Course Outline
Advanced Reconnaissance and Enumeration
- Automated subdomain enumeration using Subfinder, Amass, and Shodan
- Content discovery and directory brute-forcing at scale
- Fingerprinting technologies and mapping extensive attack surfaces
Automation with Nuclei and Custom Scripts
- Development and customisation of Nuclei templates
- Integrating tools within Bash/Python workflows
- Leveraging automation to identify easily exploitable and misconfigured assets
Bypassing Filters and WAFs
- Encoding techniques and evasion strategies
- WAF fingerprinting and bypass methodologies
- Advanced payload construction and obfuscation
Hunting for Business Logic Bugs
- Identifying unconventional attack vectors
- Parameter tampering, broken flows, and privilege escalation
- Analysing flawed assumptions in backend logic
Exploiting Authentication and Access Control
- JWT tampering and token replay attacks
- IDOR (Insecure Direct Object Reference) automation
- SSRF, open redirects, and OAuth misuse
Bug Bounty at Scale
- Managing hundreds of targets across various programs
- Reporting workflows and automation (templates, PoC hosting)
- Optimising productivity and preventing burnout
Responsible Disclosure and Reporting Best Practices
- Crafting clear, reproducible vulnerability reports
- Coordinating with platforms (HackerOne, Bugcrowd, private programs)
- Navigating disclosure policies and legal boundaries
Summary and Next Steps
Requirements
- Proficiency with OWASP Top 10 vulnerabilities
- Practical experience with Burp Suite and fundamental bug bounty practices
- Understanding of web protocols, HTTP, and scripting languages (e.g., Bash or Python)
Target Audience
- Experienced bug bounty hunters seeking advanced methodologies
- Security researchers and penetration testers
- Red team members and security engineers
Custom Corporate Training
Training solutions designed exclusively for businesses.
- Customized Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
- Flexible Schedule: Dates and times adapted to your team's agenda.
- Format: Online (live), In-company (at your offices), or Hybrid.
Price per private group, online live training, starting from 3900 € + VAT*
Contact us for an exact quote and to hear our latest promotions
Testimonials (2)
Clarity and pace of explanations
Federica Galeazzi - Aethra Telecomunications SRL
Course - AI-Powered Cybersecurity: Advanced Threat Detection & Response
It did give me the insight what I needed :) I am starting teaching on a BTEC Level 3 qualification and wanted to widen my knowledge in this area.
