The Ultimate BAC and IDOR guide for Ethical Hacking

Focused View

Experts with David Bombal,Wesley Thijs

48:59

89 View

1. Introduction

1.1 GENERAL-Syllabus-051022-203234.pdf

1. GENERAL-Syllabus.html

2.1 GENERAL-000. Introduction-211022-161844.pdf

2. GENERAL-000. Introduction.mp4

01:09

3. GENERAL-000. Demo.mp4

01:39

2. Getting help

1.1 David Bombals Discord Server.html

1. Answering your questions.mp4

01:59

2. Udemy Tips and Tricks.mp4

03:46

3. What is BAC

1.1 GENERAL-010 - So what exactly is BAC -211022-161902.pdf

1. GENERAL-010 - So what exactly is BAC.mp4

04:45

2.1 GENERAL-011. What the IDOR -211022-161923.pdf

2. GENERAL-011. What the IDOR.mp4

02:30

4. Manually hunting BAC

1.1 GENERAL-020. Manual BAC and IDOR hunting-211022-162103.pdf

1. GENERAL-020. Manual BAC and IDOR hunting.mp4

07:06

2.1 GENERAL-021 SOLUTION - Hack cheeseBlog-211022-162143.pdf

2.2 GENERAL-021. Manual testing assignment-211022-162126.pdf

2. GENERAL-021. Manual testing assignment.mp4

04:44

3.1 GENERAL-022 Solutions-201022-204002.pdf

3. GENERAL-022 Solutions.html

4.1 GENERAL-022. Assignement 2 Manual BAC Hunting-211022-162229.pdf

4.2 GENERAL-023 Assignment 3 Finding hidden links-211022-162252.pdf

4. GENERAL-022. Assignment 2 & 3.html

5. Automated hunting with burp suite

1.1 GENERAL-030. Automated BAC hunting with burp suite-211022-162318.pdf

1.2 GENERAL-031 Assignment Automated burp suite hunting-211022-162344.pdf

1. GENERAL-030. Automated BAC hunting with burp suite.mp4

06:26

6. Automated hunting with ZAP

1.1 GENERAL-040 Hunting BAC with ZAP-211022-162404.pdf

1. GENERAL-040 Hunting BAC with ZAP.mp4

14:55

7. Capstone project

1.1 GENERAL-050 Capstone project-211022-162430.pdf

1. GENERAL-050 Capstone project.html

8. XTRA - Extras

1.1 XTRA01 - Permission matrix example.pdf

1. XTRA01 - Permission matrix example.html

2.1 xtra02- mindmap bac.zip

2. XTRA02- Mindmap BAC.html

Description

Learn how to find, exploit and even automate the most common exploit type in the OWASP top 10 - 2021

What You'll Learn?

BAC Hacking with ZAP
BAC Hacking with burp
CI/CD Pipeline
Semi-automated hacking
Insecure Direct Object Reference
Broken Access Control

Who is this for?

Beginner hackers looking to thoroughly add another exploit type to their repetoire

More details

Description
First of all, we have to start by explaining to you what is in this course. You might have heard of the terms Broken Access Control (BAC) and Insecure Direct Object Reference (IDOR) before, but do you really understand what it is all about? In this course, we are going to go through a list of tools, methodologies, tips, and tricks that will help you level up your BAC game.
Who am I?Â
My name is Wesley, IÂ own a pen testing company and throughout the years IÂ have had to design my own way of working. This has led me to my favorite issue type XSSÂ but it also came with a surprising exploit type IÂ turned out to adore!Â I am of course talking about BACÂ and IDOR. With several years of teaching experience, IÂ wanted to build a course to pass my knowledge on to you and to help you grow without having to go through the same growing pains IÂ experienced.
Who is this course for?Â
If you are a beginner hacker who is looking to add a new exploit type to their repertoire or even a medior hacker who wants to further explore BACÂ and IDOR to the point of automation/semi-automating the search for the noble exploit type of BAC.
Why BAC?
Why BAC?Â Because it's the most common exploit type of the OWASPÂ top 10 - 2021 of course! This deceptively difficult exploit pulls you in with its allure of easy exploitation but you will soon realize there is much more than just the surface-level exploits you have to take into account. In my bug bounty journey, IÂ have seen how incredibly common this exploit type is and IÂ hope to bring down its prevalence by teaching you how to find and exploit this bug with different tools.
Who this course is for:
Beginner hackers looking to thoroughly add another exploit type to their repetoire

User Reviews

Rating

average 0

Total votes0

Focused display

Ethical Hacking

Experts with David Bombal

Instructor's Courses

David Bombal, together with some of the best minds in the industry is offering courses on a wide range of topics including networking, programming and software development. Our team has decades of experience teaching students from all over the world. Together we can do more!=======================================Chuck Black=======================================Chuck has been developing software for networking equipment since 1981 and has designed and developed software products for large scale networking environments using languages such as C, C++, and Java. Chuck has been granted 15 patents in the areas of network topology discovery, management, monitoring, health, and access control.Chuck graduated from California Polytechnic State University-San Luis Obispo with Bachelor and Master of Computer Science degrees.Chuck has developed Python for Network Engineers courses for vendors such as Cisco and Juniper Networks. In addition, he has developed numerous SDN application development courses for vendors such as Cisco, HPE and Brocade.Chuck is the co-author of the book SDN: A Comprehensive Approach, a thorough technical and business exploration of software defined networking, which has been used as a textbook for graduate level computer science coursework.Chuck is a well known figure in SDN and network programmability circles. He has made participated in organizations such as the Open Networking Foundation (ONF) and the OpenDaylight project.Chuck is the coauthor of one of the most popular SDN books on the market today: Software Defined Networks: A Comprehensive Approach.=======================================Hank Preston=======================================Hank’s two passions are technology and theatre. Bringing them together drives him towards a borderline obsession on creating entertaining presentations, labs and demonstrations that breakdown complex technology topics for audiences. After spending several years working on and behind the scenes on stage productions, what started as a hobby turned to a profession when Hank entered the IT industry with a focus on web and database development and engineering. Drifting from development into infrastructure engineering brought him to Cisco as a Systems Engineer, focusing on Data Center and Cloud Architecture for large enterprise customers. And after six years as an SE, Hank took up the mantle of a Developer Evangelist with DevNet where he can focuses full time on reminding everyone that technology can and should be fun to work with. Hank holds a Master Degree in Information Systems as well as several certifications including CCIE R/S 38336 from Cisco. =======================================David Bombal=======================================David Bombal (CCIE #11023 Emeritus) passed his Cisco Certified Internetwork Expert Routing and Switching exam in January 2003 and is one of a small percentage of Cisco Engineers that pass their CCIE labs on their first attempt. David qualified as a Cisco Certified Systems Instructor (CCSI #22787) many years ago! He has been training Cisco courses for over 15 years and has delivered instructor led courses in various countries around the world covering a wide range of Cisco topics from CCNA to CCIE.He has also personally developed Cisco engineer utilities such as the VPN Config Generator, software, training materials, EBooks, videos and other products which are used throughout the world.David has designed, implemented and managed networks ranging from single sites to those that span 50 countries.

Wesley Thijs

Instructor's Courses

I am the XSS Rat, an experienced ethical hacker who stands for quality and who believes knowledge is a building block we can all use to grow bigger than we ever were. As a software test i have a unique skill set that centers around logic flaws and IDORs which i have not seen very much by other hunters. This gives me the advantage of finding less duplicates and maximizing my chance of finding a vulnerability by picking the correct target and applying the correct test strategy.

Udemy

View courses Udemy

Students take courses primarily to improve job-related skills.Some courses generate credit toward technical certification. Udemy has made a special effort to attract corporate trainers seeking to create coursework for employees of their company.