Spain
Portugal
Good afternoon. Today I'd like to outline in as much detail as possible my vision of how to bughunt corporate portals, what to pay attention to, and what even beginners can find.
Let's start with the first thing: reconnaissance. I won't go into the arsenal of Project Discovery tools like nuclei, naabu, httpx, findomain, and so on. This is a well-worn topic and is well-known to everyone. Anyone interested can find it in one of the articles. What I'd like to highlight is that a huge number of vulnerabilities were discovered this year using Shodan.
Because Shodan allows you to find non-obvious resources without domain names belonging to an organization, it provides the most complete picture. You should be aware of when organizations submit their projects to Bug Bounty and other similar projects.
They've already scanned their sites with projects like nuclei and other dynamic analyzers like ScanFactory and MetaScan. They also have scanners like Nessus running internally, and their security team even dabbles in NMP scanning their own hosts. But the question is how comprehensive the work is. Even the organization's own team doesn't always understand the full scope of their resources. What can be learned on this topic?
2) Working with frameworks
The era of frameworks. Yes, folks, old websites with simple XSS have become obsolete. Now is the time for frameworks. And what you'll find is that frameworks are well-protected by default. Programmers no longer need to understand the mechanics of a particular security feature to implement it. The worst they can do is shoot themselves in the foot by not configuring the protection, or simply disabling it. And here it's crucial to understand which framework you're working with.
What are its key security features? If it's Spring, you need to go and understand all of Spring's security, how it's structured, how authentication and authorization work, how CSRF protection works, and so on, and figure out where the guys might have gone wrong. In fact, in today's reality, all penetration testers need to become AppSec specialists and deeply understand how various security implementations work.
3) IDOR
Yes, good old IDOR. It's still a top hit and the top of all error detection rankings. It's not found by automated tools. That's why there are so many of them. A lot of the security reports I've seen recently at companies I've worked with were related to IDOR. So dig as deep as you can into this topic.
4) API Vulnerabilities
This is a gold mine for those who understand it. It's a separate specialization that you can develop and focus solely on. Learn API hacking, as it holds enormous benefits, as APIs are designed from the ground up, and they still make a huge number of vulnerabilities.
5) SSRF
One of the top vulnerabilities currently found in large corporate environments. Study SSRF and complete all available Portswigger labs on the topic. In fact, complete the entire Portswigger tutorial if you haven't already. Yes, it's difficult. Yes, it's tedious. But it's worth it. It remains one of the best resources for self-study.
6) Authentication and Authorization
There are still errors in Race Condition, OAuth, and SSO logic in JWT token handling. Business logic vulnerabilities that aren't tested by automated verification tools are also very common.
