense strategies.

Jan 2019 13h 28m

Web Penetration Testing with Kali Linux

Web Penetration Testing with Kali Linux

This book covers everything you need to set up a Kali Linux lab, the latest generation of the BackTrack Linux penetration testing and security auditing Linux distribution. Learn how to use the hundred tools Kali Linux has so you can manage security tasks such as penetration testing, forensics, and reverse engineering.

Feb 2018 14h 12m

Kali Linux Intrusion and Exploitation Cookbook

Kali Linux Intrusion and Exploitation Cookbook

Born from it predecessor, Kali Linux 2.0 is the most popular Linux distribution designed for security professionals who build defensive strategies around their systems with an offensive mindset. This book aims at introducing you to the most common and not -so- common pre-installed penetration testing tools and create custom complex images in the form of easy to follow recipes. Right Information gathering, vulnerability assessment & penetration testing for Web, wired and wireless Network this book will help you get grips on exploiting vulnerabilities in your system and fix those security anomalies in no time.

Apr 2017 17h 4m

Network Vulnerability Assessment

Network Vulnerability Assessment

Being able to identify security loopholes has become critical to many businesses. That's where learning network security assessment becomes very important. This book will not only show you how to find out the system vulnerabilities but also help you build a network security threat model.

Aug 2018 8h 28m

Personalised recommendations for you

Based on your interests and search pattern

The Aspiring CIO and CISO

The Aspiring CIO and CISO

This book helps entry, mid-level, and senior managers master soft skills, craft a compelling brand, and strategically plan their career in C-suite roles with the help of expert insights needed for success in digital leadership and executive roles.

Jun 2024 8h 32m

Malware Development for Ethical Hackers

Malware Development for Ethical Hackers

This book will help you understand malware development by delving into the intricate mechanisms of malware development, injection attacks, and advanced evasion strategies with over 80 real-life examples.

Jun 2024 13h 0m

API Security for White Hat Hackers

API Security for White Hat Hackers

API Security for White Hat Hackers is a comprehensive guide that simplifies API security by showing you how to identify and fix vulnerabilities. From emerging threats to best practices, this book helps you defend and safeguard your APIs.

Jun 2024 13h 56m

Securing Cloud PCs and Azure Virtual Desktop

Securing Cloud PCs and Azure Virtual Desktop

This book covers the fundamentals of Windows 365 and Azure Virtual Desktop, addressing endpoint security challenges. You'll also explore advanced security measures for virtual environments.

Jun 2024 13h 12m

Cybersecurity Strategies and Best Practices

Cybersecurity Strategies and Best Practices

This book offers real-world case studies, holistic approaches, and practical guidance to boost your cybersecurity expertise. You'll learn how to align security strategies with business objectives and stay ahead of the evolving threat landscape.

May 2024 8h 24m

PowerShell for Penetration Testing

PowerShell for Penetration Testing

Designed for security professionals and aspiring pentesters, this book equips you with the skills and knowledge to exploit vulnerabilities, gain access, and navigate post-exploitation scenarios across diverse platforms.

May 2024 9h 56m

Securing Industrial Control Systems and Safety Instrumented Systems

Securing Industrial Control Systems and Safety Instrumented Systems

The book provides a solid understanding of SIS cybersecurity challenges and artifacts required to ensure the safety of mission-critical systems. It also serves as a strong foundation for anyone looking to boost their industrial security skill set.

Aug 2024 8h 32m

Incident Response for Windows

Incident Response for Windows

This exhaustive book helps you detect, respond to, and prevent cyberattacks on Windows-based systems by equipping you with the knowledge and tools needed to safeguard your organization's critical assets based on the actual threat landscape.

CCSP (ISC)2 Certified Cloud Security Professional Exam Guide

CCSP (ISC)2 Certified Cloud Security Professional Exam Guide

Explore all aspects of cloud security to pass the CCSP exam and boost your career with this guide packed with use cases, mock exam questions, and tips. You'll be able to apply your new-found knowledge not only to pass the exam but also at work.

Jun 2024 18h 40m

Cryptography Algorithms

Cryptography Algorithms

Uncover history, principles, and cutting-edge insights in this new edition. Learn how algorithms defend against attacks and stay current with trends like IoT and quantum cryptography. Elevate your cybersecurity expertise with this essential resource.

Aug 2024 13h 40m