Hacker101

The 'Web In Depth' session provides a security-focused exploration of web technologies. It covers the fundamental mechanisms of how the web operates and the security implications associated with them.

Key topics covered include:

• HTTP basics: Understanding the core protocol of the web.
• Cookie security: How cookies are used and how they can be secured or exploited.
• HTML parsing: How browsers interpret HTML content.
• MIME sniffing: How browsers guess the content type of a resource.
• Encoding sniffing: How browsers determine character encoding.
• Same-Origin Policy (SOP): The fundamental security model governing cross-origin requests.
• CSRF (Cross-Site Request Forgery): Understanding and identifying request forgery vulnerabilities.

Haptyc is a Python library and testing framework designed to extend the capabilities of Turbo Intruder. It aims to bring Turbo Intruder closer to feature parity with traditional Intruder by adding support for multiple user-defined positions, orchestrating complex attack styles (like battering ram and cluster bomb), and enabling the mutation of user-defined positions using modular Python code.

Key features include:

• Haptyc transform tags: A pseudo-markup system used within HTTP requests to define positions.
• Modular Transforms: Generic and portable mutation logic that can be reused across different HTTP requests, reducing the need for request-specific 'spaghetti code'.
• Accessibility: Provides ready-to-use examples for beginners while allowing advanced users to develop sophisticated, custom fuzzers.

The Introduction session provides a foundational overview of the hacker mindset and the practical application of security testing. It covers the transition from learning theoretical concepts to applying them in real-world scenarios.

Key topics covered include:

• Required tools for security testing
• The 'breaker' mindset (attacker perspective)
• Understanding the attacker-defender imbalance
• Performing lightweight threat assessment and prioritization
• Best practices for writing high-quality bug reports
• Introduction to Reflected XSS (Cross-Site Scripting)

This session focuses on identifying and exploiting the following vulnerability classes in Android applications:

• Path traversal: Exploiting improper input validation to access files or directories outside the intended scope.
• Embedded secrets: Locating sensitive information (API keys, credentials, etc.) hardcoded within the application binary or assets.
• OAuth issues: Identifying common implementation flaws in OAuth flows within mobile environments.

This session covers three critical vulnerability classes:

1. Directory Traversal: Understanding how attackers access files outside the intended web root, how to exploit these paths, and how to implement mitigations.
2. Command Injection: Learning how untrusted input can execute arbitrary commands on the host operating system, including real-world scenarios and exploitation techniques.
3. SQL Injection (SQLi): Exploring how attackers manipulate database queries, including basic exploitation, Blind SQLi (and its different types), and mitigation strategies.

This session covers fundamental techniques for identifying and exploiting vulnerabilities related to cookie management. You will learn how to:

• Manipulate cookies in the browser: Using browser developer tools to modify cookie values directly.
• Manipulate cookies in requests: Intercepting and modifying cookies within HTTP requests using proxy tools.
• Check for cookie flags: Inspecting cookies for security attributes like HttpOnly, Secure, and SameSite to assess risk.
• Identify common data encodings: Recognizing how cookie data is encoded (e.g., Base64, URL encoding) to facilitate tampering.
• Perform manipulations: Executing specific changes to cookie values to bypass authentication or escalate privileges.

This session covers the fundamentals of Cross-Site Scripting (XSS) and Authorization vulnerabilities.

XSS Topics:

• Types of XSS: Stored, Reflected, and DOM-based XSS.
• Security Lifecycle: Techniques for detection, exploitation, and mitigation of XSS vulnerabilities.

Authorization Topics:

• Vulnerability Patterns: Authorization bypasses and forced browsing.
• Security Lifecycle: Techniques for detection, exploitation, and mitigation of authorization failures.

The Burp Suite training is structured into three progressive levels:

1. Burp 101 - Getting Started: Covers basic setup and fundamental proxy usage.
2. Burp 201 - Maximizing Burp: Focuses on optimizing your workflow and using more advanced features.
3. Burp 301 - Burp Hacks for Bounty Hunters: Covers advanced techniques and specialized hacks for bug bounty hunting.