Free to attend, all welcome, but booking required as spaces limited:
https://www.eventbrite.com/e/simple-practical-and-effective-bug-hunting-methodology-for-beginners-tickets-83945309681
Simple, Practical and Effective Bug Hunting Methodology for Beginners
This event is ideal for people who are just getting started with bug hunting and for those who are enthusiastic about bug hunting. If you are working in the penetration testing business, or if penetration testing is in your area of interest, it may be beneficial to attend this event.
In this presentation, we will talk about simple, practical bug hunting methodologies and effective quick go-throughs for web applications. We will overview the reconnaissance roadmap which will help you to get low hanging fruits easily. We will learn how to use automatic scanners & payloads and task lists. This lecture will help you to do your best in short time, you will gain practical insights to hack stuff better.
Topics to be covered in the lecture:
• Bug Hunting vs Penetration Testing
• What Bug Bounty Hunting Is
• What Bug Bounty Hunting Is Not
• Recon Methodology
• Passive Discovery (like ASNs, Whois, Reverse Whois, Shodan.io)
• Active Discovery (subdomain scraping & brute-forcing)
• Enumerating (port scanning, credential brute-forcing, wayback enumeration)
• More Information (platform identification, CVE searching, content discovery, parameter discovery)
• Practical Ways of Collecting Low Hanging Fruits (some includes demonstration)
• Practical XSS Hunting
• Host Header Injection
• URL Redirection
• HTML Injection
• File Inclusion
• Missing/Insufficient SPF Records
• Insecure CORS
• Critical File Disclosure
• CSRF
• Quick Go-Throughs (not practical but systematic)
SPEAKER BIO:
Melih Tas completed B.Sc., M.Sc. and Ph.D. education in Computer Science & Engineering.
He has been working as Principal Penetration Tester in a private bank since 2015 in Istanbul, Turkey.
Besides being an award-winning entrepreneur, he secured funds and led cyber-security projects in a private cybersecurity R&D company between 2010 and 2015.
Prior to these, he also worked in a global troubleshooting centre where he found the root causes of telecommunication frauds and security incidents, and he designed effective solutions.
He wrote the National VoIP/UC Security Standard Draft by cooperating with the Turkish Standards Institute. His open-source projects include Mr.SIP: SIP-Based Audit and Attack Tool and SIP-DD: SIP-Based DDoS Defense Tool.
He is an active speaker in hacker conferences including Black Hat Arsenal, Offzone and Nopcon. Among others, he holds an OSCP certificate.
He likes bug bounty hunting in his spare time. His research interests cover the design and analysis of both offensive and defensive security mechanisms in the fields of VoIP Security, Network Security, and Web/Mobile Application Security.
