Avigdor CyberTech is a Bengaluru-based cyber security and ethical hacking training institute offering CEH, CompTIA, Cisco and SOC certifications with 100% placement assistance.
2nd Floor, Trinity Square Building, 385/1, ITPL Main Rd, Lakshminarayana Pura, AECS Layout, Munnekollal, Bengaluru, Karnataka 560037
Agents do the recon. You find the bug.
Master AI-powered reconnaissance, manual validation, and professional bug reporting on live authorised programs.
Next batch starts soon · Online + Bangalore classroom
Every course in this space now calls itself “AI-assisted”. That phrase describes a tool you happen to have open. It says nothing about who decides — and deciding is the entire job. So we name the division of labour instead, because the division of labour is the method.
A very fast intern with no accountability.
The one with a platform reputation to lose.
An agent may never be the last thing to touch a finding before submission.
There is no deliberately vulnerable application anywhere in the syllabus — no seeded demo app, no scored lab track, no container with exactly one bug in exactly one place. From the agent phase onward every exercise runs against a live programme you selected and are authorised to test, and so does every exercise the instructors run.
Agent output, triage decisions and Repeater sessions worked through on the real programme you selected — including the endpoints that turn out to be correctly secured, because those teach you the application's authorization model.
Instructors work live targets in parallel with the class. You see the false starts, the dead ends and the agent runs that returned nothing usable — not a cleaned-up final payload with the failures edited out.
Findings are written up as actual reports, reviewed line by line before they are sent, and followed all the way through triage — including the ones that come back duplicate or informational.
Every live session runs inside a published programme policy with a written ROE, and scope is confirmed before the first packet leaves the machine — including the programme's clause on AI tooling, which is now a standard part of policy review rather than an afterthought. Students who test outside scope are removed from the programme. This is the one rule we do not bend.
These are published reward ranges from real programs on the major platforms — the kind of scope you will be hunting during the course. Nobody gets the top number for a low-impact finding: the range is set by the program, and where you land in it is set by the impact you can prove.
| Program | Industry | Reward range |
|---|---|---|
| eToroSocial investment platform | Finance | $100—$15,000 |
| LaunchDarklyFeature management | Computer Software | $150—$7,500 |
| RapydPayments APIs | Finance | $100—$7,500 |
| OpenAI SafetySafety bug bounty | Computer Software | $250—$7,500 |
| MathWorksMATLAB Online | Computer Software | $200—$7,000 |
| MoovitMobility as a service | Utilities | $100—$7,000 |
| OptusSingTel Optus | Technology | $150—$5,000 |
| Nubank BrasilDigital banking | Finance | $50—$4,000 |
Minimum and maximum rewards as published by each program on a public bug bounty platform. Programs revise these regularly — verify current figures before relying on them. Listed here as market context, not as a prediction of individual earnings.
Findings submitted by students on live authorised programs during and after the course. Program names are withheld under disclosure policy.
I used to spend hours doing reconnaissance manually. The AI workflow cut that time dramatically, so I could focus on testing and finding real vulnerabilities. I landed my first valid bounty within weeks.
Most courses teach tools. This one taught me a repeatable workflow. Learning how to combine AI agents with manual validation completely changed how I approach bug hunting.
The biggest difference was working on live authorised programs instead of practice labs. By the end of the course, I was writing professional reports with confidence.
Finding the vulnerability was only half the problem. I struggled to explain the impact clearly. The report-review process taught me how to reproduce the issue, demonstrate the business impact and write reports that a security team could actually act on.
Recon was always the part where I got lost. I was collecting hundreds of endpoints without knowing what mattered. Learning how to reduce the attack surface and prioritise targets completely changed how I approached a program.
I had spent months watching bug bounty videos but never knew what to actually test. The structured hunting process helped me stop guessing and start testing systematically. My first valid finding came from a workflow I had already practised during the course.
My first bounty felt like luck. The bigger change was learning how to repeat the process across different targets. I now have a workflow for recon, testing, validation and reporting instead of randomly trying payloads and hoping something works.
That you will earn a bounty by a fixed date. Bounty outcomes over any short window are mostly luck — method is not, and method is what we can actually teach. Anyone selling you a guaranteed payout is selling you something else.
Progress here is not linear, and it helps to know the sequence rather than guessing. We set expectations against this from day one, so nobody quietly assumes they have failed.
Full recon runs unattended on one target — your method is repeatable without you sitting over it.
Any severity, likely a duplicate or Low. You can now tell signal from noise on a live application.
You can prove impact in a triager's terms rather than your own.
Consistent findings across two or three programs. Now you know it was method, not luck.
If you move through this sequence slowly, nothing is wrong. Almost every hunter spends a long stretch on zero before something clicks, and the ones who quit are usually the ones nobody told. Assessment here is on process.
Cumulative, and none of it expires when the course ends — the pipeline is still running the week after you graduate.
A working Kali environment plus a personal setup.sh that reconstructs it end to end, and a fully keyed config set.
Four agent CLIs behind one routing config with a local model as the floor, so no vendor's pricing decision can interrupt your work again.
A written threat model, a permission config that enforces it, and your own measured true-positive rate for agent output.
Scope rules, the full extension set and match/replace rules preconfigured for every future engagement.
Running against multiple programs with tuned alerting, still working long after the course ends.
Built from your own testing matrix against a real application — not copied from a blog post.
We would rather you skip this course than sit through it frustrated. We will tell you the same thing in the demo call, before you pay anything.
Bottom line: You'll show up, ship work, get feedback, and improve.
Our promise: We only want committed learners who are ready to put in the work.
The person teaching this course hunts the same programs you will — live, in the same sessions.
Designed and leads the 33-module curriculum built around an agent-led recon stack and the RECON//CONSOLE toolchain. Works live authorised programs alongside the class — including the false starts, the dead ends and the agent runs that returned nothing usable, because a cleaned-up demo teaches nobody how hunting actually goes.
View LinkedIn profile →Expand any phase for every module, its tools and its field work. Phase A sits between the box build and the fundamentals because the agent layer is infrastructure — it has to exist, and be bounded, before it is pointed at anything. Phase 3 is ordered by expected return for a hunter with this toolchain, not by textbook convention: access control comes first because it is consistently the highest-volume paid class, and neither a scanner nor an agent can find it.
/.well-known/security.txtPATH construction, and why half of all "command not found" issues are exactly this--break-system-packages: PEP 668 and why Kali now refuses a bare pip installpdtm as the ProjectDiscovery package manager, and when to fall back to individual go installGITHUB_TOKEN for the subfinder GitHub source and trufflehog org scans, PDCP_API_KEY for Chaos~/recon/$TARGET/{subs,dns,ports,http,urls,js,params,fuzz,vulns,loot}anew as the backbone of the entire system — dedupe on append, print only what is newOPENAI_BASE_URL, OPENAI_API_KEY, OPENAI_MODEL — honoured by opencode, Aider and Qwen Code alike, which is what makes vendors swappable127.0.0.1:11434, with honest hardware requirements at 7B, 14B and abovepermission block in depth: edit, webfetch, and bash pattern matching down to individual commands/read-only versus /add, and forcing whole-file edits when a small model fumbles diffsAGENTS.md as the agent's rules of engagement: scope, directories it may never touch, commands it may never run, and the programme's own AI clause restated where the agent will actually read it~/recon root is the mistake that ends badlywebfetch, a credential-free environment, a container without egress, one workspace per targetX-HTTP-Method-OverrideDomain vs Path scoping, HttpOnly, Secure, SameSite semantics, cookie tossing between subdomainsAllow-Credentials, and why the null origin mattersnonce and strict-dynamic, and bypasses via JSONP and permissive CDN allowlistsnaabu -exclude-cdnHost header routing — the basis for vhost fuzzing and host header attackskatana -proxy, ffuf -replay-proxy, nuclei -proxy — so automation lands in the sitemap and manual testing picks up where the scanner stoppedsubfinder -all -recursive semantics and what recursive actually doessort -u vs anew, lowercasing, stripping ports and trailing dotsdev-, -staging, api2, uat. variants no dataset containsdnsx -a -aaaa -cname -resp, and why CNAMEs are where takeovers live-sVC only on what is open-exclude-cdn, and why scanning Cloudflare edge IPs burns scan time and produces nothing--ulimit, and not getting your VPS null-routed.js.map) and reconstructing original source — including the comments developers thought nobody would read--only-verified distinction between a string that looks like a key and a key that worksanew diff trick — a complete change-detection system in one pipealg:none, RS256→HS256 confusion, weak HMAC secrets, kid injection, jku/x5u abuseredirect_uri validation flaws, missing or predictable state, implicit-flow token leakage via Referer, account-linking abusegopher://, dict:// and file:// where the fetch library allowsstrict-dynamic gadget chains, base-uri omission, dangling markup exfiltration/api/, /v1/, swagger and OpenAPI specs, .well-known, mobile traffic, JS bundles/v1/ still live and unpatched with weaker authorization after /v2/ shippedsrc attributes.git directories, .env files, exposed artifactsredirect_uri → account takeover; self-XSS + cache poisoning → stored XSS; IDOR + email change → takeover; SSRF + metadata → cloud credentialsEvery AI tool in this course is free, and none of the free ones are stable. That second fact is what the syllabus is built around. Learn a vendor and you relearn everything the month that vendor changes its mind. Learn the routing layer and you change three environment variables and carry on.
| Tool | Shape | Why it earns a place | What will bite you |
|---|---|---|---|
| opencode | MIT · terminal | 75+ providers, MCP support, and a permission block that denies bash patterns outright — the only one of the four with a security control you would call a control | Route it away from providers that have blocked it |
| Aider | Apache-2.0 · git-native | Every edit lands as a real commit, so /undo is an undo rather than a promise; /read-only keeps reference files out of the edit set | Small local models fumble partial diffs — force whole-file edits when output goes strange |
| Qwen Code | Open source · terminal | Gemini CLI ancestry with Qwen3-Coder tuning, and it reads the same OPENAI_* trio as everything else in the stack | The CLI is free; the hosted tier behind it is not. Bring a key or an endpoint. |
| Antigravity | Google · IDE-shaped | An agent-manager surface that suits long recon-review sessions better than a TUI does | The most volatile free tier of the four — treat it as a bonus, never as your pipeline |
Hosted free tiers are frequently free because your inputs have value. Assume anything you send may be retained. That rules out response bodies containing real customer data, platform tokens, session cookies for programme-issued accounts, and unredacted findings before submission. Sensitive context goes to the local model — which is exactly why Ollama is taught as the floor of the stack rather than a curiosity.
Stages 01–09 are where the agent layer earns its place. Stage 10 is yours alone, and the highlight marks it for a reason.
ASN · WHOIS · certs
CT logs · datasets
brute · permute
naabu · nmap · tlsx
httpx · triage
archives · katana
endpoints · secrets
ffuf · kiterunner
xss · sqli · ssrf
where the money is
impact · evidence
anew · notify
| Group | Tools |
|---|---|
| Agent layer | opencode, Aider, Qwen Code, Antigravity, Ollama, jq |
| ProjectDiscovery | subfinder, httpx, katana, nuclei, dnsx, naabu, urlfinder, notify, interactsh-client, tlsx |
| Subdomain / DNS | assetfinder, amass, puredns, massdns, dnsgen |
| URL corpus | waybackurls, gau, waymore, gospider, uro, anew, qsreplace, unfurl, gf |
| Ports | nmap, rustscan, naabu |
| Fuzzing | ffuf, feroxbuster, gobuster, kiterunner |
| Secrets / exploitation | trufflehog, SecretFinder, mantra, dalfox, sqlmap |
| Burp extensions | Autorize, Param Miner, Turbo Intruder, Collaborator Everywhere, InQL, JWT Editor, Logger++, Hackvertor, DOM Invader |
| OSINT & wordlists | shodan CLI, SecLists, n0kovo DNS list, trickest resolvers |
role, isAdmin, userId, price)Most of what keeps a hunter at zero is not missing knowledge. It is a habit. The first four are new since 2026 and are currently the fastest ways to end a hunting career before it starts.
Reviews from students across our programmes — freshers, switchers and working professionals.
Avigdor is the best place to gain the knowledge about cybersecurity, you get good learning and you will have the knowledge and get trained on what you need for cybersecurity, also you will have good Mentoring too!!
I had an exceptional learning experience at Avigdor CyberTech as part of my CPENT-based cybersecurity training. I gained practical exposure to OSINT tools, Active Directory pentesting, and various real-world cybersecurity scenarios.
I have enrolled for the cyber security professional training at Avigdor. Highly recommended to people interested in career switch to cyber security and also for freshers looking to enter this field, as there is Placement Assistance.
Best institute to learn cyber security. The courses cover a wide range of topics, from penetration testing to incident response, delivered through a blend of instructor-led live classes and hands-on practical exercises.
Avigdor CyberTech's VAPT training is hands-on and realistic. The focus on real attack scenarios, tools, and methodology makes it genuinely useful for anyone aiming for a VAPT role.
As a fresher, Avigdor CyberTech helped me understand how a SOC actually works. The training covered SIEM basics, alerts, and real incident scenarios in a way that was easy to follow and practical.
Avigdor CyberTech's SOC training is practical and industry-focused. Real SIEM use cases, log analysis, and incident handling — not just theory. If you're serious about becoming a SOC analyst, this training gives you the right foundation.
More questions? Ask us directly →
Discovery got cheap in 2026 and triage did not. The gap became a crisis, and it is the reason a course can no longer teach AI tooling without also teaching where to stop it.
curl ended its bug bounty programme after drowning in hallucinated reports. Google stopped accepting AI-generated reports. HackerOne paused the Internet Bug Bounty, Node.js suspended rewards, Nextcloud shut its programme down. YesWeHack now names the violation directly, listing programme spamming and AI slop together and enforcing them through an ethical score that can end in a permanent ban.
Read that as a market signal rather than a moral one. The supply of plausible-looking findings collapsed in price. The supply of verified findings did not.
Agent-led recon widens what you see. It does not make you better at reading an authorization model, and it will not invent the two-account test that finds the IDOR. The agent phase exists to buy you time for the manual work, not to replace it — which is exactly why Phase 3 is the biggest phase in the course.
Meet the instructor, watch a real target get worked, and ask whatever you want. No payment details asked, no commitment — and if we think you are a poor fit, we will tell you.
Booking happens on WhatsApp — your details go straight to our team. No spam, ever.
* Google rating is sample data for design review.