Bugcrowd University

Created by

Contributors

What is Bugcrowd University?

Bugcrowd University is a free and open source project to help level-up our security researchers. It includes content modules to help our researchers find the most critical and prevalent bugs that impact our customers. Each module will have slide content, videos, and labs for researchers to master the art of bug hunting. As time goes on we hope the community will help us curate BCU and create a new standard for security testing training!

Modules

Module	Slides	Video	Lab Guide	Authors
An Introduction to BCU	Slides	Video	N/A	,
How to Make a Good Submission	Slides	Video	N/A
An Introduction to Burp Suite	Slides	Video	N/A	,
Broken Access Control Testing	Slides	Video	Labs
Cross Site Scripting	Slides	Video	Labs
Recon and Discovery	Slides	Video	N/A
Server Side Request Forgery	Slides	Video	N/A	,
GitHub Recon and Sensitive Data Exposure	Slides	Video	N/A
XML External Entity Injection	Slides	Video	N/A
Burp Suite Advanced	Slides	Video	N/A

Planned Modules

Module	Slides	Video	Lab Guide	Authors
To Be Determined	Slides	Video	N/A	N/A

Previous Work

Bugcrowd believes in empowering its crowd through education. Some portions of Bugcrowd University were inspired by the DEF CON 23 talk, How to Shot Web, as well as several iterations of The Bug Hunter's Methodology talks. Because these talks outgrew the standard conference slot, each topic is represented in Bugcrowd University here as an entire module. Below are those past talks archived for your viewing should you want to add them to your education. We have also added several other useful talks and presentations by Bugcrowd staff that we think highlights great learning opportunities for our researchers:

Topic	Slides	Video	Authors
How to Shot Web (DEF CON 23) / The Bug Hunter's Methodology 1.0	Slides	Video
The Bug Hunter's Methodology 2.1 (Nullcon)	Slides	Video for 2.0
The Bug Hunter's Methodology 3(ish) (Bugcrowd LevelUp 0x02)	Slides	Video
Practical Tips For Running A Successful Bug Bounty Program (AppSecUSA 2016 & AppSecEU 2016)	Slides	Video 1 Video 2	, ,
HUNT: Data Driven Web Hacking & Manual Testing (DEF CON 25 & AppSecUSA 2017)	Slides	Video 1 Video 2	,

Bugcrowd's LevelUp 0x03

Topic	Video	Authors
LevelUp 0x03 - Why humans suck at calculating risk and how it affects security	Video
LevelUp 0x03 - Serverless Top 10 Vulnerabilities	Video
LevelUp 0x03 - Profiling the Attacker - Using Offender Profiling In SOC Environments	Video
LevelUp 0x03 - AEM hacker - approaching Adobe Experience Manager webapps	Video
LevelUp 0x03 - Social Engineering 101	Video
LevelUp 0x03 - Finding Bugs with Binary Ninja	Video
LevelUp 0x03 - API Security 101	Video
LevelUp 0x03 - Bad API, hAPI Hackers!	Video
LevelUp 0x03 - What's in my hacking tool box?	Video
LevelUp 0x03 - From CTF to CVE	Video
LevelUp 0x03 - Behind the Curtain: Safe Harbor and Department of Defense	Video	,,
LevelUp 0x03 - What you reap, is what you sow	Video
LevelUp 0x03 - From an IVI in a box to a CAR in a box	Video
LevelUp 0x03 - IoT - Attacker Point of View	Video
LevelUp 0x03 - Turbo Intruder: Abusing HTTP Misfeatures to Accelerate Attacks	Video
LevelUp 0x03 - iPhone Baseband Research + Reversing	Video
LevelUp 0x03 - The Law and You: Reducing the Cost of Free Speech	Video
LevelUp 0x03 - Mach0 and the App Store	Video

Bugcrowd's LevelUp and LevelUp 0x02

Bugcrowd also has run several community-driven and researcher testing based conferences. These presentations are full of great educational content for a bug hunter. These are highly recommended supplemental materials:

Topic	Video	Authors
LevelUp 0x02 - Intro & Bugcrowd Ambassador Program announcement	Video
LevelUp 0x02 - Small Files And Big Bounties, Exploiting Sensitive Files	Video	, ,
LevelUp 0x02 - Trickle Down PwnOnomics	Video
LevelUp 0x02 - Meet a Bugcrowd Program Admin, Twitch	Video
LevelUp 0x02 - Practical recon techniques for bug hunters & pen testers	Video
LevelUp 0x02 - Back to Basics: Application Security Practices in Smart Contract Auditing	Video
LevelUp 0x02 - Hardware Hacking 101	Video
LevelUp 0x02 - Hacking OAuth 2.0 For Fun And Profit	Video
LevelUp 0x01 - Welcome to LevelUp 2017! Intro from Sam Houston	Video
LevelUp 0x01 - Casey Ellis on the State of Bug Bounties & Ask Me Anything	Video
LevelUp 0x01 - Targeting for Bug Bounty Research	Video
LevelUp 0x01 - Giving Back to the Bug Bounty Community	Video
LevelUp 0x01 - Finding Hidden Gems in Old Bug Bounty Programs	Video
LevelUp 0x01 - How to Fail at Bug Bounty Hunting	Video
LevelUp 0x01 - Esoteric sub-domain enumeration techniques	Video
LevelUp 0x01 - MarkDoom: How I Hacked Every Major IDE in 2 Weeks	Video
LevelUp 0x01 - How does unicode affect our security?	Video
LevelUp 0x01 - Browser Exploitation for Fun and Profit	Video
LevelUp 0x01 - Hidden in Plain Site: Disclosing Information via Your APIs	Video
LevelUp 0x01 - Doing recon like a boss	Video
LevelUp 0x01 - Identifying & Avoiding Android app Protections	Video
LevelUp 0x01 - Hacking Internet of Things for Bug Bounties	Video
LevelUp 0x01 - Advanced Android Bug Bounty skills	Video
LevelUp 0x01 - Car Hacking 101	Video
LevelUp 0x01 - OWASP iGoat - Learning iOS App Penetration Testing & Defense	Video
LevelUp 0x01 - Do you like fuzzing?	Video	,
LevelUp 0x01 - Reverse Engineering iOS Mobile Apps	Video	Emily Walls
LevelUp 0x01 - Breaking Mobile App Protection Mechanisms	Video