What you'll learn
Skills you'll walk away with.
- Map an organization's full external attack surface through ASN, WHOIS, and acquisition recon
- Enumerate subdomains with scraping, brute force, permutation, and linked discovery
- Hunt subdomain takeovers, exposed S3 buckets, and leaked config files
- Profile application tech stacks and prioritize the highest-value targets
- Automate CVE and dynamic scanning so manual effort lands where it counts
- Drive content discovery across walking, fuzzing, historical, and JavaScript sources
- Analyze raw, minified, and obfuscated JavaScript for hidden endpoints and secrets
- Heat-map applications to upload, integration, and error-handling weak points
- Exploit XSS, IDOR, SSRF, XXE, and SQL injection with practical tips and tooling
- Weaponize file upload flaws through common filter and validation bypasses
- Bypass CDN, server, and code-level security controls
- Identify and exploit dependency confusion in build pipelines
What your employer gets
- A tester who runs a repeatable, data-driven methodology across large-scope engagements
- Internal recon and vulnerability-hunting capability that reduces reliance on external testing spend
- Coverage across modern web vulnerability classes: XSS, IDOR, SSRF, XXE, SQLi, and more
- Reusable methodology, tooling configs, and retained source material the team can adopt
- Ongoing access to a practitioner community for hunts, recon data, and fresh resources
Overview
Not an A–Z course. Expert tips, time-saving tricks.
Unlike other courses, TBHM is not an A–Z or beginner-oriented course. True to the spirit of Jason's public TBHM talks, the emphasis is on expert tips, time-saving tricks, practical Q&As, automation strategies, vetted resources, and engagement with a dedicated community on Discord. Each module uses real-time targets where possible, and you keep access to all source material to refer back to after the training.
What TBHM Is
// the pitch
- A masterclass for web app testers, red teamers, and bounty hunters
- The latest tools, techniques, and strategies in the wild today
- A data-driven methodology on how and where to search for vulns
- Real-time targets used in modules where possible
- All source material retained for reference after training
- An active, supportive Discord community for ongoing support
Attendees Should Have
// setup
- Burp Suite (PRO preferably)
- A VM or equivalent access to a *nix command line
- A full list of tools needed is included after purchase
Prerequisites
// before you start
- General web application and network security testing knowledge
- Familiarity with OWASP Top Ten type vulnerabilities
- Some previous hands-on testing experience
- Community access via Discord: resume guidance and job placement help
Full Syllabus
Twenty modules of real methodology.
Everything from project tracking and recon through application analysis and vulnerability-class deep dives. Expand any module to see the topics covered.
M01General Topics
- Project tracking for large scope assessments (red team and bounty)
- Mental health in offensive security
- Templating and reporting
- Testing environment
- Providers
- Tools
M02Recon Concepts
M03Recon Techniques
- Acquisitions and domains
- Shodan
- ASN analysis
- Crunchbase ++
- SSL recon
- ReconGPT
- Reverse WHOIS
- Reverse DNS
- Reverse IP
- DMARC analysis
- Ad and analytics relationships
- Supply chain investigation and SaaS
- Google-fu (trademark & privacy policy)
- TLD scanning
- O365 enumeration for apex domains
- Subdomain scraping (all the best sources and why to use them)
- Sources
- Brute force
- Wildcards
- Permutation scanning
- Linked discovery
- Wordlists
- Advantageous subs (WAF bypass - origins)
- Favicon analysis
- Sub sub domains
- Port scanning
- Screenshotting
- Esoteric techniques
- Service bruteforce
M04Best Resources to Follow to Stay Sharp
- Print resources
- Trainings
- Podcasts and YouTube
- Labs
M05Recon Adjacent Vulnerability Analysis
- CVE scanners vs dynamic analysis
- Subdomain takeover
- S3 buckets
- Quick hits (swagger, .git, configs, panel analysis)
M06Analysis Concepts
- Intended usage (not holistic, contextual)
- Analysis layers
- Application layers as related to success
- Tech profiling
- The big questions
- Change monitoring
M07Vulnerability Automation
- More on CVE and dynamic scanners
- Dependencies
- Early running so you can focus on manual
- Secrets of automation kings
M08Content Discovery
- Intro to CD (walking, brute/fuzz, historical, JS, spider, mobile, params)
- Importance of walking the app
- Bruteforce tooling
- Bruteforce tooling lists: based on tech
- Make your own (from-install, dockerhub, trials, from word analysis)
- Best base wordlists
- Quick configs
- API lists
- Bruteforce tooling tips: recursion
- Bruteforce tooling tips: sub as path
- Bruteforce tooling tips: 403 bypass
- Historical content discovery
- Spidering
- Mobile content discovery
- Parameter content discovery
M09JavaScript
- Cheatsheets (BETA)
- Raw analysis
- Inline JS
- Obfuscated JS
- Lazy loaded JS
- Minified JS
- Mobile JS analysis
- Advanced tooling and tips for all the above
M10The Big Questions
- How does the app pass data?
- How/where does the app talk about users?
- Does the site have multi-tenancy or user levels?
- Does the site have a unique threat model?
- Has there been past security research & vulns?
- How does the app handle common vuln classes?
- Where does the app store data?
M11Application Heat Mapping
- Common issue place: upload functions
- Common issue place: content type multipart-form
- Common issue place: content type XML / JSON
- Common issue place: account section and integrations
- Common issue place: errors
- Common issue place: paths/URLs passed in parameters
- Common issue place: chatbots
M12Web Fuzzing & Analyzing Fuzzing Results
- Parameters and paths (generic fuzzing)
- Reducing similar URLs
- Dynamic only fuzzing
- Fuzzing resources SSWLR - "Sensitive Secrets Were Leaked Recently"
- Backslash powered scanner
M13XSS Tips and Tricks
- Stored and reflected
- Polyglots
- Blind
- DOM tools
- Common parameters
- Automation and tools
M14IDOR Tips and Tricks
- IDOR, access, authorization, MLAC, direct browsing, business logic, parameter manipulation
- Numeric IDOR
- Identifying user tokens: GUID IDOR
- Common parameters
- Resources
M15SSRF Tips and Tricks
- SSRF intro
- Schemas
- Alternate IP encoding
- Common parameters
- Resources
M16XXE
- Common areas of exploitation
- Payloads
- Common parameters
- Resources
M17File Upload Vulnerabilities Tips and Tricks
- Common bypasses
- Common parameters
- Resources
M18SQL Injection Tips and Tricks
- SQLmap tamper
- ghauri
- Resources
- Common parameters
M19Bypass of Security Controls
- Security control types (CDN, server, code-level)
- Block triggers
- Bypass techniques
M20Dependency Confusion
- How it works
- Where and what to look for
- Resources
What's Included
More than a course. A community.
TBHM is dedicated to fostering a vibrant and supportive community for learners. A dedicated Discord channel provides ongoing support, including resume guidance and job placement assistance.
Live Training & Q&A
// format
- Live training and Q&A sessions
- 27hr+ of online content
- Certificate of completion
- All source material retained for reference
Community
// discord
- Ongoing support in a dedicated Discord
- Resume guidance and job placement assistance
- Monthly hunts, recon data, and private resources
Refund & Access
// policy
- Proprietary, cutting-edge content; all registrations non-refundable
- Full recordings provided so you can learn on your own schedule
- Bulk purchases and team discounts available, reach out for pricing
JH
Jason Haddix
CEO · Lead Instructor · The Bug Hunter's Methodology
“Having dedicated years to the cybersecurity community, I've decided it's time to embark on a new journey: launching Arcanum Information Security, infused with a unique approach that sets us apart. At Arcanum, our mission is to make a tangible impact on the security community with world class, modern, and accessible training. In parallel, Arcanum aims to disrupt the consulting model with our unique consulting services.”
Stay Looped In
Join the community.
Discussions, links, monthly hunts, recon data, and videos, plus Jason's commentary across every channel.
Ready to level up your hunting?
Get the flagship TBHM Core course on demand: 27hr+ of methodology, plus the community that comes with it.
![The Bug Hunter's Methodology [Core] course art](/assets/669180f2d9f838e5daae6b5f_Recon Topics (1).3afca3e5.png)