Boring endpoint + cross-tenant beats exotic no-impact.

0:00–0:15 API1/BOLA + API2/BFLA + excessive-data + version-gap idea

Read OWASP API Top 10 API1/API2/API8 summaries + WSTG API index headings ONLY. One line each + legacy-route hypothesis.

0:15–1:05 API labs: object-authz + version diff + method override (lab)

Do PortSwigger API testing 8 labs (BOLA, BFLA, mass-assignment, versioning) IN ORDER. Test /v1 vs /v2 same object + PUT/PATCH/DELETE swap + _method override. YT: BOLA IDOR API bug bounty.

1:05–2:00 Old-version-missing-checks + BOLA PII-leak patterns

Read 1 old-version case (/v1/transfer no victim-check vs v2) + H1 BOLA PII search (BOLA PII leak bounty) 1 report — diff + leaked fields ONLY.

2:00–2:35 Version + method + minimization map

Map versions × methods × data-minimization (list vs detail over-collection). Add array-smuggling probe (id[]=1&id[]=2, lab).

2:35–3:00 Legacy-route hypothesis test + gaps

Explain why legacy misses checks (copied code, stale middleware). Triage gaps.

0:00–0:15 Introspection / batching / depth / persisted queries

Define 4 + risk each. Read PortSwigger GraphQL topic § introspection ONLY + WSTG APIT-99 GraphQL § objectives ONLY.

0:15–1:05 __schema → per-field authz + batch/depth/N+1 (lab)

Do PortSwigger GraphQL 5 labs (introspection→admin leak + batching brute-force) + THM graphql Task 1–5 (introspection, mutations/authz, batching/IDOR, challenge) ONLY. Dump inql -t /graphql -o schema.json on lab. Test isAdmin-class field A→B.

1:05–2:00 Introspection→admin-leak + batch brute-force cases

Read 1 introspection→admin (hidden isAdmin/users field) + 1 batch [{login}]×50 brute-force — query + leaked field ONLY each.

2:00–2:35 gRPC preview (grpcurl) + persisted-query abuse note

Probe grpcurl -plaintext -d '{}' host:443 list pattern READ (lab if available) + persisted-query hash replay note. Add nuclei graphql-introspection.yaml + swagger.yaml on LAB ONLY.

2:35–3:00 Introspection-risk test + gaps

Explain why introspection on prod = schema leak. Triage gaps (WS next).

0:00–0:15 Handshake + Origin check + CSWH idea

Diagram Upgrade: websocket + Origin + Sec-WebSocket-Key → 101. Read PortSwigger WebSocket § handshake/Origin ONLY + WSTG WebSocket § objectives ONLY.

0:15–1:05 Origin + hijack PoC + injection over messages (lab)

Do PortSwigger WebSocket labs (hijack + message injection) IN ORDER. Test Origin: null/evil + session-vs-message trust (send victim-ID message as attacker). YT: WebSocket hijacking CSWSH account takeover.

1:05–2:00 WS-hijack ATO + WS SQLi/injection cases

Read 1 WS-hijack ATO (missing Origin → victim socket actions) + 1 WS SQLi/injection (message field concatenated) — handshake/message evidence ONLY each.

2:00–2:35 WS map: origin/auth/message-authz

Map endpoints × Origin policy × message trust. Note Socket.io fallback (polling → WS upgrade).

2:35–3:00 CSWH test + gaps

Explain hijack with headers. Triage gaps (NOS next).

0:00–0:15 NOS list: price/qty/coupon/plan/team/limits

List 6 + test values (-1, 0, 0.01, 999999, NaN, null). Read PortSwigger business-logic § numeric/coupon ONLY.

0:15–1:05 Price/qty + coupon/promo/plan/team abuse (lab, $0-risk)

Do PortSwigger logic labs (numeric + coupon) + THM buslogic Task 2–4 (price/coupon/workflow) ONLY. Test negative/zero/float/overflow + free→pro paths on lab with $0-risk (cancel immediately, own accounts).

1:05–2:00 Yelp free-order + price-manip cases

Read Yelp free-order/credit-abuse + 1 price-manip (0 + client-side validation bypass) — tampered field + server response ONLY each. X: BOLA PII leak bounty for invariant-check mindset.

2:00–2:35 Invariant checks: totals recomputed server-side?

Map invariants (total = price×qty − discount, plan gates, team caps). Note client-trusted fields.

2:35–3:00 NOS-example test + gaps

Narrate one end-to-end (field → response → ledger). Triage gaps (workflows next).

0:00–0:15 State map: register → pay → use → cancel → refund

Draw states + transitions. Read PortSwigger business-logic § workflow/skip ONLY.

0:15–1:05 Skip-step + terminal-state re-entry (lab)

Test direct-endpoint skip (POST step-3 without step-1/2) + terminal re-enter (use→cancel→use, refund→reuse) on lab. Log idempotency (double-click/refresh = double-charge?).

1:05–2:00 Workflow-skip upgrade + transfer-victim cases

Read 1 skip-upgrade (free→pro without pay) + 1 transfer-victim (to=victim swap) — skipped step + abused transition ONLY each.

2:00–2:35 Two-user flows: send/share/transfer recipient abuse

Test recipient swap + invite-token reuse on lab (own accounts). Note post-conditions (balance/role/ownership deltas).

2:35–3:00 State-bug test + gaps

Explain one state bug end-to-end. Triage gaps (race next).

0:00–0:15 Check-then-act windows + single-packet rationale

Write 3 windows (coupon/balance/2FA) + why parallel beats sequential. Read PortSwigger race topic § single-packet ONLY + HackTricks race § single-packet gate code ONLY.

0:15–1:05 Coupon double-spend + limit-overrun parallel bursts (lab)

Run PortSwigger race labs with Turbo engine.openGate('race1') single-packet (lab). Bursts: coupon ×10 parallel + limit-overrun ×10. Log timing table (sent/received/delta). YT: race condition single packet Turbo Intruder.

1:05–2:00 H1 2FA race-bypass + double-spend critical

Read H1 2FA race-bypass (parallel OTP gates) + 1 double-spend critical (ledger before/after) — gate + ledger ONLY each. X: race condition double spend 2FA bypass min_faves:100.

2:00–2:35 State-transition race windows (use→cancel→refund)

Map Day-5 states + mark raceable transitions. Note repeatability (3/5 wins?) + money/state impact with $1 ledger.

2:35–3:00 Single-packet-why test + gaps

Explain gate synchronization in 3 lines. Triage gaps (live SaaS next).

0:00–0:15 Coverage recall: BOLA/version/GraphQL/NOS/race

List 5 + 1 probe each. Check OWASP API Top 10 index headings ONLY.

0:15–1:05 Two-account + history sweep on SaaS VDP (gentle, $0-risk)

Sweep BOLA/version/GraphQL + NOS + race candidates (1× single-packet on own $1 data max) with Burp history on. No real-money moves, no other-tenant writes, instant cancel/refund.

1:05–2:00 SaaS logic disclosures (2, same-program if possible)

Read H1 hacktivity SaaS (BOLA/version/race) 2 — abused transition + delta ONLY. Compare your sweep gaps.

2:00–2:35 Logic playbook update + minimal state-abuse PoCs

Update playbook (BOLA/version/GraphQL/NOS/race). Archive minimal PoCs (deltas, refunded). Dup-check before drafting.

2:35–3:00 Logic-triage + no-money test + gaps to Week 11

Recite triage + money rule. Assign gaps (infra/cloud) to Week 11.