Verified IT Work Experience Program

Web Application Security & Bug Bounty Internship

Hunt OWASP Top 10 web vulnerabilities, master Burp Suite Pro, and execute real-world bug bounty testing.

3 - 6 Months
Online / On-site
Experience Letter + LOR
1-on-1 Lead Mentorship
Apply for Internship Download Brief

Role Overview

Step onto the frontlines of offensive cyber defense. In this Web Application Security & Bug Bounty Internship, you will hunt for critical vulnerabilities across live multi-tenant SaaS platforms, banking APIs, and simulated e-commerce ecosystems. Working in isolated cyber ranges and authorized target scopes, you will master Burp Suite Professional, exploit the OWASP Top 10, weaponize IDOR and SSRF, automate scans with Nuclei, and write professional vulnerability disclosure reports that earn bounties and corporate job offers.

Tools & Stack You Will Use

Burp Suite Professional OWASP Top 10 Exploitation Web Reconnaissance & OSINT API Security Testing IDOR & Authorization Flaws SSRF & Cloud Metadata SQL Injection & XSS CVSS v3.1 Scoring Bug Bounty Methodology VAPT Audit Reporting

What You Will Receive

  • Verified Experience Certificate: Company-issued credential recognizing duration.
  • Letter of Recommendation (LOR): Signed recommendation from tech lead for top performers.
  • Production GitHub Repos: Live pull requests, commits, and verified public repositories.
  • Interview & Placement Support: Direct client interview opportunities & referrals.

Eligibility & Candidates

  • Final year & pre-final engineering/IT students
  • Fresh graduates looking for company experience
  • Career switchers seeking real-world portfolios

Commercial Projects You Will Build

Real-world product blueprints and enterprise deliverables

1 Web Architecture, HTTP Internals & Interception Proxy Setup

Live Milestone
  • HTTP/1.1 and HTTP/2 deep dive: Requests, responses, headers, cookies, sessions, and WebSocket protocols
  • Configuring Burp Suite Professional: Upstream proxies, SSL/TLS certificate installation, and browser integration
  • Target mapping and scope definition: Automated sitemap crawling and passive endpoint identification
  • Exploring Burp modules: Repeater for request tampering, Decoder for encoding/decoding, and Comparer for diff analysis

2 Broad & Deep Web Asset Reconnaissance

Live Milestone
  • Subdomain enumeration: Combining passive OSINT (Amass, Sublist3r, Findomain) and active DNS brute-forcing (Subfinder, Massdns)
  • Live host probing and port scanning: Rapid port discovery with Naabu and HTTP status probing with HTTPX
  • JavaScript file analysis: Extracting hidden API endpoints, hardcoded credentials, and cloud storage URLs using LinkFinder and SecretFinder
  • Web directory and parameter fuzzing: High-speed endpoint discovery with ffuf and Gobuster using SecLists wordlists

3 OWASP Top 10 Core Injection & Client-Side Flaws

Live Milestone
  • SQL Injection (SQLi): Error-based, Boolean-blind, Time-based, and UNION-based exploitation with manual payload crafting and SQLMap
  • Cross-Site Scripting (XSS): Reflected, Stored, and DOM-based XSS exploitation, cookie stealing, and session hijacking
  • Cross-Site Request Forgery (CSRF): Identifying vulnerable state-changing endpoints, creating automated HTML PoC exploit forms, and bypassing weak SameSite cookie configurations
  • Server-Side Template Injection (SSTI): Identifying template engines (Jinja2, Twig, Freemarker) and achieving Remote Code Execution (RCE)

4 Modern Access Control, IDOR & Cloud SSRF Exploitation

Live Milestone
  • Broken Object-Level Authorization (BOLA/IDOR): Finding horizontal and vertical privilege escalations using Burp Autorize extension
  • Server-Side Request Forgery (SSRF): Exploiting backend URL parsers to query internal microservices and extract AWS/Azure EC2 metadata tokens (169.254.169.254)
  • JWT security testing: Cracking weak HMAC secrets, none-algorithm bypasses, and key confusion attacks
  • GraphQL & REST API penetration testing: Query batching DoS, introspection analysis, mass assignment, and unauthenticated endpoint chaining

5 Business Logic Vulnerabilities & Race Conditions

Live Milestone
  • Business logic flaws: Flawed coupon code algorithms, price tampering in e-commerce shopping carts, and parameter tampering
  • Race condition attacks: Concurrency testing using Turbo Intruder to exploit multi-request withdrawals, double-spending, and gift card redemption
  • Authentication & 2FA bypasses: Rate-limit testing, response manipulation (HTTP 200 OK tampering), and OTP brute-forcing
  • Automated vulnerability hunting with Nuclei: Writing and running custom YAML templates for zero-day and n-day vulnerabilities

6 Professional VAPT Reporting, Capstone Defense & PPO Evaluation

Live Milestone
  • Bug bounty platform workflows: Setting up profiles on HackerOne, Bugcrowd, and Intigriti, understanding scopes, and adhering to Rules of Engagement (ROE)
  • Drafting professional vulnerability reports: Writing executive summaries, reproduction steps, proof-of-concept (PoC) videos, CVSS v3.1 scoring, and developer remediation advice
  • Capstone Project: Full-scope security audit of an enterprise multi-tenant banking and commerce application with comprehensive VAPT audit report
  • Final technical defense walkthrough, code remediation review, and Pre-Placement Offer (PPO) interview evaluation

Agile Work Culture & Daily Routine

How you collaborate inside your developer pod each week

1

Daily Standups & Sprints

Participate in 15-minute morning standups, track sprint backlog items in Jira, and define daily feature goals.

2

Feature Engineering

Write clean, modular code following design patterns, database migrations, and API contract specifications.

3

PR Reviews & Quality Gates

Submit GitHub pull requests, receive 1-on-1 feedback from senior tech leads, and pass automated CI test pipelines.

4

Cloud Staging & Demo

Deploy live containerized features to cloud staging environments and demonstrate working software during sprint reviews.

Local Internship Campuses & Dev Centers

In-person & hybrid developer seats in Coimbatore & Chennai

Coimbatore • Internship

Web Application Security & Bug Bounty Internship
Chennai • Internship

Web Application Security & Bug Bounty Internship
Limited Seats Per Batch

Start Your Professional Journey Today

Join our Web Application Security & Bug Bounty Internship and gain verified company work experience, senior mentorship, and a production-grade portfolio.

Apply for Internship Explore All Tracks