Back to All Events

Web Hacking Secrets: How to Hack Legally and Earn Thousands of Dollars at HackerOne

Course Schedule

This training is ONLINE ONLY.

This online training is composed of

6 hours of high-quality video courses with lots of recorded demos (LIFETIME access; the courses are listed below)

• 4 hours of live online training (demonstrating advanced attacks on modern web applications + training support for the video courses)

The live portion is on May 24 May 27 (Friday), from 9am to 1pm

 

Course Abstract

HackerOne is your big opportunity. This is the platform where you can hack legally and at the same time you can make money. You can hack many different companies like Twitter, Yahoo, Uber, Coinbase, and a lot more. And you can get paid for your findings, for example $100, $1,000, or even $10,000 per one bug. It’s just amazing. All you need is Internet connection and knowledge. Yes – you need knowledge to go from zero to thousands of dollars at HackerOne, and in this online training I’m going to share my knowledge with you.

I’m one of the top hackers at HackerOne and I know quite a lot about hacking and making money that way. In this online training I’ll present many award-winning bugs. The more you play with award-winning bugs the more knowledge you get and the more knowledge you have, the more money you can make. I’ll also discuss a successful bug hunting strategy that I have been using in the recent years. What’s more, I’ll present a lot of demos, because I want you to see how all these things work in practice.

 

Course Outline

6 hours of high-quality video courses with lots of recorded demos

You will get lifetime access to these 6 video courses:

1. Start Hacking and Making Money Today at HackerOne

  • HackerOne: Your Big Opportunity

  • Getting Started with 5 Bugs

  • Automatic Leakage of Password Reset Link (FREE VIDEO)

  • How to Get Access to the Account of the Logged Out User

  • Insecure Processing of Credit Card Data

  • Disclosure of Authentication Cookie

  • User Enumeration

2. Keep Hacking and Making Money at HackerOne

  • How to Impersonate a User via Insecure Log In (FREE VIDEO)

  • Sensitive Information in Metadata

  • Disclosure of Credentials

  • Insecure Password Change

  • Dictionary Attack

3. Case Studies of Award-Winning XSS Attacks: Part 1

  • XSS via Image

  • XSS via HTTP Response Splitting

  • XSS via Cookie (FREE DEMO)

  • XSS via AngularJS Template Injection

4. Case Studies of Award-Winning XSS Attacks: Part 2

  • XSS via XML (FREE VIDEO)

  • XSS via location.href

  • XSS via vbscript:

  • From XSS to Remote Code Execution

5. DOUBLE Your Web Hacking Rewards with Fuzzing

  • The Basics of Fuzzing

  • Fuzzing with Burp Suite Intruder - Overview

  • Fuzzing for SQL Injection - Demo (FREE VIDEO)

  • Fuzzing for Path Traversal – Demo

  • Fuzzing with Burp Suite Intruder: Tips and Tricks

6. How Web Hackers Make BIG MONEY: Remote Code Execution

  • From SQL Injection to Remote Code Execution (FREE VIDEO)

  • From Disclosure of Software Version to Remote Code Execution

  • Remote Code Execution via File Upload

  • Remote Code Execution via Deserialization

Lifetime access to these 6 video courses will be granted before participating in the live online training session. More information can be found in the section ”What students will receive”.

4 hours of Live Online Training

Part 1: I’ll demonstrate advanced attacks on modern web applications:

  • Token hijacking via PDF file

  • Subdomain takeover

  • HTTP parameter pollution

  • Bypassing XSS protection

  • DB truncation attack

  • and more …

Part 2: I’ll answer your questions about the attacks presented in the video courses and bug hunting at HackerOne (training support for the video courses)

 
 

What Students Should Know

  • Basic hacking skills

  • Basic knowledge of web application security

  • Basic understanding of XSS attacks (cross-site scripting)

 

What Students will Learn

  • Master web application security testing

  • Become a successful bug hunter

  • Go from zero to thousands of dollars at HackerOne.

  • Double your web hacking rewards with fuzzing

  • Learn how hackers earn thousands of dollars per one bug

  • Discover how to find these bugs step-by-step in practice (recorded DEMOS)

  • Learn from one of the top hackers at HackerOne

 

What Students will Receive 

Students will receive lifetime access to 6 hours of high-quality video courses with lots of recorded demos (hosted on the 3rd party platform Grinfer; subject to terms of use and privacy policy). The access link will be sent after subscribing to my newsletter and before participating in the live online training session (during the live online training session, there will be time to ask questions about the attacks presented in the video courses and bug hunting at HackerOne – training support for the video courses).

 

What Students Say About My Trainings

References are attached to my LinkedIn profile (https://www.linkedin.com/in/dawid-czagan-85ba3666/). They can also be found here (https://silesiasecuritylab.com/services/training/#opinions) - training participants from companies such as Oracle, Adobe, ESET, ING, …

 

About the Instructor: Dawid Czagan

Dawid Czagan (@dawidczagan) is an internationally recognized security researcher and trainer. He is listed among top hackers at HackerOne. Dawid Czagan has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter and other companies. Due to the severity of many bugs, he received numerous awards for his findings. Dawid Czagan shares his security bug hunting experience in his hands-on trainings “Hacking Web Applications – Case Studies of Award-Winning Bugs in Google, Yahoo, Mozilla and More” and “Black Belt Pentesting / Bug Hunting Millionaire: Mastering Web Attacks with Full-Stack Exploitation”. He delivered security training courses at key industry conferences such as Hack In The Box (Amsterdam), CanSecWest (Vancouver), 44CON (London), Hack In Paris (Paris), DeepSec (Vienna), NorthSec (Montreal), HITB GSEC (Singapore), BruCON (Ghent) and for many corporate clients. His students include security specialists from Oracle, Adobe, ESET, ING, Red Hat, Trend Micro, Philips and government sector (references are attached to Dawid Czagan’s LinkedIn profile (https://www.linkedin.com/in/dawid-czagan-85ba3666/ ; they can also be found here: https://silesiasecuritylab.com/services/training/#opinions). Dawid Czagan is a founder and CEO at Silesia Security Lab – a company which delivers specialized security testing and training services. He is also an author of online security courses. To find out about the latest in Dawid Czagan’s work, you are invited subscribe to his newsletter (https://silesiasecuritylab.com/newsletter) and follow him on Twitter (@dawidczagan) and LinkedIn (https://www.linkedin.com/in/dawid-czagan-85ba3666/).  

 
 
Previous
Previous
May 26

Advanced Penetration Testing: Mastering Web Attacks with Full-Stack Exploitation