[av_heading heading=’دانلود کتاب Hands-On Bug Hunting for Penetration Testers’ tag=’h1′ style=’blockquote modern-quote modern-centered’ size=” subheading_active=” subheading_size=’15’ padding=’10’ color=’custom-color-heading’ custom_font=’#4ecac2′ av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” admin_preview_bg=”][/av_heading]
[av_textblock size=” font_color=” color=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” admin_preview_bg=”]

Book Description

Bug bounties have quickly become a critical part of the security economy. This book shows you how technical professionals with an interest in security can begin productively—and profitably—participating in bug bounty programs.

You will learn about SQli, NoSQLi, XSS, XXE, and other forms of code injection. You’ll see how to create CSRF PoC HTML snippets, how to discover hidden content (and what to do with it once it’s found), and how to create the tools for automated pentesting workflows.

Then, you’ll format all of this information within the context of a bug report that will have the greatest chance of earning you cash.

With detailed walkthroughs that cover discovering, testing, and reporting vulnerabilities, this book is ideal for aspiring security professionals. You should come away from this work with the skills you need to not only find the bugs you’re looking for, but also the best bug bounty programs to participate in, and how to grow your skills moving forward in freelance security research.

Table of Contents

 Joining the Hunt
Technical Requirements
The Benefits of Bug Bounty Programs
What You Should Already Know – Pentesting Background
Setting Up Your Environment – Tools To Know
What You Will Learn – Next Steps
How (Not) To Use This Book – A Warning
Summary
Questions
Further Reading
 Choosing Your Hunting Ground
Preparing for an Engagement
Technical Requirements
Attack Surface Reconnaisance – Strategies and the Value of Standardization
Summary
Questions
Further Reading
Unsanitized Data – An XSS Case Study
Technical Requirements
A Quick Overview of XSS – The Many Varieties of XSS
Testing for XSS – Where to Find It, How to Verify It
XSS – An End-To-End Example
Summary
Questions
Further Reading
 SQL, Code Injection, and Scanners
Technical Requirements
SQLi and Other Code Injection Attacks – Accepting Unvalidated Data
Testing for SQLi With Sqlmap – Where to Find It and How to Verify It
Trawling for Bugs – Using Google Dorks and Python for SQLi Discovery
Scanning for SQLi With Arachni
NoSQL Injection – Injecting Malformed MongoDB Queries
SQLi – An End-to-End Example
Summary
Questions
Further Reading
 CSRF and Insecure Session Authentication
Technical Requirements
Building and Using CSRF PoCs
CSRF – An End-to-End Example
Summary
Questions
Further Reading
 Detecting XML External Entities
Technical requirements
A simple XXE example
XML injection vectors
XML injection and XXE – stronger together
Testing for XXE – where to find it, and how to verify it
XXE – an end-to-end example
Summary
Questions
Further reading
 Access Control and Security Through Obscurity
Technical Requirements
Security by Obscurity – The Siren Song
Data Leaks – What Information Matters?
Low Value Data – What Doesn’t Matter
Data Leak Vectors
Unmasking Hidden Content – How to Pull the Curtains Back
Data Leakage – An End-to-End Example
Summary
Questions
Further Reading
 Framework and Application-Specific Vulnerabilities
Technical Requirements
Known Component Vulnerabilities and CVEs – A Quick Refresher
WordPress – Using WPScan
Ruby on Rails – Rubysec Tools and Tricks
Django – Strategies for the Python App
Summary
Questions
Further Reading
Formatting Your Report
Technical Requirements
Reproducing the Bug – How Your Submission Is Vetted
Critical Information – What Your Report Needs
Maximizing Your Award – The Features That Pay
Example Submission Reports – Where to Look
Hackerone Hacktivity
Vulnerability Lab Archive
GitHub
Summary
Questions
Further Reading
Other Tools
Technical Requirements
Evaluating New Tools – What to Look For
Paid Versus Free Editions – What Makes a Tool Worth It?
A Quick Overview of Other Options – Nikto, Kali, Burp Extensions, and More
Summary
Questions
Further Reading
 Other (Out of Scope) Vulnerabilities
Technical Requirements
DoS/DDoS – The Denial-of-Service Problem
Sandboxed and Self-XSS – Low-Threat XSS Varieties
Non-Critical Data Leaks – What Companies Don’t Care About
Other Common No-Payout Vulnerabilities
Summary
Questions
Further Reading
 Going Further
Blogs
Courses
Summary
Questions
Further Reading

What You Will Learn

Choose what bug bounty programs to engage in

Understand how to minimize your legal liability and hunt for bugs ethically

See how to take notes that will make compiling your submission report easier

Know how to take an XSS vulnerability from discovery to verification, and report submission

Automate CSRF PoC generation with Python

Leverage Burp Suite for CSRF detection

Use WP Scan and other tools to find vulnerabilities in WordPress, Django, and Ruby on Rails applications

Write your report in a way that will earn you the maximum amount of money

برای دانلود به کانال تلگرام مراجعه فرمایید

[/av_textblock]
[av_textblock size=” font_color=” color=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” admin_preview_bg=”]
علیرضا خبیر
مشاور و مدرس تست نفوذ و امنیت شبکه‌های اداری و صنعتی
[/av_textblock]
[av_heading tag=’h1′ padding=’10’ heading=’لینک ها ‘ color=’custom-color-heading’ style=’blockquote modern-quote modern-centered’ custom_font=’#37ef34′ size=” subheading_active=” subheading_size=’15’ custom_class=” admin_preview_bg=” av-desktop-hide=” av-medium-hide=” av-small-hide=” av-mini-hide=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=”][/av_heading]
[av_textblock size=” font_color=” color=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” admin_preview_bg=”]

بخش آموزش های سایت

[/av_textblock]
[av_textblock size=” font_color=” color=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” admin_preview_bg=”]

[/av_textblock]
[av_font_icon icon=’ue8b7′ font=’entypo-fontello’ style=’border’ caption=’لینک کانال تلگرام’ link=’manually,http://t.me/sgapsec’ linktarget=’_blank’ size=’40px’ position=’center’ color=” admin_preview_bg=”]
کانال تلگرام ما
[/av_font_icon]
[av_font_icon icon=’ue909′ font=’entypo-fontello’ style=’border’ caption=’لینک اینستاگرام’ link=’manually,https://www.instagram.com/sgapsec’ linktarget=’_blank’ size=’40px’ position=’center’ color=” admin_preview_bg=”]
کانال تلگرام ما
[/av_font_icon]
[av_postslider link=’category,71,72,70,1,73′ wc_prod_visible=” prod_order_by=” prod_order=” columns=’5′ items=’-1′ offset=’0′ contents=’title’ preview_mode=’auto’ image_size=’portfolio’ autoplay=’yes’ interval=’5′]