Starting Practical Bug Bounty: Web Application Security Foundations

Last night, I enrolled in Practical Bug Bounty from TCM Security and Intigriti to prepare for the Practical Web Pentest Associate (PWPA) certification.

Tonight, I started the learning path by watching the course introduction and the videos on the importance of web application security, security standards, and best practices.

What the Course Covers

The introduction featured the course instructors, Heath Adams, Alex Olsen, and Jonah Burgess, and outlined the material ahead:

Introductory Sections

Introduction
Web Application Security Intro
Before We Attack
Lab Build
Web Application Technologies

Recon and Information Gathering

Technology fingerprinting
Directory enumeration
Brute-force attacks
Subdomain enumeration
Burp Suite overview

Attacks

Authentication and authorization testing, including brute-force attacks, MFA-related weaknesses, and insecure direct object references (IDORs)
Injection and related attacks, including local and remote file inclusion (LFI/RFI), SQL injection, cross-site scripting (XSS), server-side template injection (SSTI), command injection, XML external entity (XXE) attacks, and file upload vulnerabilities
Other common attacks, including cross-site request forgery (CSRF), server-side request forgery (SSRF), and subdomain takeovers

Wrapping Up

Reporting
Evasion techniques
Closing topics

These are topics in the course outline. Tonight's session focused on the introductory material.

Why Web Application Security Matters

The Web Application Security module began with a high-level review of why this work matters:

Protecting data
Maintaining customer trust
Meeting legal and regulatory requirements
Preventing business disruption
Protecting brand reputation
Preventing financial loss
Protecting intellectual property
Preventing identity theft

Security Best Practices

The videos also reviewed practices that help protect web applications:

Regular patching and updates
Applying the principle of least privilege
Secure coding, including input validation and sanitization
Secure data storage
Multi-factor authentication
Logging and monitoring
User training

Security References and Further Reading

The session introduced resources for understanding common risks and weaknesses:

OWASP Top 10, an awareness resource covering major web application security risks
Common Weakness Enumeration (CWE), a catalog of software and hardware weaknesses
SANS Top 25

At the end of the session, we were encouraged to explore these resources further. This entry documents the introductory material I covered as I continue preparing for PWPA.