Complete Ethical Hacking Course 2025 - Top 90 Interesting Bugs - Ethical Hacking & Bug Bounty

Value of the Information & Strength of the Argument

The video provides practical insights into bug bounty hunting, emphasizing the importance of recon, chaining vulnerabilities, and thinking creatively. The presenter shares real-world examples that illustrate common vulnerabilities and exploitation techniques. However, the argumentation is largely anecdotal and lacks rigorous technical depth. The presenter does not provide detailed payloads, request/response examples, or remediation advice, which limits the educational value for advanced practitioners. The value lies in the breadth of vulnerability types covered and the mindset encouraged, but the lack of verifiable details and sources weakens the overall argumentation.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is low: the presenter explicitly states he does not own the reports and they may not be true, and he does not provide any links to the original bug reports or technical write-ups. The only sources cited are promotional links to his own website and social media, which are not scientific references. The title is misleading as it promises a complete course covering 90 bugs, but the video only covers about 17 bugs and is more of an overview. The content is not peer-reviewed and lacks citations, making it unreliable for academic or professional use. The presenter’s credentials are not verified, and the video appears to be a promotional tool for his training platform.

The title promises a comprehensive ethical hacking course covering 90 bugs, but the video only covers about 17 bugs and is more of an overview than a complete course.

5/10

The video is a tutorial that presents a curated list of bug bounty findings, but it lacks verifiable sources, technical depth, and rigorous methodology. The presenter explicitly disclaims ownership and verification of the reports, and the content is largely anecdotal with minimal technical detail.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 00:00Introduction and overview of the course, disclaimer about bug reports.
• 02:00Bug 1: Stored XSS to privilege escalation - chain of vulnerabilities leading to account takeover.
• 05:00Bug 2: Recon finding - exposed database credentials via subdomain and config file.
• 08:00Bug 3: Broken access control - API endpoint manipulation to access all user profiles.
• 10:00Bug 4: HTML injection leading to PII disclosure in source code.
• 12:00Bug 5: IDOR in ChatGPT remix feature - predicting media IDs.
• 15:00Bug 6: Exposed AWS API keys in JS files leading to arbitrary account creation.
• 18:00Bug 7: Chaining self-XSS with CSRF for account takeover (PortSwigger lab).
• 20:00Bug 8: Path guessing to access dashboards without authentication.
• 22:00Bug 9: Bypassing 403 with HTTP method change to access admin panel.
• 25:00Bug 10: Logical flaw in discount application leading to free items.
• 28:00Bug 11: Plaintext site ID leading to third-party account takeover (New Relic).
• 31:00Bug 12: Multiple vulnerabilities found in a single program (HTML injection, response manipulation, API.log, XSS, SQLi).
• 34:00Bug 13: Using Axiom for automated recon and vulnerability scanning.
• 37:00Bug 14: Unprotected S3 directory listing on Netflix subdomain.
• 40:00Bug 15: Git config exposure leading to source code and credentials.
• 43:00Bug 16: Support email leading to full wiki access via Atlassian instance.
• 46:00Bug 17: Bypassing 2FA by dropping OTP request.

• AllGoodTutorials — Promotional website for the presenter's training platform.
• AllGoodTutorials Newsletter — Newsletter signup page.
• AllGoodTutorials Supporters — Support page for the platform.
• AllGoodTutorials Pricing — Pricing page for premium access.
• AllGoodTutorials Videos — Video courses page.
• AllGoodTutorials Telegram — Telegram channel.
• AllGoodTutorials LinkedIn — LinkedIn company page.

• OWASP Top 10 — Lists common web vulnerabilities such as broken access control and injection, which align with the bugs discussed.
• PortSwigger Web Security Academy — Provides labs and tutorials on vulnerabilities like XSS, CSRF, and access control, which are covered in the video.

• No specific discordant sources found — The video does not cite any sources that contradict its claims, but the lack of verifiable sources makes it difficult to assess concordance.