How to get experience with no experience? Have a look at bug bounty programs. Vickie Li demos Insecure Direct Object References (IDOR) and tells us how to get into bug bounty. We also discuss why her book Bug Bounty Bootcamp is a fantastic book to buy if you want to get into bug bounty. Get real world experience today.

// MENU //
00:00 - In plain text!
00:24 - Introducing//Vickie Li
00:58 - Part 1//The Interview
01:01 - Origin//Bug Bounty Bootcamp
03:37 - What are Bug Bounty Programmes?
05:26 - Part Time Bug Hunting?
05:44 - Easy Way to Get Experience
07:45 - Which Bug Bounty Programmes for Beginners?
10:51 - Beginners//Don't Compete with Pros
13:15 - Duplicates as Valid Experience
14:23 - What You Need to Start
14:59 - Linux//Do You Need It?
15:55 - Automate!//Which Programming Language?
18:03 - Beginner Friendly Vulnerabilities
21:17 - Part 2//Exploiting IDOR Vulnerability Demo
21:24 - What is IDOR?
22:51 - PortSwigger IDOR Lab
24:05 - Live Chat IDOR
24:48 - View transcript
25:12 - Burp Suite Intercept
26:05 - What to Look For//IDs Aren't Always Obvious
26:56 - Burp Suite//Looking Through Headers
27:56 - Burp Suite//Repeater
28:30 - Testing View Transcript Again
29:18 - GET Request//Identifying Exploitable Endpoint
30:26 - Modifying GET Request
31:35 - Finding the right headers to modify
33:47 - Why the first attempt didn't work
34:09 - IRL//What You Would Do
34:23 - Password in Live Chat Transcript
35:40 - How to Prevent IDORs
36:01 - IDORs//Worth Pursuing?
39:57 - Bug Bounties//How to Start
41:21 - Learn More!//Vickie's Blog
41:38 - Follow Vickie's Twitter!
41:52 - Thank You & Closing

// Books //
Bug Bounty Bootcamp: https://amzn.to/3K2YDeJ
The Web Application Hacker's Handbook: https://amzn.to/3IZ2RTr
Hacking API’s by Corey J Ball: https://amzn.to/3JOJG0E 
Alice and Bob learn application security by Tanya Janca: https://amzn.to/3oMyMij
Automate the boring stuff with Python: https://amzn.to/3N2QuYu

// Videos mentioned //
Nahamsec: https://youtu.be/9vaEwycet90
Corey Ball: https://youtu.be/CkVvB5woQRM
Tanya Janca: https://youtu.be/nyhytT2tRN0
Al Sweigart: https://youtu.be/7iBqoc-DzTQ

// Vickie's social media //
Twitter: https://twitter.com/vickieli7
Website: https://vickieli.dev/
YouTube: https://www.youtube.com/channel/UCjQH...
Medium: https://vickieli.medium.com/

// Connect with David //
Discord: https://discord.com/invite/usKSyzb
Twitter: https://www.twitter.com/davidbombal 
Instagram: https://www.instagram.com/davidbombal 
LinkedIn: https://www.linkedin.com/in/davidbombal 
Facebook: https://www.facebook.com/davidbombal.co 
TikTok: http://tiktok.com/@davidbombal
YouTube: https://www.youtube.com/davidbombal 

// Platforms mentioned //
HackerOne: https://www.hackerone.com/
bugcrowd: https://www.bugcrowd.com/
Intigriti: https://www.intigriti.com/
Huntr: https://huntr.dev/

// Connect with Nahamsec //
Twitter: https://twitter.com/nahamsec
YouTube: https://www.youtube.com/c/nahamsec
Github: https://github.com/nahamsec/Resources...
Discord: https://discord.com/invite/ysndAm8
Instagram: https://www.instagram.com/nahamsec/
LinkedIn: https://www.linkedin.com/in/nahamsec/
Twitch: https://www.twitch.tv/nahamsec
Website: https://nahamsec.com/

// MY STUFF //
Monitor: https://amzn.to/3yyF74Y
More stuff: https://www.amazon.com/shop/davidbombal

// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com

Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! 

Disclaimer: This video is for educational purposes only.

#python #hack #xss

#401: Bug Bounty bootcamp // Get paid to hack websites like Uber, PayPal, TikTok and more

This is your path to becoming a Pentester in 2023. The best courses and best cert. Big thanks to Rana for answering so many of your questions!

Thanks for the cool Solar Generator Jackery!
Official Jackery website:: https://bit.ly/3XWNjqO
Amazon Store: https://amzn.to/3IMSq8r

// Rana's courses //
Free Web Hacking Course:   

 / ranakhalil101  

50% OFF Web Security Academy Course Code: DavidBombal500FF
Academy: https://academy.ranakhalil.com/

8 hour SQL Injection playlist:   

 • SQL Injection | C...  

// Previous video //
Broken Access Control:   

 • Free Web Hacking ...  

// Rana's OSCP journey //
https://rana-khalil.gitbook.io/hack-t...

// Book Rana Recommended //
Web Application’s Hacker’s handbook 2nd Ed by Dafydd Stuttard: 
US Link:  https://amzn.to/3J90wZa
UK Link:  https://amzn.to/3J7H2UT

// TCM-Security Course Discounts and Affiliate Links // 
Get 25% off courses and 10% off PNPT with coupon code: BOMBAL2023

Practical Ethical Hacking: https://davidbombal.wiki/tcmpeh

Windows Privilege Escalation for Beginners: https://davidbombal.wiki/tcmwpe

Linux Privilege Escalation for Beginners: https://davidbombal.wiki/tcmlpe

Open-Source Intelligence (OSINT) Fundamentals: https://davidbombal.wiki/tcmosint

The External Pentest Playbook: https://davidbombal.wiki/tcmepp

Movement, Pivoting, and Persistence: https://davidbombal.wiki/tcmmpp

Python 101 for Hackers: https://davidbombal.wiki/tcmpython

Linux 101: https://davidbombal.wiki/tcmlinux

Practical Malware Analysis & Triage: https://davidbombal.wiki/tcmmalware

Mobile Application Penetration Testing: https://davidbombal.wiki/tcmmobile

Python 201 for Hackers: https://davidbombal.wiki/tcmpython201

Practical Web Application Security & Testing: https://davidbombal.wiki/tcmweb

Practical Windows Forensics: https://davidbombal.wiki/tcmwinforensics

GRC Analyst Master Class: https://davidbombal.wiki/tcmgrc

// TCM-Security Certifications //
https://certifications.tcm-sec.com/?r...

If you are current/former military, students, teachers, and first line responders (doctors, nurses, EMTs, etc.) you can get 20% off TCM certifications. Email support@tcm-sec.com for that discount if you qualify.

// Tib3rius courses //
- Windows Privilege Escalation: https://www.udemy.com/course/windows-...
- Linux Privilege Escalation (Tib3rius): https://www.udemy.com/course/linux-pr...

// IPsec //
Recommended YouTube channel:   

 / @ippsec  

// Rana's SOCIAL // 
Twitter: https://twitter.com/rana__khalil
Academy: https://academy.ranakhalil.com/
Youtube Channel:   

 / ranakhalil101  
Medium Blog: https://ranakhalil101.medium.com/
Rana Intigriti Interview:   

 • Hacker Heroes #5 ...  

// David's SOCIAL //
Discord: https://discord.gg/davidbombal
Twitter: https://www.twitter.com/davidbombal 
Instagram: https://www.instagram.com/davidbombal 
LinkedIn: https://www.linkedin.com/in/davidbombal 
Facebook: https://www.facebook.com/davidbombal.co 
TikTok: http://tiktok.com/@davidbombal

// MY STUFF //
https://www.amazon.com/shop/davidbombal

// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com

pentest
pentester
hack
hacker
hacking
ethical hacking
tcm security
web
web hacking
web hacking course
web hacking tutorial
xss
owasp
owasp top 10
cross site scripting
portswigger
kali linux install
kali linux 2022
ethical hacker course
ethical hacker

Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! 

Disclaimer: This video is for educational purposes only. 


#hacker #pentester #hack

#420: The best Hacking Courses & Certs (not all these)? Your roadmap to Pentester success.

If you want to become a Pentester in 2023, then you should get your OSCP - this is what a lot of experts I interview recommend. The Official OSCP course (PEN-200: Penetration Testing with Kali Linux) recently got updated. I interview Jeremy Miller from OffSec about the changes.

Disclaimer: I was NOT paid for this interview. I wanted to make this video because it affects many of you watching and I would have done it without receiving anything from OffSec. However, they did give me access to Learn One for one year so I could see the course content. This has helped me prepare for the interview. Hopefully I'll be able to make more content covering what is in the PEN 200 course in future :)

// Documentation //
Changes: https://www.offsec.com/offsec/pen-200...
Course: https://www.offsec.com/courses/pen-200/

// Offsec //
Twitter: https://twitter.com/offsectraining
Website: https://www.offsec.com/
LinkedIn: https://www.linkedin.com/company/offs...

// Jeremy's SOCIAL //
Twitter: https://twitter.com/JeremyHarbinger
LinkedIn: https://www.linkedin.com/in/jeremy-mi...
Website: https://jeremyharbinger.com/

// David's SOCIAL //
Discord: https://discord.gg/davidbombal
Twitter: https://www.twitter.com/davidbombal 
Instagram: https://www.instagram.com/davidbombal 
LinkedIn: https://www.linkedin.com/in/davidbombal 
Facebook: https://www.facebook.com/davidbombal.co 
TikTok: http://tiktok.com/@davidbombal

// MY STUFF //
https://www.amazon.com/shop/davidbombal

// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com

// MENU //
00:00 - Coming up
00:28 - Intro
00:31 - Updated OffSec PEN-200 course for 2023 // What's changing?
05:22 - Hacking is not easy as it seems
07:46 - Preparing for the real world
10:19 - Pre-requisites for the course
14:15 - Jeremy's background // Journey to pentesting
21:13 - Approach with an open mind
22:41 - Learning models & challenges
28:10 - Feedback loop
30:16 - Buffer overflow explained 
32:34 - What has been removed & added // PEN-200 updated
37:30 - What is "pedagogy"? // Changing ways to teach and learn
40:38 - The PEN-200 course and the OSCP exam
44:11 - Old and new OS available in PEN-200 course
46:04 - Things are changing but not everything
48:24 - OffSec subscriptions and contents
49:43 - Pros vs. Cons // Helping students understand
52:14 - Final words & conclusion

oscp
pen-200
offsec
offensive sercurity
pentest
pentester
hack
hacker
hacking
ethical hacking
ethical hacker course
ethical hacker

Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! 

Disclaimer: This video is for educational purposes only. 

#hacker #pentester #oscp

#421: The best Hacking Cert just got updated (OSCP PEN-200)

Learn your path to success with the man who has wrestled a bear and lived to tell the tale! 

Phillip not only wrestled, was a bouncer, and a whole lot more, but also become a pentester! This is your Pentester Blueprint.

// Books Mentioned //
The Pentester  Blueprint: https://amzn.to/41N5CBl
The Hacker Playbook: https://amzn.to/40LvInc
The Hacker Playbook: https://amzn.to/3oVemqr
The Hacker Playbook: https://amzn.to/40SjokN
The Web Application Hacker's Handbook: https://amzn.to/3oLN5Xv
Hacking APIs: https://amzn.to/3Hi5amj
Penetration Testing A Hands-On Introduction to Hacking: https://amzn.to/3Hi5zF
RTFM (Read Team Field Manual): https://amzn.to/3Vf0XWs
Operator Handbook Red Team + OSINT + Blue Team: https://amzn.to/41JTQYH

//Phillip's SOCIAL//
YouTube:    

 / phillipwylie  
Twitter:  https://twitter.com/PhillipWylie
LinkedIn: https://www.linkedin.com/in/phillipwylie
Instagram: https://www.instagram.com/phillip.wylie/
Linktr:  https://linktr.ee/phillipwylie
Website:  https://www.thehackermaker.com/
Podcast:  https://www.itspmagazine.com/the-hack...

// David's SOCIAL //
Discord: https://discord.gg/davidbombal
Twitter: https://www.twitter.com/davidbombal 
Instagram: https://www.instagram.com/davidbombal 
LinkedIn: https://www.linkedin.com/in/davidbombal 
Facebook: https://www.facebook.com/davidbombal.co 
TikTok: http://tiktok.com/@davidbombal

// MY STUFF //
https://www.amazon.com/shop/davidbombal

// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com

// MENU //
00:00 - Coming up
01:05 - The Pentester Blueprint book // Who is it for?
03:36 - Resources about pentesting // Podcasts & walkthroughs
07:00 - From pro-wrestler to pentester
11:48 - Helping others through conferences
13:15 - Getting recruited by networking // Using social media
17:43 - How to create content
20:24 - Connecting and sharing work on Twitter
21:37 - Ignore the trolls
24:29 - Bug bounty
26:02 - Recommended certifications
30:30 - Recommended labs & VMs
34:07 - Try Hack Me & Hack The Box
35:00 - College/University degrees
36:50 - The Pentester Blueprint Formula
41:24 - Recommended books
43:26 - What is a pentester?
44:59 - Advice for anyone starting
51:05 - Final words
52:17 - Conclusion

pentest
pentester
hack
hacker
hacking
ethical hacking
ethical hacker course
ethical hacker
ceh
oscp
hack the box
try hack me
ejpt
ine

Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! 

Disclaimer: This video is for educational purposes only. 

#hacker #pentester #hack

#422: Pentester Blueprint: Your road to success

Want to learn about IT? Want to get ahead in your career?  Well, this is the right place! 

On this channel, I discuss Python, Ethical Hacking, Networking, Network Automation, CCNA, Virtualization and other IT related topics.
   
This YouTube channel has new videos every week! Subscribe for technical, detailed, no fluff content.

David’s details:
Discord: https://discord.com/invite/usKSyzb
Twitter: https://www.twitter.com/davidbombal 
Instagram: https://www.instagram.com/davidbombal 
LinkedIn: https://www.linkedin.com/in/davidbombal 
Facebook: https://www.facebook.com/davidbombal.co 
Website: http://www.davidbombal.com  
YouTube: https://www.youtube.com/davidbombal 

All the best!
David

Popular tracks tagged #web_hacking