Stage B — Practitioner
Doing the work under authorization: the hard rules and scope discipline that make everything legal, engagement methodology, the toolbench in activation order, the web vulnerability classes found, reproduced and fixed one by one, defensive basics, and how authorized testing is actually offered to beginners through bug bounty programs.
Published 2026-10-09 · generated from the lesson data
The milestone
A first valid finding submitted to a program that authorizes testing — in scope, reproducible by a stranger following your steps, with the impact argued honestly.
The lessons
1. Authorization, scope, and the hard rules
This is the lesson that gates everything after it. Every hands-on lesson in Stage B — every lab you stand up, every PortSwigger exercise, every bounty report you will ever write — assumes you can state, in writing, what…
2. Engagement methodology: WSTG, PTES, and NIST SP 800-115
Authorization tells you what you may touch. Methodology tells you what to do with it, in what order, and what each step produces. Without a methodology you poke at random: you find the easy bugs, miss the structural…
3. The toolbench: fifteen phases, one question each
Every engagement in the methodology lesson runs on tools, and every tool in this lesson exists to answer exactly one question. Beginners collect tools; professionals collect answers. The difference shows up in the…
4. Setting up practice targets locally
Every hands-on lesson in this guidebook needs a target you are allowed to touch, and the answer is always the same: one you run yourself, on your own machine, bound to localhost. This lesson builds that bench of targets…
5. IDOR: Insecure Direct Object References
IDOR is the single highest-yield vulnerability class for a beginning bounty hunter: it is common, it is usually simple to prove, and its impact writes itself ("one user reads another user's data"). It sits inside…
6. API abuse: the flaws that live behind the JSON
Modern applications are APIs wearing a web page as a costume: the front end is JavaScript calling JSON endpoints, and the mobile app talks to the same endpoints directly. Testers who only click the UI miss the real…
7. SQL injection: when your input becomes the query
SQL injection is the oldest injection class on the web and still one of the most damaging: it sits inside OWASP Top 10:2025 A05 — Injection and carries its own weakness ID, CWE-89. You…
8. OS command injection: when your input reaches a shell
OS command injection is SQL injection's sibling one layer down: instead of the database executing your input as code, the operating system does. It sits inside OWASP Top 10:2025 A05 —…
9. SSRF: when the server fetches what you tell it to
Server-side request forgery is the vulnerability where the attacker doesn't make the request — the server does, on the attacker's behalf, to a destination the attacker chose. It sits in…
10. CSRF: when the victim's browser does the attacker's work
Cross-site request forgery is the attack where the victim's own browser issues the malicious request — authenticated, cookie-attached, indistinguishable from legitimate traffic. It sits in OWASP Top 10:2025…
11. Cross-site scripting: when the browser can't tell your code from the attacker's
Every application that renders user input in a page can carry XSS, which makes it the most common web vulnerability class you will meet in bounty programs and penetration tests. It sits in OWASP Top 10:2025 A05…
12. Server-side template injection: when your input becomes the program
Web applications build pages from templates: files mixing fixed HTML with placeholders the server fills in (Hello, {{ name }}). Template injection happens when attacker input stops being…
13. XXE: when the parser works for the attacker
XML is still everywhere: SOAP APIs, SAML assertions (SAML — Security Assertion Markup Language — the XML-based tokens used in single sign-on logins), document uploads (DOCX/XLSX are zipped XML), SVG images,…
14. Insecure deserialization: when data builds the objects
Applications constantly convert objects to bytes and back — sessions in cookies, cached objects, messages between services, "remember me" tokens. Serialization is object→bytes;…
15. GraphQL abuse: the query language that trusts the querier
GraphQL replaces REST's fixed endpoints with a single endpoint that answers whatever shape the client asks for: the client writes the query, the server resolves it. That flexibility is the feature — and the…
16. Race conditions: when "check, then act" isn't atomic
Most web code runs as check, then act: check the coupon is unused, then apply the discount; check the balance covers the transfer, then move the money; check the username is free, then create the…
17. Business-logic flaws: when the code works and the rules don't
Business-logic flaws are the highest-creativity class in bounty work: no injection, no misconfiguration, just the application's own rules failing when a user deviates from the expected path. They sit in OWASP…
18. Broken authentication and session management: proving who you are, and staying proven
Authentication is the gate every other control stands behind: if an attacker can become the victim, authorization checks are answering the wrong question. It sits in OWASP Top 10:2025 A07 — Authentication…
19. JWT and OAuth flaws: trusting the token more than the verifier deserves
JSON Web Tokens carry identity between services: header.payload.signature, base64url-encoded, the signature proving the payload wasn't tampered with. OAuth 2.0 is the delegation protocol that hands those…
20. Security headers and browser defenses: telling the browser what "safe" means
Security headers are the cheapest defense-in-depth in web security: a handful of response headers that change how the browser treats your pages — blocking inline scripts, upgrading connections to HTTPS, refusing to be…
21. Bug bounty mechanics: how authorized testing is actually offered to beginners
Every vulnerability class you have learned to find and fix has to be found somewhere legal before any of it matters. Bug bounty programs are the market where that happens: an organization publishes what you may…
In reading order, 21 lessons. Every lesson follows the same ten parts — mechanism, walkthrough, sources, proof — and every walkthrough was executed and dated.
What you can honestly claim
You can honestly claim: you have found, reproduced, and fixed real vulnerability classes on targets you were authorized to test, and you can write a triage-ready report. You cannot yet claim: professional experience, any certification, or readiness for unsupervised work. Stage B is the first evidence, not the last.
What comes next
When the milestone is met, continue to Stage C — Professional.