BugBountyHunter

Overview

A variety of free challenges recreated based on real bug bounty findings. Practise your knowledge learnt from our website and see if you can complete each challenge. After you think you've found the answer you can then reveal the solution to check if you are right!

Syllabus

Newcomer Challenges

Cross Origin Resource Sharing - Checking if a whitelisted string is found is a bad approach
Misc / Application Logic - Can you obtain the sensitive information somehow?
Cross Site Scripting (XSS) - Can you find any XSS on this "harmless" page?
Open URL Redirect - You may only redirect to *.bugbountyhunter.com
Open URL Redirect - Only relative redirects are allowed!
Cross Site Scripting (XSS) - Change the class of our image and pick your favourite!
Cross Site Scripting (XSS) - Can you find any XSS? No HTML tags allowed!

Level Up Your Hacking

Misc / Application Logic - Can you access our private tool, XSS Destroyer?
Test your recon - There's a leak somewhere!
Open URL Redirect - Can you steal the SSO token?
Cross Site Scripting (XSS) - "I've won a bounty" generator
Insecure Direct Object Reference - Check out these HackerPhotos! Nothings wrong here.
Misc / Application Logic - What's behind this admin panel?
Cross Site Scripting (XSS) - This strict URL filter should prevent XSS, right?
Cross Site Request Forgery (CSRF) - There's cross site request forgery (CSRF) protection, but how good is it?

ZSeano's Playground