Who's talking?
Quick intro before we start breaking things.
$ whoami
Aditya Dindi aka pyrus
$ cat bio.txt
UTSA grad currently working as a Cybersecurity Engineer / Pentester. Previously an Application Security Intern at Paycom and a Cyber Operations Intern at MITRE.
$ echo $ROLE $LOCATION
Red Team @ Viasat · San Diego
$ ls ~/highlights
- CPTC Central Regional Champion (1st Place, 2023)
- CSRF on GroupMe
- Prev. Officer / President @ CompTIA Student Chapter
- Former RowdyCon (Rowdy CyberCon) host
$ cat education.txt
BBA Cybersecurity: University of Texas at San Antonio
$ ls ~/certs
OSCPOffSec
CWESHack The Box
Security+CompTIA
CySA+CompTIA
$
The plan for today
- See what actually happens between your browser and a web server
- Get comfortable with the tools that let you watch and tamper with that traffic
- Learn the big three bug families: injection, XSS, and broken access control
- Hack 8 purpose-built vulnerable apps and grab their flags
Rules of engagement
These labs exist to be attacked, so go wild. Real systems are different: if you don't own it or don't have
written permission to test it, don't touch it. Unauthorized testing is illegal. Stick to labs, CTFs, and bug
bounty programs that invite you in.
01-web-basics →