Top 4 Web hacking demos for aspiring hackers (with labs and CTF)

Summary

David Bombal interviews Justin Gardner, a full-time bug bounty hunter, about getting started in web hacking. Gardner demonstrates four common vulnerability classes in browser-based labs, followed by a bonus challenge that combines the techniques.

Demonstrations and Technical Concepts

1. IDOR (Insecure Direct Object Reference)

A user changes an ID in a URL and can view another user’s private information. In the demo, browser network tools show that an API request returns the data.

Gardner says IDORs still occur in real applications, including at major companies. Less-visible parts of a site can be fruitful places to investigate.

2. Broken Access Controls

The lab presents a read-only account with a disabled delete button. Removing the button’s disabled attribute allows the action to be attempted.

The key lesson is that changing the interface alone is not a vulnerability. The issue arises only if the server accepts an action the user should not be allowed to perform. Gardner connects the simplified demo to real cases where requests are not properly authorized by the server.

3. Cross-Site Scripting (XSS)

A search term is reflected on a page. Entering HTML shows that user input is being rendered as code rather than plain text.

Gardner explains that XSS can enable JavaScript execution in a victim’s browser. Basic reflected XSS is less common than it once was because of framework-level protections, while more complex cases may require understanding how the application handles data and browser security controls.

4. Cross-Site Request Forgery (CSRF)

In the demo, a simple request triggers account deletion without an additional confirmation or token. If a victim is logged in and visits an attacker-controlled site, that site may be able to cause the victim’s browser to make the request.

Gardner says same-site cookies have made some CSRF cases harder, but request-forgery issues still arise, including in account-linking flows.

5. Bonus Challenge: Combining Techniques

The interface hides a challenge behind a disabled button. After accessing it, the task is to find a user’s password. The IDOR technique reveals the target user, and inspecting the API response exposes a value that is not shown in the interface.

Gardner says returning a password is an exaggerated example, but APIs can expose other sensitive fields omitted from the UI. He gives the example of an API returning a person’s age when it was not displayed.

Advice and Resources

• Gardner recommends spending roughly 200 hours learning vulnerability types, then choosing one area—he often suggests IDOR—and moving from study to hands-on testing rather than getting stuck in “learners’ purgatory.”
• He stresses persistence: repeated failures are normal, and learning to investigate an application deeply is part of the process.
• Suggested learning resources include Caido labs, PortSwigger Academy, disclosed bug bounty reports on HackerOne, and AI as a learning companion.
• Bug bounty platforms mentioned include HackerOne, Bugcrowd, Intigriti, and YesWeHack, as well as company-run programs. Gardner advises testing only where a vulnerability disclosure policy or bug bounty program authorizes it.
• On making a career of bug bounty work, Gardner says high earnings are possible but concentrated among highly successful hunters. He advises not quitting a job immediately: first build a track record and earn at least a full-time salary from bug bounty work part-time. He also notes that financial stress can make the work harder.
• Gardner says AI has lowered the effort needed to build automation and can assist with hacking when directed by someone knowledgeable. He sees it as changing the field without eliminating opportunities for persistent researchers.

Main Speakers and Sources

• David Bombal: Host and interviewer.
• Justin Gardner: Full-time bug bounty hunter and host of the Critical Thinking Bug Bounty podcast; presenter of the demos and career advice.
• Resources mentioned: Caido labs, PortSwigger Academy, HackerOne write-ups, and other bug bounty platforms.