Interview With Arbaz Hussain - Security Researcher From India

Today we have another Security Researcher Arbaz Hussain on Techmedia NG, One of the Youngest and Newbie Security Researcher in India from Hyderabad City, He Got Acknowledge by More than 50 Companies in Past 5 months , Including Facebook,Google,Paypal Q-4,AVG And Many others.

He's Not Here only for the Interview only but also to share his idea on How He Started his Journey as a Security Researcher, The Challenges He Faced, He share Some of the most important thing when starting a Journey as a Security Researcher with you Guys.  Just Take Your Time To Enjoy of one the most Awesome Interview On Techmedia NG.

Also Read: Interview With Penetration Testers And Ethical Hackers From Around The World

Arbaz Hussain

Hello, Arbaz Hussain Introduce Your Self To Our Readers


Hi, My Name is Arbaz Hussain , i'm 17 Years old From Hyderabad(City of India) , I Do Spend alot of time on Security Researching and work as a Penetration Tester on Hackerone Platform.

Please Tell Us About Your Education


About My Academic College?

I Hate My Academic Education, I Observe Myself Different From The Society and I Always Think's in a Unique Way, I Always Wonder is There Anything Which i'm Going to Get From Indian Degree's Except The Certificate. I Just Hate Learning The Things Which we are not going to use in Real Life. I always Want to Learn Something New & Different Things And Master it For The Rest of My Life. I Hate Indian Education Where
Teachers Trained  Their Student "How To Buttify The Things" Rather Than Learning Some Real Stuff. I Don't Care Whether i Get Job Or Not.

In Future But For Sure One Day i will be proud of myself And i will Continue Learning This Stuff Until And Unless I Reach my Goals.I Don't Care What People Think's About Me. I Will Follow my Passion And Do What i Love if  That Even Mean I'm a JackAss. However It's My Parents
Dream, For Sure Will do Both Things.

And How You Started The Journey As A Security Researcher?


It's All started in the Month of July 2015. I Was Habitual of Playing couple of My Favorite Game's i.e Call of duty 4 Modern Warfare and Delta force Black Hawk Down , Once upon a time i happened to see a Post on Facebook Which was About reporting  Security Vulnerabilities, The dude Posted The Report of Microsoft On Facebook, At that moment I Don't know what vulnerability means( So Vulnerability = Security Flaw or Weakness which can be used by The Attacker in order to Attack the Target ). Right after taking look at the post i Just Googled , What is Reporting Bugs and All that stuff which was mentioned in the post and i read  Couple of Blogs On Breaking and Fixing the things on internet :D And My Mind Fucked up  And I was not able to Understand Anything So i Just Left it and went on, But At The End of July, my Facebook Account was Compromised Though Phishing Method (At that time I was Not Aware of it) Attacker Performed Some Nudge & Abusive Activity on My Account, All i could do was just Recovering My account and closing it, At that time i was so Angry And Everyone was Blaming Me and I cant even say that "My account was compromised ".

So That Moment of My Anger Turns My Mind into Hacky Shacky Things, Slowly I Stopped playing Games and Started learning About Hacking Stuff such as Keyloggers, Rats, Trojans, Phishing and lot of Evil stuff in a BlackHat way. :D I would like to Thank One of My Best Fried  "Hassan Madni" Who Helped me in Solving Problems in Evil Activities. I Had Enjoyed alot By Spying on Other Computers, Attacking The Websites, Spamming etc , But once i suddenly Asked Myself "I'm on Right way?" , "Is there any Benefit, I'm Getting from it apart from Fun?" And Yes I was wrong!, So i Decided to find the way which may be called "Positive way or Ethical Way", The first thing i did was to get ride of all Evil activity, I read lots of articles But Failed many times understanding but i never gave up, The time passed away i kept struggling all the way and finally Got A Way To Follow The Ethical Way :) .

When Did You Start Hacking And Tell Us About Your Experience?


In the Month of August 2015, A Desire to Be Top White Hat Hacker Growns into My Mind, However i Love To Break and Fix the Things, So Finally I Decided to Make it As My Career, As Days Went On , Later I got to Know That "It is Not Easy to Be Security Hacker", However No One Is Going To Teach you this Field From Basics, I Even Did Some Courses online and Read couple of Books on Application Security Even Through i Didn't Understood Anything, So I Just Keep Adding New Friends Who Do such Security Things, I Asked More than 100 peoples On Internet.

No One Helped me But I Would Like to Thank Those Guys Who Showed Me a Way to Follow The Hard way , "Nothing Comes Easy, Until and Unless You Have Desire to Achieve That " And Slowly My Excitement of Learning Web Security Turns into Addiction. Well Learning Self is Not an Easy Task, I Quit Playing Games and Talking With The People With Whom I Used to Spend My Nights And Started Reading Books, Blogs, Papers Etc .The Main Problem i Faced Was That Book's Were Annoying( Contains Most of Meaningful Words Which Was Not So Easy To  Understand Properly) Even though i Didn't gave up, I Type Each Word Randomly on Google to Know it's Meaning And Write Some Important points from Book into Notepad, To Revised it Regularly, I Spent Day's and Night's on Learning new things Which Was So Horrible And Annoying Sleepless nights But Was Passionate to Learn it And Achieve it.

Which Website/System Did You First Find Vulnerability? What’s The Vulnerability?


When i Was New to Hacking Field, i Used to Have Fun Breaking into Friends Computers by Distributing Viruses  and Hacking Websites From SQL Injection Vulnerabilities.

What Advise Will You Give To Beginners Coming Into This Field?


Getting Fame And Money isn't purpose of Ethical hacking. There are lots of my friends who are looking for some one who may teach them but what i always said and believed "Help Your self and Learn Yourself". However There are More Important things in my Life Than My Career (i.e My Religious, My Family And My Girl). As Following Well Said By Shammer Amir (Security Researcher At Hackerone) "Well My Aim is To Help The Needy One's With My Bounties". It's about inspiring other. I wouldn't have donated if didn't came across the work of Charity
Hackers Association. Their work inspired me and as i shared, It could inspire more researchers who is in my friend list. This is the soul purpose of doing this. The Founder of Melinda-Gates foundation Bill Gates once answered a similar question. I'll add it here if i find it." I Found Many People's Around the internet Who Wan'ts to Learn About Penetration Testing But Still They Are Confused and Always Ask Security researcher's some Suggestion's, In This Article i Would Like to Share My Small Experience and How i Work on Bug Bounty. Now From This Interview Let's Thank Arbaz For Providing Some Sources On How To Start Penetration Testing

From My View :-

1. You Should have Some Basics Knowledge about The Communication's Between Devices and The Internet Such As "What is Http And Https"
"What is SSL , SSH , FTP "  "HTTP Response and Request" "HTTP STATUS CODES" "INTERCEPTING THE TRAFFIC WITH PROXIES"

Sources/References:

(https://www.youtube.com/watch?v=0PHCAdw6Z8w)
(https://www.instantssl.com/https-tutorials/what-is-https.html)
(https://en.wikipedia.org/wiki/Request%E2%80%93response)
(https://www.youtube.com/watch?v=sxiRFwQ1RJ4)
(https://en.wikipedia.org/wiki/List_of_HTTP_status_codes)
(https://portswigger.net/burp/tutorials/UsingBurpProxy.html)
(https://www.youtube.com/watch?v=2cYEhHTjA7E)
(https://www.youtube.com/watch?v=qsE04AhlJrc)
(https://www.youtube.com/watch?v=zAHOqv7S4bk)
(https://www.youtube.com/watch?v=RsQ1tFLwldY)
https://www.optimizesmart.com/geek-guide-direct-traffic-analysis/

2. You Should Know At-least Basics of Web Based Languages, Some Scripting And Developing Languages.

HTML5      -> ( A+)

Javascript ->  (A)

PHP          ->  (A+)

PERL        ->  (B)

Python       -> (A+)

C AND JAVA -> (A)

NOTE :- You Must Know HTML And PHP (A+) Compulsory For Learning Web Based Testing.
FOR ANDROID AND iOS : JAVA AND C# IS COMPULSORY or Atleast Some Basics (A)

3. Learn About Intercepting Proxies

I Will Strongly Recommend you Guys to Go With Burp Suite, You Can Also Use Any Other Proxy Such as OWASP ZAP , WebScarab Or You Can Go With FireFox  Addon(LIVE HTTP HEADER)
(https://addons.mozilla.org/en-US/firefox/addon/live-http-headers/)

BURP SUITE MAP:-

You Can Download Burp Suite From Here
(https://portswigger.net/burp/download.html)

Just Try To Search About Burp Suite on Youtube or Google To Learn more about it.

Or Go with this Book
(http://www.amazon.in/Burp-Suite-Essentials-Akash-Mahajan-ebook/dp/B00QFBNXHA?tag=googinhydr18418-21)

==> Start Learning About Vulnerabilities Now

1. SQL INJECTION

Sources/References :-
https://www.youtube.com/watch?v=PB7hWlqTSqs
Free Course: (http://newdemy.com/courses/sql-injection-online-course-by-hitesh-choudhary)
(https://www.youtube.com/watch?v=7H358PrFagc)
http://www.guru99.com/learn-sql-injection-with-practical-example.html
http://breakthesecurity.cysecurity.org/2010/12/hacking-website-using-sql-injection-step-by-step-guide.html
http://www.securityidiots.com/Web-Pentest/SQL-Injection/

2.  Master The XSS ( CROSS SITE SCRIPTING )

https://www.youtube.com/watch?v=LLtOJNeMp7c
https://www.youtube.com/watch?v=TKn5qdti66c
http://www.indiancomputerwizard.com/2015/08/xss-web-application-filters-bypass.html
http://binhduong-ug.blogspot.in/2012/11/xss-master-guide-for-all-xperts-and.html

You Can Practice It Here:-
https://public-firing-range.appspot.com/
http://demo.testfire.net/bank/login.aspx

Quick Tip:-

Always Try To Test Your Input  At https://jsfiddle.net/ or Any HTML, JS Editors to avoid confusion while testing applications.

3. CSRF ( Cross Site Request Forgery ) :

Cross-Site Request Forgery, or CSRF for short is a common and regular online attack. Basically, An attacker will use CSRF to trick a victim into accessing a website or clicking a URL link that contains Some Malicious Code To Change His Setting.

Sources/References :-

https://www.youtube.com/watch?v=vrjgD0azkCw
https://www.youtube.com/watch?v=QJmYhIJraOo
https://www.youtube.com/watch?v=2Y7IywV1YBQ
https://www.youtube.com/watch?v=sqvnEbZ1Dxw
http://www.rafayhackingarticles.net/2012/11/website-hacking-csrf.html
http://www.securitytube.net/video/196

-> Hackerone Platform Disclose Reports :-
There are more than thousands of Reports Publicly Disclose on Hackerone

http://h1.nobbd.de/

5. Some of The Useful Browser Addons and Extensions:-

Chrome : http://resources.infosecinstitute.com/19-extensions-to-turn-google-chrome-into-penetration-testing-tool/

Firefox : http://resources.infosecinstitute.com/use-firefox-browser-as-a-penetration-testing-tool-with-these-add-ons/

KNOW HACKING BUT NOT HACKING :

In Upcoming Paragraph i Would Like to Share My View For Those Guys Who Have Good Knowledge About Pentesting, Vulnerabilities Findings And Work on Bug Bounties Platform's Like Hackerone , Bugcrowd , Crowdsheet etc . But Still Gets Duplicates or Invalid(N/A) Bugs and Loose Their Confidence.

To be successful At Hackerone, YOU MUST THINK OUTSIDE THE BOX. Because you're not going to earn much for known issue unless you're very early to report. If you find out about a public program after 10/12 hours of its launching. Don't waste your time looking for known issues.
Dont look for low hanging Fruites , Just Take A Deep Dive into the application.

Another way, If you're lucky is to get yourself invited in a brand new Program, Report 20/25 issues there. You'll get a fortune. I mean bounty or Reps. And if you're lucky you'll get both. I've seen some guys climbed to the top just with 1 or 2 programs.

Thanks Very Much Arbazz :)

No comments

Powered by Blogger.