Become unshakeable: HTTP, Burp, scope, notes.

0:00–0:20 Deep recall: HTTP request/response + methods + status codes cold

Draw from memory: METHOD path HTTP/1.1 + Host + headers + blank line + body, methods GET/POST/PUT/PATCH/DELETE/OPTIONS, codes 200/301/302/400/401/403/404/405/429/500. Then read MDN HTTP Messages § HTTP Requests ONLY (stop before Responses) + MDN Methods GET/POST/PUT/DELETE rows ONLY + THM webapplicationbasics Task 3–6 (URL, req/resp, methods, codes, headers) ONLY. Fix your drawing, log gaps.

0:20–1:10 Burp install → CA isolated → intercept login → Repeater + Comparer (lab)

Do Burp docs Step 2 Intercepting HTTP traffic Steps 1–3 ONLY + Step 3 Modifying (Forward/Drop/on-off) ONLY + Step 5 Reissuing (Send to Repeater, edit, resend) ONLY + CA cert http://burp/cert in a FRESH test profile ONLY (never main). Then THM burpsuitebasics Task 4–8 (Proxy + FoxyProxy + CA + Intercept + Target) ONLY + THM burpsuiterepeater Task 3–6 (send Ctrl+R, Views Render/Hex, Inspector, practical) ONLY. Intercept a lab login, change one param, compare responses.

1:10–2:00 Mapping-before-payloads + scope discipline + target selection

Read TBHM 03_Mapping.md FULL (mapping only) + TBHM 02_Discovery.md passive bullets ONLY + HuntBook Phase 0 Scope section ONLY (in/out-of-scope, rate rules). Watch YouTube search Jason Haddix The Bug Hunter's Methodology v4 Recon Edition — Mapping section ONLY, stop at fuzzing. Then HackerOne directory → 1 VDP → copy Scope tab VERBATIM + filter hacktivity scope out of scope duplicate → 1 N/A report, note the exact policy line violated.

2:00–2:35 Notes rig + accounts + extensions (HUNT) + gap log

Create scope.md (program/in/out/rate/contacts) + notes/ + gap-log.md. Create A/B accounts in 2 separate profiles. Install Bugcrowd HUNT README param lists ONLY + use as passive highlighter during mapping. Watch YT InsiderPhD Note-Taking for Bug Bounty Hunters Notion + Why do Bug Bounty hunters love Obsidian InsiderPhD — template structure ONLY. Tick WSTG checklist INFO rows ONLY.

2:35–3:00 OOB proof + idempotency test + Day-1 gaps triage

Recite safe/idempotent cold. Read Burp Collaborator Getting Started — Generate + Poll ONLY + interactsh README — interactsh-client -o out.txt ONLY. Confirm 1 ping to Collaborator/interactsh. Triage gap-log: each gap gets fix-day assigned.

0:00–0:20 DNS + TLS deep recall (records, certs, headers)

Write A/AAAA/CNAME/MX/TXT/NS/SOA + recursive vs authoritative + TTL. Then Cloudflare record types A/CNAME/MX/TXT rows ONLY + THM dnsindetail Task 2–5 (types, TTL, dig) ONLY + THM passiverecon Task 2–4 (whois, nslookup, dig MX/TXT) ONLY. List TLS log fields: issuer, SAN/CN, Server, X-Powered-By.

0:20–1:10 Passive enum: crt.sh + subfinder/amass/assetfinder → sort -u (VDP)

Run crt.sh %.target.com export CSV ONLY + subfinder -d target -silent passive ONLY + amass enum -passive -d target + assetfinder --subs-only target (one each, no brute) + THM subdomainenumeration Task 1–6 (brute/OSINT/VHost, crt.sh, Google site:, dnsrecon, sublist3r, ffuf Host FUZZ) — READ ONLY, do passive steps on VDP. sort -u → recon/passive.txt. Headers via Burp history only.

1:10–2:00 Takeover fingerprints + program selection (3 + 1)

Study Can-I-Take-Over-XYZ Heroku + S3 + GitHub Pages fingerprints ONLY + H1 #665398 + #953719 (read PoC: CNAME + unclaimed proof) ONLY + NahamSec Resources program-selection section ONLY + InsiderPhD Choosing Your Target video. Score your VDP: scope width, freshness, response time, dup rate.

2:00–2:35 ASN + acquisitions + target-profile.md + WAF/stack log

Do HackTricks External Recon § ASN/WHOIS/acquisitions ONLY (stop at brute) + THM redteamrecon Task 2–4 (WHOIS/DNS/footprinting) ONLY. Fill target-profile.md (company/scope/ASN/tech/industry/acquisitions). Log wafw00f https://target + whatweb -a 3 + httpx -td (one host, gentle). Check Wikipedia/Crunchbase acquisitions.

2:35–3:00 Lock VDP + explain passive-before-brute + gaps

Justify VDP in 3 lines via WSTG INFO index headings ONLY. State passive-before-brute rule + rate-limit respect. Triage gaps into gap-log.

0:00–0:20 Cookie flags + session types + SOP vs CORS deep

Write, then verify MDN Set-Cookie Attributes (HttpOnly/Secure/SameSite/Path/Expires) ONLY + PortSwigger CORS § SOP def + CORS headers (Origin/ACAO/ACAC) ONLY + OWASP Same-Origin Policy def + relaxation matrix ONLY + THM walkinganapplication Task 2–6 (Explore, View-Source, Inspector, Debugger, Network) ONLY. Distinguish cookie token vs JWT vs localStorage.

0:20–1:10 Flag table + u7test123 reflection trace + DevTools mastery (no payloads)

On 2 sites log HttpOnly/Secure/SameSite per cookie. Inject u7test123 into search/profile, trace in DevTools (Elements/Network/Storage) where it lands: HTML / attribute / JS / URL — tracking ONLY, zero payloads. Do THM introwebapplicationsecurity (OWASP map) READ + THM owaspjuiceshop Task 3–7 (Injection, Broken Auth, Data Exposure, Access Control, XSS) — map ONLY, exploit later. Note logout/expiry.

1:10–2:00 Stored-XSS → admin view: sinks, not payloads (H1 patterns)

Read H1 payloads repo — 1 stored case, extract input → display → viewer privilege ONLY + H1 #380410 Pornhub gallery-delete (photo_id swap) + H1 #858662 Starbucks card balance (CardNumber swap) — mapping lesson ONLY + NahamSec Resources XSS methodology section ONLY. For each: what field, where shown, who views it.

2:00–2:35 SOP one-pager + JS bundle inventory + LinkFinder preview

Write SOP/CORS one-pager (triple + 2 relaxations + credential rule). Manually list JS URLs from 1 page (Sources tab, no scanner). Preview LinkFinder README usage (-i app.js -o cli) ONLY — do not run bulk today + WSTG Client-side index headings ONLY.

2:35–3:00 HttpOnly test + evidence + gaps

Answer: what HttpOnly stops vs does NOT stop + SameSite bypass idea in one line. Archive trace + table (URL+timestamp, redact cookies). Triage gaps.

0:00–0:20 Linux pipes + regex + requests vs httpx vs naabu roles

Drill | grep/cut/sort -u/awk/xargs/tee + regex .* ^$ []{} () | FUZZ on your passive.txt. Read httpx README basic flags ONLY + naabu README port flags ONLY + nmap -sV -sC -p80,443 pattern (no live run). State: requests=glue, httpx=HTTP probe, naabu/nmap=ports.

0:20–1:10 requests script + httpx JSONL + ffuf filtered (lab ONLY)

Write 20-line requests Quickstart (Make a Request + Passing Parameters ONLY): Session + headers/cookies/proxies/timeout. Run httpx -sc -title -td -json -o live.jsonl on Day-2 list. Run ONE ffuf on Juice Shop: -u /FUZZ -w common.txt -mc 200 -fc 404 per THM ffuf Task 2–4 (basics + filters) ONLY + Task 5 param FUZZ preview (no live). Use SecLists Discovery/Web-Content/common.txt + raft-medium + Discovery/DNS/namelist.txt paths ONLY.

1:10–2:00 NOS mindset + playbook gaps + katana/gau preview

Read PATT Business Logic README + 1 numeric case ONLY + AnukarOP index — mark top-5 gaps ONLY + katana README (-u -d 3 -jc -xhr) + gau README (--subs) flag rows ONLY (no bulk run). Note “every No = maybe-bug”.

2:00–2:35 Versions log + shallow clones + BBOT/testssl/wafw00f/whatweb preview

Log httpx/naabu/ffuf/katana -version + BBOT README (-t -p subdomain-enum) + testssl (--fast) + wafw00f + whatweb (-a 3) usage lines ONLY. Clone SecLists + PATT depth-1 ONLY. Start host|product|version|source inventory (CVE workflow for later).

2:35–3:00 Filter discipline test + gaps

Explain httpx vs naabu + why -fc 404 -fs N -ac matters with your ffuf line. Triage gaps.

0:00–0:20 Model cold: BOLA vs BFLA vs mass assignment

Sketch features × objects × trust (anon/A/B/admin). Read TBHM README Mapping bullets ONLY + PortSwigger Access Control § horizontal/vertical + BOLA/BFLA defs ONLY + H1 #2633771 (GraphQL AddTagToAssets gid brute-force) summary — note per-field, not per-query ONLY.

0:20–1:10 Endpoint × method × auth table + object map (VDP, gentle)

Crawl 1 VDP app (manual + sitemap). Build table per WSTG INFO index § Attack Surface headings ONLY + katana -u -d 3 -jc -xhr -silent on 1–2 pages ONLY + THM walkinganapplication T2–6 revisit for View-Source/Inspector/Network discipline. Log every ID/UUID/slug (URL/body/cookie/GraphQL) + httpx -td stack.

1:10–2:00 Two IDORs, two key types (numeric vs encoded/UUID)

Read PATT IDOR 1 numeric case ONLY + H1 #2586584 (numeric UpdateProfile ID → email leak) + H1 #2633771 (base64 gid brute-force) — key-swap steps ONLY + pentester.land Tags:IDOR → 1 UUID case, note predictability analysis ONLY. Extract 123→124 vs decode-then-enumerate.

2:00–2:35 Tech → bug-class routing (7 stacks) + Ebb & Flow preview

From headers/cookies/errors/JS, route per HackTricks web fingerprint table ONLY: PHP→SQLi/LFI/upload, Node→pollution/SSTI/JWT-none, Python→Jinja SSTI/debug, Java→SpEL/deser/actuator, Ruby→mass-assign/redirect, Go→auth/SSRF/JWT, .NET→ViewState/IIS-tilde. Read HuntBook Ebb & Flow summary (3–5 vectors → test briefly → back to recon) ONLY.

2:35–3:00 Horizontal vs vertical cold + archive

Recite with examples (A→B profile vs user→admin). Archive table + map + routing.

0:00–0:20 Attack types math + OOB-mandatory cases

Memorize via Burp Intruder attack-types rows ONLY (Sniper 1 set, BatteringRam same, Pitchfork ≤20 parallel, ClusterBomb product) + THM burpsuiteintruder Attacks section (300 = 3×100 Sniper, 6000 = 100×2×30 ClusterBomb) ONLY. List OOB-mandatory: blind SQLi / blind SSRF / second-order / stored-admin.

0:20–1:10 Sniper lab + Collaborator UA/Referer + grep-match + throttle

Do THM burpsuiteintruder Practical (usernames+passwords, sort by length/status) ONLY, throttled, lab ONLY + Burp Intruder Getting Started § positions ONLY. Inject Collaborator into UA + Referer, poll. Set grep-match + throttle. Preview THM burpsuiteom Decoder/Comparer/Sequencer tasks ONLY for evidence support.

1:10–2:00 Blind-SSRF proof shape + desync vocab + Slack H1 preview

Read PortSwigger SSRF § Blind + hidden surface ONLY + Smuggler docs probes list ONLY (no exploit) + H1 #386292 (Slack SSRF) + #61312 + #207170 summaries — note Event-Subscription URL as sink + parser bypass idea ONLY. Skim H1 #2567048 Smule SendGrid CNAME thread for claim-vs-dispute lesson.

2:00–2:35 Rate-limit + evidence hygiene + exploit-server flow

Read PATT Rate Limit headers table ONLY (X-Forwarded-For etc.) + rehearse PortSwigger exploit-server victim flow (lab) ONLY. Rule: 429 = stop + backoff; every proof = request + response + transcript triple, cookies/PII redacted. Preview InsiderPhD hackerone-reports mirror structure for report shape.

2:35–3:00 OOB-mandatory recite + archive + gaps

Recite 4 cases + Sniper vs ClusterBomb math. Archive OOB shot + Sniper log (redacted). Triage gaps.

0:00–0:20 Weakest-2 re-quiz + WSTG INFO ≥80% + gap triage

Re-answer 2 weakest self-tests cold (e.g. idempotency, SOP vs CORS, Sniper math). Tick WSTG checklist INFO rows ONLY → ≥80%. Every remaining gap in gap-log gets owner-day (W02D1 etc.). CUT anything below INFO this week.

0:20–1:20 Passive-only VDP: crt.sh + subfinder + dnsx + httpx → diff (zero active)

PASSIVE ONLY, VDP scope ONLY: crt.sh export + subfinder -all -silent → dnsx -a -resp -silent basic flags ONLY → httpx -sc -title -td -cl -silent ONLY. Diff vs Day-2 passive.txt → recon/day7/diff.txt (added/removed = W02 priority). No naabu/nmap/ffuf bulk, no OOS, no CVE exploit. Reference THM passiverecon + redteamrecon discipline (passive sections) ONLY.

1:20–2:20 Calibrate vs 1 recon writeup + H1 same-program search

Read pentester.land 1 recon-methodology writeup — pipeline stages vs yours ONLY (+ bugpedia mirror if paywalled). Then H1 hacktivity search your VDP family (type:hacktivity takeover/recon/IDOR) — 2 reports, extract recon source + mapping step ONLY. Log 1 thing they did you missed (ASN, alt-TLD, JS, Shodan, GitHub).

2:20–2:45 base-checklist.md + scope re-verify + evidence pack

Write base-checklist.md: scope→proxy→history→Collaborator→A/B→passive→dnsx→httpx→katana-ready→diff→gaps. Re-verify scope.md against live program page (policies change). Pack evidence: history + scope shot + OOB shot + tables (redacted). Reference HackTricks recon summary + TBHM recon bullets ONLY.

2:45–3:00 Pipeline recite + Week-02 ready + gaps assigned

Aloud: scope → passive → resolve → rank → katana → JS → diff → gaps. Confirm scope.md, notes/, gap-log.md, recon/, base-checklist.md exist. Assign every open gap to a Week-02 day. Submit nothing.