/bugcrowd_university

Open source education content for the researcher community

Creative Commons Attribution 4.0 InternationalCC-BY-4.0

Bugcrowd University

Created by

Twitter Twitter

Contributors

Twitter

What is Bugcrowd University?

Bugcrowd University is a free and open source project to help level-up our security researchers. It includes content modules to help our researchers find the most critical and prevalent bugs that impact our customers. Each module will have slide content, videos, and labs for researchers to master the art of bug hunting. As time goes on we hope the community will help us curate BCU and create a new standard for security testing training!

Modules

Module Slides Video Lab Guide Authors
An Introduction to BCU Slides Video N/A Twitter, Twitter
How to Make a Good Submission Slides Video N/A Twitter
An Introduction to Burp Suite Slides Video N/A Twitter, Twitter
Broken Access Control Testing Slides Video Labs Twitter
Cross Site Scripting Slides Video Labs Twitter

Planned Modules

Module Slides Video Authors
Recon and Discovery Slides Video N/A
Server Side Request Forgery Slides Video N/A
Security Misconfiguration Slides Video N/A
XML External Entity Injection Slides Video N/A
Advanced Burp Suite Slides Video N/A

Previous Work

Bugcrowd believes in empowering its crowd through education. Some portions of Bugcrowd University were inspired by the DEF CON 23 talk, How to Shot Web, as well as several iterations of The Bug Hunter's Methodology talks. Because these talks outgrew the standard conference slot, each topic is represented in Bugcrowd University here as an entire module. Below are those past talks archived for your viewing should you want to add them to your education. We have also added several other useful talks and presentations by Bugcrowd staff that we think highlights great learning opportunities for our researchers:

Topic Slides Video Authors
How to Shot Web (DEF CON 23) / The Bug Hunter's Methodology 1.0 Slides Video Twitter
The Bug Hunter's Methodology 2.1 (Nullcon) Slides Video for 2.0 Twitter
The Bug Hunter's Methodology 3(ish) (Bugcrowd LevelUp 0x02) Slides Video Twitter
Practical Tips For Running A Successful Bug Bounty Program (AppSecUSA 2016 & AppSecEU 2016) Slides Video 1 Video 2 Twitter, Twitter, Twitter
HUNT: Data Driven Web Hacking & Manual Testing (DEF CON 25 & AppSecUSA 2017) Slides Video 1 Video 2 Twitter, Twitter

Bugcrowd's LevelUp and LevelUp 0x02

Bugcrowd also has run several community-driven and researcher testing based conferences. These presentations are full of great educational content for a bug hunter. These are highly recommended supplemental materials:

Topic Video Authors
LevelUp 0x02 - Intro & Bugcrowd Ambassador Program announcement Video Twitter
LevelUp 0x02 - Small Files And Big Bounties, Exploiting Sensitive Files Video Twitter, Twitter, Twitter
LevelUp 0x02 - Trickle Down PwnOnomics Video Twitter
LevelUp 0x02 - Meet a Bugcrowd Program Admin, Twitch Video Twitter
LevelUp 0x02 - Practical recon techniques for bug hunters & pen testers Video Twitter
LevelUp 0x02 - Back to Basics: Application Security Practices in Smart Contract Auditing Video Twitter
LevelUp 0x02 - Hardware Hacking 101 Video Twitter
LevelUp 0x02 - Hacking OAuth 2.0 For Fun And Profit Video Twitter
LevelUp 0x01 - Welcome to LevelUp 2017! Intro from Sam Houston Video Twitter
LevelUp 0x01 - Casey Ellis on the State of Bug Bounties & Ask Me Anything Video Twitter
LevelUp 0x01 - Targeting for Bug Bounty Research Video Twitter
LevelUp 0x01 - Giving Back to the Bug Bounty Community Video Twitter
LevelUp 0x01 - Finding Hidden Gems in Old Bug Bounty Programs Video Twitter
LevelUp 0x01 - How to Fail at Bug Bounty Hunting Video Twitter
LevelUp 0x01 - Esoteric sub-domain enumeration techniques Video Twitter
LevelUp 0x01 - MarkDoom: How I Hacked Every Major IDE in 2 Weeks Video Twitter
LevelUp 0x01 - How does unicode affect our security? Video Twitter
LevelUp 0x01 - Browser Exploitation for Fun and Profit Video Twitter
LevelUp 0x01 - Hidden in Plain Site: Disclosing Information via Your APIs Video Twitter
LevelUp 0x01 - Doing recon like a boss Video Twitter
LevelUp 0x01 - Identifying & Avoiding Android app Protections Video Twitter
LevelUp 0x01 - Hacking Internet of Things for Bug Bounties Video Twitter
LevelUp 0x01 - Advanced Android Bug Bounty skills Video Twitter
LevelUp 0x01 - Car Hacking 101 Video Twitter
LevelUp 0x01 - OWASP iGoat - Learning iOS App Penetration Testing & Defense Video Twitter
LevelUp 0x01 - Do you like fuzzing? Video Twitter, Twitter
LevelUp 0x01 - Reverse Engineering iOS Mobile Apps Video Emily Walls
LevelUp 0x01 - Breaking Mobile App Protection Mechanisms Video Twitter

License

CC-BY-4.0 - Creative Commons Attribution 4.0 International