Skip to main content
Back to course
Log in
Get started
Someone wanted to learn this too, so Grasp built them a personal learning path.
Create your own
Bug bounty hunter learning path
ยท
Module 3
Web Application Analysis & Mapping
1
Configuring a Browser for Proxy Interception
Configure a browser to proxy web traffic through an interception proxy like Burp Suite.
2
Analyzing HTTP/S Traffic
Analyze HTTP/S requests and responses to understand application functionality, including headers, cookies, and API calls.
3
Mapping Attack Surface with Burp Suite Spider and Discovery Tools
Use Burp Suite's spidering and content discovery tools to map the application's attack surface.
4
Identifying Key Application Workflows
Manually browse the application to identify key user workflows and business logic.
5
Inspecting Client-Side Code with Browser DevTools
Use browser developer tools to inspect and analyze client-side code (HTML, CSS, JavaScript).
6
Web Server Reconnaissance with Nikto and Wappalyzer
Identify web server technologies, frameworks, and potential misconfigurations using tools like Nikto and Wappalyzer.
7
API Endpoint Discovery
Enumerate API endpoints by analyzing application traffic and client-side JavaScript files.
8
API Authentication Methods
Differentiate between common API authentication patterns like API Keys, Bearer Tokens (JWT), and OAuth.
Previous module
Network Exploitation & Initial Access
Next module
Authentication & Session Management Flaws