Quiz: Module 4 Practical Assignment: The Junior Bug Hunter’s First Report Assignment Overview In the cybersecurity industry, no one cares about what you know; they care about what you can prove. Finding a vulnerability is only half the job; if you cannot clearly document it and communicate the risk, you will not get paid, and you will not pass professional certifications. This assignment bridges the gap between theory and real-world application. You will use your Kali Linux lab, your knowledge of the OWASP Top 10, and your new Burp Suite skills to hunt for a flaw on a legally safe practice site. You will then compile your findings into a professional Bug Bounty Report. Objective Demonstrate the ability to configure and use Burp Suite’s Intercept and Repeater features. Successfully identify a web application vulnerability (specifically Broken Access Control / IDOR or Information Disclosure). Write a flawless, professional vulnerability report using the industry-standard template. ⚠️ Critical Rule DO NOT test any website that is not explicitly listed in the instructions below. Only use the provided practice URLs. Testing unauthorized sites is illegal and will result in immediate failure of this course module. The Target Environment For this assignment, you will be targeting the Acunetix Test PHP Site. This is a deliberately vulnerable website hosted by a legitimate security company specifically for professionals to practice on. Target URL: http://testphp.vulnweb.com Part 1: Technical Execution & Evidence Gathering (40 Points) You must complete the following technical steps and capture visual/textual evidence of your work. You will paste this evidence into your final submission document. Task 1: The Intercept Ensure Burp Suite is running and your Firefox browser is properly configured with the proxy (Port 8080) and the CA Certificate installed (as taught in Lesson 4.2). Navigate to the target site’s login page: http://testphp.vulnweb.com/login.php Turn on Burp Intercept. Enter any random username and password (e.g., test/test) and click Login. Deliverable 1: Copy and paste the raw HTTP POST request that Burp intercepted into your assignment document. (Highlight the exact line that contains the username and password you typed). Task 2: The Hunt & The Repeater Turn OFF Burp Intercept (let traffic flow normally). Browse the website. Look for pages that display information based on a number or ID in the URL (e.g., ?id=1, ?pid=2). Hint: Look at the product pages or the “View Details” links. Once you find a URL with a numeric parameter, right-click the request in Burp’s HTTP History (or intercept it) and send it to Repeater. Deliverable 2: Take a clear screenshot of the Burp Suite Repeater tab showing your original captured request on the left, and the normal server response on the right. Task 3: The Exploitation Still in the Repeater tab, manipulate the numeric parameter in the URL. Change it from 1 to 2, then 3, etc. Find an instance where changing the number reveals information that should likely belong to a different user or a different context (e.g., seeing a different user’s order details, viewing a different product that you weren’t supposed to access via that specific navigation flow, or viewing comments meant for a different page). Deliverable 3: Copy and paste the raw HTTP Response from Burp Repeater that proves you successfully accessed the unauthorized/alternative data. Highlight the specific text in the response payload that proves the access. Part 2: The Professional Deliverable (50 Points) Now that you have found the flaw and gathered the raw data, you must write the report as if you were submitting it to HackerOne for a $500 bounty. Create a section in your assignment document titled “Vulnerability Report” and format it exactly as follows using the template from Lesson 4.3: Vulnerability Title: [Fill in a professional title, e.g., “Insecure Direct Object Reference (IDOR) in product details allows viewing of unauthorized items”] Severity: [Low / Medium / High / Critical] – Defend your choice based on the data you saw. Description: [2-3 sentences explaining what the flaw is and why it happened (hint: the application trusts the user-supplied ID without verifying authorization).] Steps to Reproduce: [Write a numbered, 1-2-3 list of exact instructions. Include the exact starting URL, the exact parameter you changed in Burp Repeater, and what you changed it to.] Proof of Concept (PoC): [Reference the screenshots and raw text you gathered in Part 1. Explicitly state “See Task 2 Screenshot” and “See Task 3 Raw Response”.] Impact: [Explain the business impact. If this were an e-commerce site, what could an attacker do with this flaw?] Part 3: Conceptual Application (10 Points) The OWASP Mapping Review the OWASP Top 10 list provided in Lesson 4.1. State exactly which ONE of the OWASP Top 10 categories the vulnerability you found in Part 2 falls under. Write a short paragraph (3-4 sentences) explaining why it fits into that specific category. Submission Checklist (Before you submit, ensure you have:) Raw HTTP POST request from the login intercept. Screenshot of Burp Repeater showing the original request/response. Raw HTTP Response showing the manipulated data access. A fully completed, professionally formatted Vulnerability Report. Correct OWASP Top 10 classification with justification. Zero mention of testing any live, unauthorized websites. Instructor Evaluation Rubric (How you will be graded) Technical Accuracy (40%): Did the student successfully intercept traffic? Did they successfully use Repeater to manipulate a parameter? Is the raw HTTP data accurate? Report Quality (40%): Is the report free of spelling/grammar errors? Is the tone professional and objective? Are the Steps to Reproduce perfectly clear and easy to follow without guessing? Did they accurately describe the Impact? Conceptual Understanding (10%): Did they correctly map the bug to the proper OWASP Top 10 category with a sound logical justification? Rule Adherence (10%): Did the student follow all instructions and safety rules? (Any submission showing traffic intercepted from a real-world, out-of-scope site will receive an automatic zero). Note for LMS Admin: You can set this up as a “File Upload” or “Text Entry” assignment in your LMS, allowing students to paste text and upload their Burp Suite screenshots as a PDF or Word Doc. - The Acinge Network
Skip to content
