Hacking

Interpret a bug-bounty policy to determine whether a proposed test is authorized, prohibited, or out of scope.

Turn a program's scope, rate limits, and data-handling rules into a testing checklist.

Configure an isolated browser profile to proxy an authorized lab through Burp Suite Community Edition.

Capture an HTTP request and identify its method, path, headers, cookies, parameters, and body.

Modify one element of an HTTP request and replay it with Burp Repeater.

Relate HTTP response status, headers, and body changes to the request that produced them.

Maintain a timestamped testing log while redacting credentials and personal data.

Compare bug-bounty programs using scope clarity, accessible functionality, competition, response history, and reward structure.

Convert a selected program's published scope into an inventory of permitted assets and test accounts.

Gather passive information about an in-scope asset without interacting with out-of-scope systems.

Trace a browser action through proxy history to the endpoints that implement it.

Identify controllable inputs in paths, queries, headers, cookies, forms, and JSON bodies.

Create a role-action-object matrix for an application's accessible features.

Prioritize test hypotheses by likely impact, attack-surface fit, and testing cost.

Create two controlled user identities with distinct owned records for authorization testing.

Identify direct and indirect object references in authorized application traffic.

Test horizontal access control by substituting identifiers between controlled accounts.

Test vertical access control by replaying privileged actions from a lower-privileged controlled account.

Distinguish interface-level feature hiding from server-side authorization enforcement.

Test whether multi-step workflows enforce authorization consistently at every step.

Demonstrate an access-control impact using the minimum data and actions necessary.

Reproduce a suspected vulnerability from a clean baseline using a minimal request sequence.

Rule out caching, stale state, intended sharing, and client-only behavior as false-positive causes.

Determine the affected asset, endpoint, prerequisites, and user roles for a finding.

Describe security impact using a realistic attacker path rather than hypothetical worst cases.

Build a concise proof of concept that avoids destructive actions and unnecessary data access.

Write a report containing a clear title, summary, steps, evidence, impact, and suggested remediation.

Respond constructively to requests for clarification, duplicate decisions, and severity disagreements.

Map the registration, login, recovery, multifactor, logout, and session-renewal flows of an application.

Evaluate account-enumeration behavior using program-compliant request volumes and controlled identities.

Assess password-reset token lifetime, reuse, binding, and invalidation in an authorized lab.

Verify whether authentication and privilege changes rotate or invalidate existing sessions.

Test multifactor enforcement across recovery paths, remembered devices, and alternate endpoints using controlled accounts.

Evaluate session cookies for Secure, HttpOnly, SameSite, scope, and predictable-lifetime weaknesses.

Demonstrate an authentication or session weakness without taking control of another person's account.

Classify untrusted input by HTML, attribute, JavaScript, CSS, or URL rendering context.

Confirm reflected cross-site scripting in an authorized lab with a harmless execution marker.

Confirm stored cross-site scripting using content and accounts under the learner's control.

Trace a DOM-based data flow from an attacker-controllable source to an unsafe sink.

Evaluate how contextual encoding and Content Security Policy affect cross-site scripting exploitability.

Test whether a state-changing action resists cross-site request forgery through tokens, SameSite cookies, and origin checks.

Evaluate a CORS policy with a controlled origin and credentialed versus uncredentialed requests.

Report browser-side impact without collecting real session tokens or personal data.

Identify features that may cause a server to fetch a learner-controlled URL.

Distinguish a genuine server-side request from a browser-side request using a controlled callback endpoint.

Validate server-side request forgery in an authorized lab without contacting sensitive internal services.

Test file-path inputs for traversal using non-sensitive lab files and normalized path variants.

Evaluate upload controls for extension, content type, file signature, storage location, and retrieval behavior.

Test whether uploaded or generated files are isolated from unintended users.

Identify unsafe archive extraction or filename handling in an authorized lab.

Demonstrate the impact of a server-side request or file-handling flaw with a minimal safe proof.

Identify parameters whose responses suggest influence over a server-side query or interpreter.

Test for SQL injection in an authorized lab using controlled error, Boolean, and timing comparisons.

Differentiate SQL injection evidence from network latency, generic errors, and application instability.

Identify inputs that may reach an operating-system command interpreter.

Confirm command injection in an authorized lab using a harmless output or timing marker.

Identify template-rendering inputs and test them with a harmless arithmetic expression.

Convert injection evidence into a reproducible report without extracting unnecessary data.

Recognize REST, GraphQL, and asynchronous API interactions in browser and proxy traffic.

Derive an authorized API endpoint inventory from application traffic and published documentation.

Apply paired-account authorization testing to API objects, functions, and nested resources.

Test for unintended field modification by comparing accepted, ignored, and returned API properties.

Evaluate whether alternate HTTP methods and content types bypass an application's intended controls.

State a business workflow's invariants for ownership, quantity, price, balance, sequence, and one-time actions.

Test workflow order, replay, and state-transition assumptions using controlled data.

Confirm a concurrency flaw in an authorized lab with synchronized requests and bounded impact.

Build a hypothesis-driven checklist tailored to one application's technologies, roles, and trust boundaries.

Use publicly exposed client-side code to identify in-scope routes and parameters for manual verification.

Connect two independently verified weaknesses into a valid exploit chain in an authorized lab.

Estimate a finding's severity from exploit prerequisites, affected users, data sensitivity, and business consequence.

Choose a specialization based on observed program surfaces, personal results, and vulnerability-class fit.

Track tested hypotheses, outcomes, duplicates, and triage feedback to improve future target selection.

Design a sustainable weekly hunting cycle that balances study, testing, reporting, and review.