Big thanks to @ThreatLocker for sponsoring my trip to ZTW26 and also for sponsoring this video.  To start your free trial with ThreatLocker please use the following link:  https://www.threatlocker.com/davidbombal

Are you looking to get into bug bounty hunting but feel overwhelmed or worried the field is oversaturated? In this video, full-time bug bounty hunter Justin Gardner shares a realistic, actionable guide to web hacking for beginners.

We dive straight into the practical side with five live demonstrations of common web vulnerabilities—all done using just your browser and DevTools. Justin explains how Insecure Direct Object Reference (IDOR), Broken Access Controls, Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) work in the real world, including stories of finding these exact bugs on major platforms like Google.

After the demos, we tackle the biggest questions new hackers have: Is there still money to be made in 2026? How has AI changed the landscape? And what is the exact roadmap to landing your first bounty? Justin breaks down his "200-hour rule" for learning, why you need to get comfortable with failing, and the best resources (like HackerOne and PortSwigger) to help you launch your cybersecurity career today.

#webhacking #bugbounty #threatlocker

David Bombal

Full-time bug bounty hunter Justin Gardner demonstrates four common web vulnerabilities using live labs: IDOR (insecure direct object reference), broken access controls (client-side), XSS (cross-site scripting), and CSRF (cross-site request forgery). Each demo is shown using only browser dev tools, with real-world confirmation that these vulnerabilities still exist in production systems. Justin also shares advice on getting started in bug bounty hunting, recommending ~200 hours of study before actively hacking, choosing a specialty vulnerability, using platforms like HackerOne and PortSwigger Academy, and not quitting your day job until bug bounty income matches your salary.

Top 4 Web hacking demos for aspiring hackers (with labs and CTF)