My experience of The Art Of Hacking training, and the story of first critical finding

Hey folk,

I am Jayesh patel. Little bit of $whoami:  I am a bug hunter who is highly motivated towards the field of Web, Mobile application Security and I actively participate on various Bug Bounty Programs/Platforms like Bugcrowd, Hackerone, BugBounty.jp, openbugbounty.org.

 

Why am I writing this blog post ?

ENCIPHERS team asked me about my experience of basic and advanced level training in The Art Of Hacking series, and asked if I would be interested to share my experience through a post. 

So I said yes!!! and here i am writing blog about some of my findings, which I discovered after taking advance level training from ENCIPHERS.

Before the advance level training, I was only able to find the vulnerabilities which were of low-severity but after the training, I found my first critical vulnerability within hours. 

So the journey started on 29 September 2018, when ENCIPHERS team conducted a free training  “The Art Of Hacking: WEB APPLICATION HACKING – BASIC LEVEL“.  The training was awesome, I  learned lot of things to improvise in bug bounty hunting.  ENCIPHERS team also helped me in finding a vulnerability on a web application which I was trying to hack (under a responsible disclosure program).

 

After The Art Of Hacking – Basic Level training, ENCIPHERS team announced about The The Art Of Hacking: WEB APPLICATION HACKING – ADVANCE LEVEL and I Registered for the training. The advance level training was conducted on 16 December 2018, at Vivanta By Taj, New Delhi. This time, it was about advance and critical vulnerabilities like RCE, SQLI, SSRF, XXE  etc.

 

On the day of training, it started with setting up our access on a virtual private server,  Bughunter’s VPS and we were provided with multiple guides (PDFs). One of the other interesting thing was a Hacker Mind-Map designed by ENCIPHERS team.  The Hacker Mind-Map is a detailed flow of steps which one can follow while doing bugbounties or penetration testing. The Bughunter’s VPS was already setup with multiple bug bounty related tools, and a Tools and Usage guide  was also provided. This helped me a lot in finding bugs, just by recon only. The Mind-Map explained, how someone should start with testing a target, and what are the possible tests to do at each stage. 

In the training, we learned about many advance level vulnerabilities, and exploited them in a test application (by taking remote shells and dumping databases). 

Story of my first critical bug:

After the training, while I was returning back to my hometown, I had a few hours on the train station. So I thought of doing some bug hunting using the concepts from training.

So, I choose a target and first thing I learned in training was to understand the scope properly. This was a target with sub-domains included, so I started using my Bughunter’s VPS and discovered all the sub domains using Aqua-tone tool, which was already setup on the VPS. After that enumeration I started port scanning on all the sub-domains using Masscan tool on Bug Hunter VPS.

After scanning, I found that 5002 port was open on target site so I just opened that site www.xyz.com:5002 on chrome.

Yeah…….!!! 🙂 😉

port was open and control panel login page was visible now my second task was to bypass the access control page so I just tried the default credential admin:admin.

After entering username and password I got access of control panel and yeah!!! that was my first critical bug and all thanks to ENCIPHERS team for this amazing training.

 

 

If you are into bug bounties or penetration testing and want to enhance your security skills, I would highly recommend a training by ENCIPHERS.

Once I reported the vulnerability to the target company’s email address, within 24 hours I got a response:

unnamed (4)unnamed (5)

At the end of this blog, I just want to post a picture of me from the training 🙂 Looking forward to more training by ENCIPHERS.

 

DSCN5603

1 comment

Comments are closed.