Day 1: Introduction
- Hacking into One Month with Jon and Chris!
- An Overview of the App We Are Hacking
- Legal Disclaimer
Day 2: Hacker Tools - The Proxy
- Let's Dive into Proxies with Jon and Chris
- Understanding Ports
- Intro to Proxies
- Intercepting Requests with Burp
- Fun With Encoding
Day 3: Account Bruteforcing
- What is Bruteforcing?
- Guessing Usernames and Passwords
- Harvesting One Month
- Password Attacks
- Fixing Error Message
- Enforcing Strong Passwords
- Preventing Brute Force Attacks
Day 4: Breaking Authorization Controls
- Trusting Users
- Securing Request Parameters
- Searching For Vulnerabilities
- Finding Hidden Pages
- Automating File and Directory Discovery with Dirbuster
- Enforcing Admin Access
Day 5: Cross Site Scripting
- Let's Discuss "Cross-Site Scripting"
- Javascript Hacks Using Cross-Site Scripting (XSS)
- Hacking Tool - Beef
Day 6: SQL Injection
- Jon and Chris Break Down SQL Injection
- Introduction to Database Queries Using SQL
- Detecting SQL Injection
- Hack Tool - Sqlmap
- Fixing SQL Injection Vulnerabilities
Day 7: Encryption and Storing Secrets
- Storing Secrets
- Keeping Passwords
- Hack Tool - John The Ripper
- Stronger Hashes with Bcrypt
- Protecting Sensitive Information in a Database
- Reviewing Encryption Code
- Applying Encryption
- Masking Sensitive Data
Day 8: Calling System Commands
- Exploiting System Commands
- Securing File Operations
Day 9: API Security
- "What the Heck is an API?"
- Accessing Models Using an API
- Securing an API
Day 10: Cross-Site Request Forgery
- Explaining Cross Site Forgery
- Ruin a Vacation Using Cross-Site Request Forgery
- Building a Cross-Site Request Forgery Attack
- Hacking Gmail Using CSRF
- Protecting Against CSRF
Day 11: Mass Assignment
- Understanding Mass Assignment
- Privilege Escalation Using Mass Assignment
- Preventing Mass Assignment
- Hacking Github Using Mass Assignment
- Enhancing Mass Assignment with Strong Parameters
Day 12: Insecure Downloads
- Hacking Download Functionality
- Securing File Downloads
Day 13: Keeping Up To Date
- "Why Do I Have to Update Rails?"
- Maintaining Ruby, Rails, and Gems
Day 14: URL Redirection
- URL Redirection Explained
- Understanding URL Redirection Attacks
- Exploiting URL Redirection
- Fixing URL Redirection Vulnerabilities
Day 15: Security Tools - Brakeman
- Code Audits with Brakeman
- Hack Tool - Brakeman
Day 16: OWASP
- What Can OWASP Do for You?
- Additional Resources - OWASP
Day 17: Rumblr
- A Rumblr in the Jungle with Jon and Chris
- Rumblr Walkthrough
Day 18: Rumblr Security Issues
- Rumblr Hack #1
- Rumblr Hack #2
- Rumblr Hack #3
- Rumblr Hack #4
- Rumblr Hack #5
- Rumblr Hack #6
Going Deeper with Jon Rose
- Hey Jon, "What's Next?"
- What is a Bug Bounty?
- What's the Day in the Life of a Web Security Hacker?
