Hacker101 - Introduction

Summary

Hacker101 introduces the course’s goals and foundational approach to web security testing. It covers identifying, exploiting, and remediating common and less familiar vulnerabilities; handling cryptography; reviewing application designs; and working as a bug bounty hunter or security consultant.

Recommended Tools and Preparation

• Burp Proxy is recommended for monitoring and modifying HTTP/HTTPS traffic. The free edition is sufficient for the course, though the instructor recommends the Pro version for practical work.
• Firefox is recommended because its proxy settings can be configured separately from the rest of the system, and its developer tools can help inspect cookies and the DOM. Chrome and other alternatives can also work.
• Learners should be able to run Java applications and automate web requests. Python’s Requests library is suggested for writing request scripts.

Testing Mindset and Prioritization

The course encourages testers to think like attackers: explore an application, test its controls, and consider how its features might fail. Attackers need to find only one useful vulnerability, while defenders need to find them all. Testers should therefore prioritize rather than expect to uncover every bug.

A useful process is to identify an application’s functions, consider what an attacker could gain by compromising each one, and focus on higher-risk areas. For example, an e-commerce site may hold payment information, while a monitoring application may contain data an attacker could alter or destroy. Developers can also be asked which risks concern them most.

Vulnerability Reporting

A bug report should include:

• Title
• Severity
• Description
• Reproduction steps
• Security impact
• Mitigation
• Affected URLs

Severity depends on context. The instructor’s approximate scale ranges from informational and low impact through medium and high, up to critical issues such as serious data exposure or system compromise.

First Vulnerability: Reflected XSS

The example demonstrates reflected cross-site scripting (XSS): user-provided input is inserted directly into an HTML response without adequate sanitization or encoding. An attacker may use this to make a victim’s browser run JavaScript in the victim’s account context. Reflected input can appear in ordinary places, such as search results.

The next session is previewed as an in-depth look at browsers and the web, followed by cross-site request forgery (CSRF). Learners are encouraged to set up a proxy, browse through it, and observe how data flows, including where their own sites reflect user input.

Main Speaker

Cody Broches, identified as a HackerOne researcher and the course instructor.