David Bombal

#558: Top 4 Web hacking demos for aspiring hackers (with labs and CTF)

Mar 16, 2026
Guest
Justin Gardner
Justin Gardner, a full-time bug bounty hunter and podcaster, walks through hands-on web-hacking demos and practical training. He demonstrates IDOR, broken client-side access controls, reflected XSS, and CSRF using only the browser. Short guidance on a 200-hour learning roadmap, labs to practice, and what it takes to start earning in bug bounty work.
Ask episode
AI Snips
Chapters
Transcript
Episode notes
INSIGHT

AI Scales Attackers But Persistence Wins

  • AI has lowered automation friction so skilled hunters can scale findings, making the landscape different but still full of opportunity.
  • Success still favours those who persist through many failures until one exploit clicks.
ADVICE

Find IDOR By Iterating IDs In URLs

  • Test for IDOR by changing object IDs in URLs or API requests and iterating numeric IDs to enumerate records.
  • Justin reports getting bounties from Google, Uber, and Meta for such simple IDOR findings.
ADVICE

Bypass Client Side Controls With DevTools Then Replay

  • Check client-side access controls by editing the DOM (e.g., remove disabled attributes) then replay the resulting request to the server.
  • Removing a disabled attribute only matters if the server actually performs the action (e.g., delete) afterward.
Get the Snipd Podcast app to discover more snips from this episode
Get the app