130 Days Bug Hunting Learning Challenge | Week - 02
Browser, Burp, Mapping and Content Discovery
DAY - 006
Cookies, sessions, local storage, and authentication state
1) Study — 60 Minutes
PortSwigger Authentication Overview — 35 Minutes: Session handling and authentication mechanisms.
TryHackMe Web Application Basics — 25 Minutes: Request/Response headers and cookies.
2) Same Topic Lab Set — 90 Minutes
Core — Must be completed today
Observe pre-login vs post-login cookies in a PortSwigger lab.
https://portswigger.net/web-security/authentication
Login before and after cookies.
Identify what changed.
Replay a logged-in request after logout in a training lab.
https://portswigger.net/web-security/authentication
Login.
Capture an authenticated request.
Logout.
Replay the same request and observe the response.
Solve Rule:
25 minutes self-attempt → Theory revisit → Lab hint (if required) → Solution → Lab reset → Solve again.
3) Your Own Notes & Research — 30 Minutes
Write down 5 things you learned today and 1 most important mistake.
Annotate one representative request/response; do not keep sensitive lab credentials or tokens in your notes.
Write the purpose and limitations of Secure, HttpOnly, SameSite, Domain, Path, and Max-Age attributes.
Finally, write:
“What three questions will I ask in my next real authorized test?”
DAY - 007
Burp Proxy, HTTP History, Repeater & Decoder
STUDY — 60 MINUTES
1. PortSwigger Getting Started Videos
Learn Burp Proxy, HTTP History and Repeater interface.
🔗 https://portswigger.net/web-security/getting-started
2. Burp Suite Community Edition Documentation
Learn project setup and browser configuration.
🔗 https://portswigger.net/burp/documentation/desktop/getting-started
PRACTICE — 90 MINUTES
Core — Complete Today
• Intercept, edit and forward at least 3 HTTP requests using Burp Proxy. (Use Any Lab or Website)
• Send the same requests to Repeater and compare the responses.(Use Any Lab or Website)
• Decode and re-encode URL and Base64 values using Burp Decoder.
🔗 https://portswigger.net/burp/documentation/desktop/tools/decoder
Solve Rule:
25-minute self-attempt → Revisit theory → Use a hint → View the solution if necessary → Reset and solve again
NOTE + RESEARCH — 30 MINUTES
• Write 5 things you learned today
• Write 1 important mistake or problem you faced
• Note one HTTP Request/Response or an important concept
• Create a short checklist or research summary about today’s topic
DAY COMPLETE WHEN
Study Completed + Core Practice Completed + Progress Saved + 30-Minute Notes Completed
DAY - 008
Topic: Content Discovery (Manual, OSINT & Wordlist-Based)
STUDY — 60 MINUTES
1. TryHackMe Content Discovery — Tasks 1–5
Learn manual content discovery, robots.txt, sitemap.xml, OSINT techniques, and basic discovery methods.
🔗 https://tryhackme.com/room/contentdiscoveryx
PRACTICE — 90 MINUTES
Core — Complete Today
• Complete the Manual & OSINT tasks in the THM Content Discovery room.
🔗 https://tryhackme.com/room/contentdiscoveryx
• Complete the Directory Discovery task in the same room.
🔗 https://tryhackme.com/room/contentdiscoveryx
• Find hidden content in OWASP Juice Shop without scanning outside the lab.
🔗 https://demo.owasp-juice.shop/
Solve Rule:
25-minute self-attempt → Revisit theory → Use a hint → View the solution if necessary → Reset and solve again
NOTE + RESEARCH — 30 MINUTES
• Write 5 things you learned today
• Write 1 important mistake or problem you faced
• Note one HTTP Request/Response or an important concept
• Create a short checklist or research summary about today’s topic
DAY 010
Topic: Content Discovery Continuation & Weekly Mapping Assessment
STUDY — 60 MINUTES
1. TryHackMe Content Discovery — Complete the remaining tasks.
🔗 https://tryhackme.com/room/contentdiscoveryx
2. PortSwigger Web Security Academy — Information Disclosure Overview
Learn about hidden files, backup files, debug information, and information disclosure.
🔗 https://portswigger.net/web-security/information-disclosure
PRACTICE — 90 MINUTES
Core — Complete Today
• Complete the remaining tasks in the TryHackMe Content Discovery room.
🔗 https://tryhackme.com/room/contentdiscoveryx
• Solve the Source Code Disclosure via Backup Files lab.
🔗 https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-via-backup-files
• Solve the Information Disclosure on Debug Page lab.
🔗 https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-on-debug-page
Solve Rule:
25-minute self-attempt → Revisit theory → Use a hint → View the solution if necessary → Reset and solve again
NOTE + RESEARCH — 30 MINUTES
• Write 5 things you learned today
• Write 1 important mistake or problem you faced
• Note one HTTP Request/Response or an important concept
• Create a short checklist or research summary about today’s topic
Day 009 is missing