CWE-200: INFORMATION EXPOSURE

Nmap, Shodan, Google Dorking, DNS enumeration. Before you attack, you map. Every port, every service, every version number. Reconnaissance is how the professionals find what others miss. In BountyWarz, your ship's long-range scanners replicate the same methodology used by real penetration testers.

Tools: nmap, whois, dig, traceroute, theHarvester

TCP/UDP SERVICE ENUMERATION

SYN scans, stealth scans, version detection. 65,535 ports to check, and each open one is a potential entry point. Port scanning is the foundation of network security assessment — and the first thing every bounty hunter learns.

Tools: nmap -sS, masscan, rustscan, netcat

CWE-89: SQL INJECTION

OWASP #1. Unsanitized input + database queries = total compromise. Union-based, blind, time-based, error-based — each variant exploits trust between application and database. Understanding SQLi means understanding how data flows through every web application.

Tools: sqlmap, Burp Suite, manual payloads

CWE-79: CROSS-SITE SCRIPTING

Reflected, stored, DOM-based. Inject JavaScript into pages other users trust. Steal sessions, redirect logins, deface sites. XSS is the art of making the victim's browser betray them — and it's everywhere.

Tools: XSStrike, Burp Suite, browser DevTools

CWE-287: IMPROPER AUTHENTICATION

Broken auth, session hijacking, credential stuffing, JWT manipulation. When authentication fails, the attacker IS the user. Most breaches start here — and understanding auth flaws is what separates amateurs from professionals.

Tools: Hydra, John the Ripper, Hashcat, jwt.io

CWE-269: IMPROPER PRIVILEGE MANAGEMENT

SUID binaries, kernel exploits, misconfigured sudoers, PATH hijacking. You have a shell — now get root. Privilege escalation is the post-exploitation art of turning limited access into total control.

Tools: LinPEAS, WinPEAS, GTFOBins, PowerUp

LATERAL MOVEMENT & PIVOTING

SSH tunneling, port forwarding, SOCKS proxies, pass-the-hash. Once inside one system, reach everything it connects to. Pivoting is how a single compromised machine becomes a launchpad for the entire network.

Tools: Chisel, SSH -L/-R/-D, Proxychains, Metasploit

CAPTURE THE FLAG COMPETITIONS

Jeopardy-style and attack/defense. Categories: web, crypto, forensics, pwn, reverse engineering. CTFs are how the cybersecurity community trains — and BountyWarz brings that competition into the game with real flag capture mechanics tied to each nation's territory.

Platforms: HackTheBox, TryHackMe, picoCTF, CTFtime