Bugcrowd University is a free and open source project to help level-up our security researchers. It includes content modules to help our researchers find the most critical and prevalent bugs that impact our customers. Each module will have slide content, videos, and labs for researchers to master the art of bug hunting. As time goes on we hope the community will help us curate BCU and create a new standard for security testing training!
| Module | Slides | Video | Lab Guide | Authors |
|---|---|---|---|---|
| An Introduction to BCU | Slides | Video | N/A | ,  |
| How to Make a Good Submission | Slides | Video | N/A | |
| An Introduction to Burp Suite | Slides | Video | N/A | , |
| Broken Access Control Testing | Slides | Video | Labs | |
| Cross Site Scripting | Slides | Video | Labs | |
| Recon and Discovery | Slides | Video | N/A |  |
| Server Side Request Forgery | Slides | Video | N/A |  ,  |
| GitHub Recon and Sensitive Data Exposure | Slides | Video | N/A |  |
| XML External Entity Injection | Slides | Video | N/A |  |
| Burp Suite Advanced | Slides | Video | N/A |  |
| Module | Slides | Video | Lab Guide | Authors |
|---|---|---|---|---|
| To Be Determined | Slides | Video | N/A | N/A |
Bugcrowd believes in empowering its crowd through education. Some portions of Bugcrowd University were inspired by the DEF CON 23 talk, How to Shot Web, as well as several iterations of The Bug Hunter's Methodology talks. Because these talks outgrew the standard conference slot, each topic is represented in Bugcrowd University here as an entire module. Below are those past talks archived for your viewing should you want to add them to your education. We have also added several other useful talks and presentations by Bugcrowd staff that we think highlights great learning opportunities for our researchers:
| Topic | Slides | Video | Authors |
|---|---|---|---|
| How to Shot Web (DEF CON 23) / The Bug Hunter's Methodology 1.0 | Slides | Video | |
| The Bug Hunter's Methodology 2.1 (Nullcon) | Slides | Video for 2.0 | |
| The Bug Hunter's Methodology 3(ish) (Bugcrowd LevelUp 0x02) | Slides | Video | |
| Practical Tips For Running A Successful Bug Bounty Program (AppSecUSA 2016 & AppSecEU 2016) | Slides | Video 1 Video 2 |  ,  ,  |
| HUNT: Data Driven Web Hacking & Manual Testing (DEF CON 25 & AppSecUSA 2017) | Slides | Video 1 Video 2 | , |
| Topic | Video | Authors |
|---|---|---|
| LevelUp 0x03 - Why humans suck at calculating risk and how it affects security | Video |  |
| LevelUp 0x03 - Serverless Top 10 Vulnerabilities | Video |  |
| LevelUp 0x03 - Profiling the Attacker - Using Offender Profiling In SOC Environments | Video |  |
| LevelUp 0x03 - AEM hacker - approaching Adobe Experience Manager webapps | Video |  |
| LevelUp 0x03 - Social Engineering 101 | Video |  |
| LevelUp 0x03 - Finding Bugs with Binary Ninja | Video |  |
| LevelUp 0x03 - API Security 101 | Video |  |
| LevelUp 0x03 - Bad API, hAPI Hackers! | Video |  |
| LevelUp 0x03 - What's in my hacking tool box? | Video |  |
| LevelUp 0x03 - From CTF to CVE | Video |  |
| LevelUp 0x03 - Behind the Curtain: Safe Harbor and Department of Defense | Video |  , , |
| LevelUp 0x03 - What you reap, is what you sow | Video |  |
| LevelUp 0x03 - From an IVI in a box to a CAR in a box | Video |  |
| LevelUp 0x03 - IoT - Attacker Point of View | Video |  |
| LevelUp 0x03 - Turbo Intruder: Abusing HTTP Misfeatures to Accelerate Attacks | Video |  |
| LevelUp 0x03 - iPhone Baseband Research + Reversing | Video |  |
| LevelUp 0x03 - The Law and You: Reducing the Cost of Free Speech | Video | |
| LevelUp 0x03 - Mach0 and the App Store | Video |  |
Bugcrowd also has run several community-driven and researcher testing based conferences. These presentations are full of great educational content for a bug hunter. These are highly recommended supplemental materials:
| Topic | Video | Authors |
|---|---|---|
| LevelUp 0x02 - Intro & Bugcrowd Ambassador Program announcement | Video | |
| LevelUp 0x02 - Small Files And Big Bounties, Exploiting Sensitive Files | Video |  ,  ,  |
| LevelUp 0x02 - Trickle Down PwnOnomics | Video |  |
| LevelUp 0x02 - Meet a Bugcrowd Program Admin, Twitch | Video |  |
| LevelUp 0x02 - Practical recon techniques for bug hunters & pen testers | Video |  |
| LevelUp 0x02 - Back to Basics: Application Security Practices in Smart Contract Auditing | Video |  |
| LevelUp 0x02 - Hardware Hacking 101 | Video |  |
| LevelUp 0x02 - Hacking OAuth 2.0 For Fun And Profit | Video |  |
| LevelUp 0x01 - Welcome to LevelUp 2017! Intro from Sam Houston | Video | |
| LevelUp 0x01 - Casey Ellis on the State of Bug Bounties & Ask Me Anything | Video |  |
| LevelUp 0x01 - Targeting for Bug Bounty Research | Video |  |
| LevelUp 0x01 - Giving Back to the Bug Bounty Community | Video |  |
| LevelUp 0x01 - Finding Hidden Gems in Old Bug Bounty Programs | Video |  |
| LevelUp 0x01 - How to Fail at Bug Bounty Hunting | Video |  |
| LevelUp 0x01 - Esoteric sub-domain enumeration techniques | Video | |
| LevelUp 0x01 - MarkDoom: How I Hacked Every Major IDE in 2 Weeks | Video |  |
| LevelUp 0x01 - How does unicode affect our security? | Video |  |
| LevelUp 0x01 - Browser Exploitation for Fun and Profit | Video |  |
| LevelUp 0x01 - Hidden in Plain Site: Disclosing Information via Your APIs | Video |  |
| LevelUp 0x01 - Doing recon like a boss | Video |  |
| LevelUp 0x01 - Identifying & Avoiding Android app Protections | Video |  |
| LevelUp 0x01 - Hacking Internet of Things for Bug Bounties | Video |  |
| LevelUp 0x01 - Advanced Android Bug Bounty skills | Video | |
| LevelUp 0x01 - Car Hacking 101 | Video |  |
| LevelUp 0x01 - OWASP iGoat - Learning iOS App Penetration Testing & Defense | Video |  |
| LevelUp 0x01 - Do you like fuzzing? | Video |  ,  |
| LevelUp 0x01 - Reverse Engineering iOS Mobile Apps | Video | Emily Walls |
| LevelUp 0x01 - Breaking Mobile App Protection Mechanisms | Video | |
CC-BY-4.0 - Creative Commons Attribution 4.0 International