About Course
Red Teaming Course Bundle: Web, API, Android & Bug Bounty
This red teaming course bundle from TMG Security brings four of our most popular hacking courses together in one package. You learn web application pentesting, API pentesting, Android pentesting and advanced bug bounty hunting, so you can attack a target from every side. As a result, it is the best value way to build a complete offensive security skill set with TMG Academy.
- 4 courses in 1
- Web + API + Android
- Advanced bug bounty
- OWASP Top 10 based
- Online & self-paced
Web Application Penetration Testing
Description
This course introduces students to the WAPT concepts associated with Web application pentesting. We encourage you to take this course if you are a complete beginner in API bug bounty world. This course uses a custom-developed vulnerable web application pentesting to demonstrate how, web vulnerabilities can be identified and exploited. This course teaches you how to identify a variety of web vulnerabilities lies in the Server-side, Client-side.
Course Content
- Roadmap & Report Writing
- Burp suit Advance Techniques
- Practical Recon Techniques
- Practical Recon techniques (Manual + Automation)
- Subdomain Finding.
- Rate Limit Bypass.
- Authentication bypass
- CSRF
- Third party password token Leakage
- File Upload Bugs
- Parameter Tampering
- Sensitive Token in URL
- OS (Command) Injection
- DMARC and SPF
- Clickjacking
- Broken Authentication
- CORS
- WordPress pentesting
- Key Exploits
- Jira Misconfiguration
- Email, Password or delete Account Validation
- Information Disclosure
- Long password Dos attack
- Web Cache Deception Attack
- URL Redirection
- Host header Attacks
- LFI & RFI
- IDOR
- SSRF
- XSS (Blind, Stored, Reflected)
- HTML Injection
- Subdomain Takeover
- CVES +Types of exploits
- 2Fa Bypass
- Exif Metadata
- Business Logic Errors
- Google Dorks
API Penetration Testing
Requirements
Description
This course introduces students to the security concepts associated with APIs pentesting. In this courses we encourage you to take this course if you are a beginner in API pentesting security world. This course uses a custom developed vulnerable APIs pentesting to demonstrate how , API vulnerabilities can be identified and exploited. This course teaches you how to identify a variety of API vulnerabilities such as SQL Injection, XXE, Sensitive data in GET, Leaky APIs etc.
OWASP API PENTESTING
- Bola (broken object level authentication)
- Injection attack
- Improper assets management
- Security misconfiguration
- Mass assignment
- Broken function level authorization
- Excessive data exposure
- Broken user authentication
- API rate limiting
API-PENTESTING using postman tool
- Introduction $ installation
- Postman authentication
- Postman navigation
- OAUTH 2.0 authentication in postman
API PROJECT TESTING
- Access admin api/ access admin panel
- Brute-force apis to find new endpoints
- Make an account / loging to account
- Restore / delete everything
- Edit someone’s grade
- Transport layer security
- Blind xss in the admin control panel
- User enumeration
- Information exposure via server headers
- Authentication bypass
- Input validation attacks
- Sql injection
- Error handling
- Encryption
- Ssrf
- Bola
- Command injection
Android Pentesting TRAINING
Requirements:
-
The course starts from basics, however, it is good to have basic knowledge of web applications & API pen-testing.
Topics:
- Introduction to Android Architecture
- Concept of Android Terminologies
- Android Signing Process
- Android Pentesting Setup
- Static Analysis
- Dynamic Analysis
- SSL Pinning Bypass
- OWASP Mobile TOP 10
Android Pentesting Setup
Introduction to Android Pentesting:
- Pentesting Process / Stages
- How android Pentesting works
Introduction to Android Architecture
- Android Security Architecture
- Role of Services, Activities, Permissions, etc…
- Application Security and Signing Process
Android Pentesting Setup
We will see How you can set up an Android Pentesting Lab with so many tools and their alternatives
Android Static Analysis
- Pull APK From Play Store
- How to find Hardcoded Strings
- How to find sensitive information (API-Keys, Credentials etc..)
- How to enumerate Firebase Databases
- Android Backup Exploit
- Task Hijacking
- How to Exploit Activities, Services, Providers & Broadcast Receivers.
- Insecure Platform Usage
- Insecure Data Storage
- Improper Transport Usage (Logcat)
- Automated Static Analysis MobSF
Android Dynamic Analysis
- What is SSL Pinning
- How to Bypass SSL Pinning Through various ways
- Dynamic Analysis using MobSF
- Introduction to Burp Suite / Installation
- Introduction about Frida / Objection
- Vulnerability Testing
Android Bug Bounty Hunting
- Live Android App Hunting
ADVANCED BUG BOUNTY HUNTING V1.0
Description
This course introduces students to the Advance Bug bounty concepts associated with Web application pentesting. We encourage you to take this course if you are a complete beginner in Advance Web bug bounty world. This course uses a custom-developed vulnerable web application pentesting to demonstrate how, web vulnerabilities can be identified and exploited. This course teaches you how to identify a variety of Advance web vulnerabilities lies in the Server-side, Client-side.
Course Content
- Testing Chrome extensions (Manual and automatic approach)
Static Testing
Dynamic Testing - Deep Down with JWT(Json Web Tokens)
- Testing Oauth Misconfigurations (Account Takeovers and more…)
- CORS bypasses
- CSRF bypasses
- Stored/Reflected Cross Site Scripting (Account Takeovers and other impacts)
Generic
Bypasses
Sandbox
Link Embed - Indirect Object References (Generic approach)
- Sensitive Data exposure
- Source code (Js analysis)
Shodan
GitHub
Other third parties resources - Webhooks/apis
- LocalStorage
- Enhancing Power of recon
- Some Client Side bypasses
- Advanced Business logic
- Different type of Race Conditions
- File uploads
- Some high CVEs vulnerability(Grafana(LFI),WordPress(XSS))
- Chaining vulnerabilities
- IDOR and cross site scripting
- Cross site scripting (with very low impact ) and oauth misconfiguration to account takeover
- Low Impact HTML injection to increasing more impact
- Cross Site Scripting with HTTP only cookie set to true(Methods to find bypasses)
- Cross Site Scripting in sandbox environment
- Link embed to Stored Cross Site Scripting stealing user user sessions
- Cross Site Scripting to Account Takeover with LocalStorage
- Shodan backup found api key and then full org takeover
- Some interesting findings with wayback URLs (CVE bases cross site scripting, IDOR chaining to massive user enumeration, support/client/third parties leaks)
- Master OTP to Massive Account Takeovers
Note: Mostly all the mentioned content will be taught live and with poc findings recording.
Benefits :
- Get ISO Certified Certification
- Get WAPT ( ID CARD )
- Live Targets to hunt
(Sample)
Point To Be Noted :
It takes minimum 3 months to get hard copy of ID CARD
What you get in this red teaming course bundle
Web Application Pentesting
First, master recon, authentication bypass, IDOR, file upload bugs, injection flaws and report writing. View the WAPT course.
API Pentesting
Next, test REST APIs with Postman, find hidden endpoints and exploit broken authorization from the OWASP API Security Top 10.
Android Pentesting
Then, set up a mobile lab, run static and dynamic analysis, bypass SSL pinning and hunt Android bugs.
Advanced Bug Bounty Hunting
Finally, combine everything to find higher-impact bugs on live programs. Bug bounty is our USP, so this part is built for real payouts.
Who should take this red teaming course?
- Aspiring penetration testers who want web, API and mobile skills in one place.
- Bug bounty hunters who want to widen their scope beyond websites.
- Students and freshers who want a job-ready offensive security portfolio.
- Developers and IT teams who want to think like an attacker.
Want to study one topic at a time instead? Browse all TMG Security cybersecurity courses, or book one-to-one red team training with a live trainer.
Red teaming course FAQ
What is included in the Red Teaming Bundle?
The bundle includes four courses: Web Application Penetration Testing, API Penetration Testing, Android Pentesting and Advanced Bug Bounty Hunting V1.0.
Is this red teaming course good for beginners?
Absolutely. Each course starts with the fundamentals, so beginners can follow along before moving to advanced attacks.
Why buy the bundle instead of single courses?
The bundle costs less than buying the four courses separately. In addition, it gives you one clear path from web hacking to mobile and bug bounty.
Will this course help me with bug bounty programs?
It will. Every module focuses on real vulnerabilities that bug bounty programs reward, and the bundle ends with advanced bug bounty hunting.
Is the red teaming course online and self-paced?
Yes. The red teaming course is fully online, so you can learn at your own pace on any device from your TMG Academy dashboard.
Course Content
WAPT (Web Application Penetration Testing)
-
Access Resources
00:00 -
Join WAPT Community
00:00
