Bug Bounty

Summary

Bug Bounty Hunting is a subset of Web Application penetration testing and is focused on results over attempts. PoC || GtFO.

Remember

1. Bug Bounty Hunting is a game of luck but you control how many times you roll the dice.
2. You are doing this to learn. Go down those rabbit holes now and start building that intuition.
3. Take your time with a program. Spend at least 40 hours with a program before jumping ship.
4. Understand the business need to understand the impact and severity
5. Fuzz all the things
6. Do it every day
7. Dedicate time to learn new vulnerabilities.

Starting an Engagement

• Make sure to fuzz within scope
• Create Multiple accounts to test for IDOR

Top Mistakes According to Triagers

1. Lack of Information
   1. Lack of Detailed information
   2. Not providing Clear Steps to Reproduce
   3. Incomplete PoC
2. Ignoring Program Requirements
   1. Ignoring scope
   2. Ignoring program rules
3. Exaggerating the Severity
4. Not Considering User Impact
   1. Understand the business need to understand the severity
5. Submitting the same vulnerability with slightly different variations.
6. Submitting Low-Impact or no impact issues
7. Being disrespectful
8. Leaking information
9. Unrealistic payout expectations
10. Failing to verify and validate

Writing a Report