BOOTCAMP
Bug Bounty Bootcamp. From zero to hunter.
20 live online sessions that take you from the fundamentals to advanced exploitation: web, API, mobile and AI-assisted hunting. Taught by active bug hunters, with real-case labs and every report reviewed by a mentor.
- Starts 16 November 2026
- 20 live online sessions
- 700+ page ebook and certificate
20 sessions, four phases: from zero to your first valid report.
- Phase 01 · Sessions 01-02Beginner
Foundation
Read a target the way a hunter does: auth flows, the browser security model, recon and attack surface.
- 01Auth & Browser Security Concepts (JWT, OAuth, CORS, CSP)
- 02Recon, Attack Surface Mapping & Information Disclosure
- Phase 02 · Sessions 03-10Intermediate
Web Exploitation
The core bug classes of real programmes: auth, access control, XSS, injection and SSRF.
- 03Broken Authentication & Session Management
- 04IDOR, BOLA & Broken Access Control
- 05XSS, HTML Injection & CSP Bypass
- 06CSRF, Clickjacking & Open Redirect
- 07SQL Injection: Manual & Automated
- 08NoSQL & Advanced Injection
- 09File Upload, Path Traversal & LFI/RFI
- 10SSRF: Server-Side Request Forgery
- Phase 03 · Sessions 11-16Advanced
Advanced Exploitation
Chain small flaws into high-severity findings: logic bugs, SSTI, race conditions and request smuggling.
- 11XXE & OS Command Injection
- 12Business Logic & Impact Bugs
- 13SSTI, Deserialization & Prototype Pollution
- 14Race Conditions & Concurrency Bugs
- 15Rate-Limit Bypass & Resource Abuse
- 16HTTP Request Smuggling & Cache Attacks
- Phase 04 · Sessions 17-20Intermediate-Advanced
API, Mobile & AI
OAuth and WebSocket, REST and GraphQL, mobile APIs and AI-assisted hunting.
- 17Exploiting OAuth, JWT, CORS, WebSocket & DOM
- 18API Security (REST & GraphQL)
- 19Mobile App Bug Bounty & API Interception
- 20AI-Assisted Bug Hunting & Automation
Batch 01 - November 2026
20 live online sessions, from zero to advanced. Includes a 700+ page ebook and a certificate.
Not a CTF, not a flag hunt. Find the bug, write the report.
- 20live online sessions with mentors who still hunt
- 20+real-case lab machines, mapped by bug type and level
- 700+pages in The Hunter's Handbook, an ebook for participants only and yours to keep
EVERY SESSION
Live demo
A mentor exploits a target live.
Hands-on lab
You reproduce it in a legal, isolated lab.
Report writeup
A mentor reviews your report the way a programme's triage would.
You leave with a report from every lab for your portfolio, and a certificate.
Learn from people who still hunt. Active bug hunters and red team operators.
- Lead instructor
Septio Noerdiansyah
Bug hunter
- Instructor
Muhammad Wishal
Web bug hunter
34+ Hall of Fame entries and bounties
- Instructor
Anjar Wilujeng
API & mobile hunter
3+ years in red teaming · HTB CPTS
- Instructor
Ahmad Ferdiansyah
Bug hunter
- Instructor
Jason Suryoatmojo
Web & infra hunter
47 findings, 2 critical
Batch 01 fees. One cohort, limited seats.
Early bird · until 09 November 2026
IDR 2,000,000
About IDR 100,000 a session, 56% off the regular fee.
Regular fee · Batch 01
IDR 4,500,000
About IDR 225,000 a session.
- Format
- 20 live sessions · online
- Includes
- 700+ page ebook · certificate
- Seats
- Limited · one cohort
KEY DATES
- NowEnrolment open
- 09 Nov 2026Early bird closes
- 16 Nov 2026Batch 01 begins
No degree, no location limit. Anyone can start from zero.
Working professionals
A valuable side skill and a route into security: learn in the evenings, hunt at weekends.
Students & career starters
A portfolio recruiters notice: valid reports and a certificate, without waiting for a first job.
COMMON QUESTIONS
- No background yet?
- Sessions 01-02 start from the fundamentals. If you can use a browser and a terminal, that is enough.
- Already in IT, or a developer?
- You can move through the basics quickly and focus on advanced exploitation.
- Worried about the legal side?
- Every lab is isolated and in scope. Responsible disclosure is taught from day one.
BATCH 01 ENROLMENT
Enrol now. Seats are limited.
The IDR 2,000,000 early bird fee runs until 09 November 2026. Batch 01 begins online on 16 November 2026.