Real-World Bug Hunting A Field Guide to Web Hacking (Peter Yaworski)（Z-Library）

# Real-World Bug Hunting: A Field Guide to Web Hacking ## 【One-Line Pitch】 A practical, story-driven guide to finding real security vulnerabilities in web applications, taught through actual bug bounty case studies from companies like Twitter, Uber, and HackerOne. Perfect for aspiring ethical hackers and developers who want to understand how attackers think and how to write more secure code. ## 【Book Arc】 - **Opening (~0%–9%)**: Establishes the fundamentals—how the internet works, HTTP requests and responses, status codes, and core concepts like clients, servers, and statelessness. This groundwork is essential for understanding why vulnerabilities exist. - **Early (~9%–28%)**: Introduces common vulnerability classes through real bug bounty reports, starting with open redirects, HTTP parameter pollution, and cookie manipulation. Each case study walks through the discovery process and the thinking behind the exploit. - **Early–Middle (~28%–38%)**: Covers injection-style attacks including CRLF injection, cross-site scripting (XSS), and client-side template injection (CSTI). These chapters emphasize how encoding tricks and browser quirks can bypass filters. - **Middle (~38%–47%)**: Dives into server-side attacks—SQL injection (SQLi) and server-side request forgery (SSRF)—with detailed examples of how attackers extract database information or reach internal systems. - **Late (~47%–end)**: The excerpts suggest the book continues with more advanced vulnerability types, tooling (like sqlmap), and guidance on participating in bug bounty programs and writing effective reports. ## 【Key Takeaways】 - **HTTP fundamentals are the foundation of web hacking** (Early): Understanding requests, responses, status codes, and statelessness is prerequisite knowledge—vulnerabilities emerge from unintended actions or unexpected input at these layers. - **Persistence pays off in bug hunting** (Early): The Twitter HPP case shows that when a first attempt fails (changing a UID), trying a second parameter with the same name can bypass signature validation—knowledge of obscure attack types matters. - **Cookie attributes are security controls** (Early): The `secure` and `httponly` flags determine when browsers send and read cookies; misconfigurations here can expose session data or enable injection attacks. - **Encoding is both a defense and an attack vector** (Early): Sites that sanitize input by modifying it (rather than encoding/escaping) are vulnerable—test with URI-encoded values like `%2F` and use tools like CyberChef to explore encoding bypasses. - **Blacklists are inherently bypassable** (Early): The Twitter CRLF case demonstrates that character encoding tricks can circumvent blacklist filters, especially when combined with browser-specific bugs. - **Template injection can escalate to full XSS** (Middle): The Uber AngularJS case shows how client-side template injection (CSTI) in older frameworks with sandbox escapes can lead to arbitrary JavaScript execution. - **SQL injection remains a high-impact vulnerability** (Middle): Attackers can extract database names, usernames, and hostnames—or even create admin accounts—and tools like sqlmap automate the process; always re-encode payloads to match server expectations. - **Think like a developer to find bugs** (Early): When sanitization modifies input, consider what assumptions the developer made—like what happens with duplicate attributes or how spaces are replaced—and test those edge cases. ## 【Reading Tips】 - **Skim the HTTP fundamentals chapter** if you already know how requests and responses work—but don't skip the statelessness discussion, as it explains why cookies and sessions matter. - **Deep-read the case studies**: Each bug bounty report is a mini-story with a "Takeaways" section—these are the gold. Pay attention to the thought process, not just the payload. - **Watch for recurring patterns**: Encoding bypasses, parameter pollution, and filter evasion appear across multiple chapters—note how the same core idea manifests differently. - **The SQLi and SSRF chapters are denser**: If you're new to databases or server-side concepts, read these more slowly and consider running the examples in a lab environment. - **Use the appendix tools**: The book references tools like sqlmap and CyberChef—familiarize yourself with these before attempting hands-on practice. ## 【Coverage Limits】 This guide is based on excerpts covering roughly the first half of the book (through SQLi and SSRF). Later chapters on additional vulnerability types, advanced tooling, and career guidance for bug bounty hunting are not covered in detail here. ##