└── README.md /README.md: -------------------------------------------------------------------------------- 1 | # 🎯 Bug Bounty Quick Start Guide 2 | 3 |
4 | Typing SVG 5 |
6 | 7 | ## πŸ“– About This Guide 8 | 9 | This comprehensive resource is designed to help beginners start their journey in bug bounty hunting. It provides a curated collection of tools, methodologies, and learning materials that are essential for identifying and reporting security vulnerabilities. Whether you're completely new to security research or transitioning from another field, this guide offers: 10 | 11 | - πŸŽ“ Structured learning paths and free educational resources 12 | - πŸ› οΈ Essential tools with practical usage examples 13 | - πŸ“ Step-by-step methodology for hunting bugs 14 | - πŸ”’ Best practices and safety guidelines 15 | - 🌐 Recommended platforms and programs 16 | - πŸ“š Valuable learning resources and practice environments 17 | 18 | Perfect for: Security enthusiasts, aspiring bug hunters, and anyone interested in web security. 19 | 20 | --- 21 | 22 | ## πŸ“š Learning Resources 23 | 24 | ### Free Courses & Platforms 25 | | Platform | Description | Link | 26 | |----------|-------------|------| 27 | | PortSwigger Web Security Academy | Interactive labs and learning materials | [Link](https://portswigger.net/web-security) | 28 | | TryHackMe | Beginner-friendly rooms and paths | [Link](https://tryhackme.com) | 29 | | HackerOne CTFs | Practice finding vulnerabilities | [Link](https://ctf.hacker101.com/) | 30 | | PentesterLab | Hands-on web security exercises | [Link](https://pentesterlab.com/) | 31 | | OWASP Top 10 | Essential vulnerabilities to understand | [Link](https://owasp.org/www-project-top-ten/) | 32 | 33 | ### YouTube Channels 34 | | Channel | Focus | Link | 35 | |---------|-------|------| 36 | | InsiderPhD | Beginner tutorials | [Link](https://www.youtube.com/c/InsiderPhD) | 37 | | NahamSec | Bug bounty tips | [Link](https://www.youtube.com/c/Nahamsec) | 38 | | STΓΆK | Vulnerability analysis | [Link](https://www.youtube.com/c/STOKfredrik) | 39 | | Bug Bounty Reports Explained | Report breakdowns | [Link](https://www.youtube.com/c/BugBountyReportsExplained) | 40 | 41 | ## πŸ› οΈ Essential Tools 42 | 43 | ### Reconnaissance Tools 44 | ```bash 45 | # Subdomain Enumeration 46 | subfinder -d target.com # Fast subdomain discovery 47 | amass enum -d target.com # Comprehensive enumeration 48 | assetfinder target.com # Quick asset discovery 49 | 50 | # Content Discovery 51 | dirsearch -u https://target.com # Directory enumeration 52 | ffuf -w wordlist -u https://target.com/FUZZ # Fast fuzzing 53 | gobuster dir -u https://target.com -w wordlist # Directory busting 54 | 55 | # Visual Recon 56 | aquatone -out ./aquatone targets.txt # Screenshot and analysis 57 | eyewitness --web -f urls.txt # Visual reconnaissance 58 | ``` 59 | 60 | ### Vulnerability Scanning 61 | ```bash 62 | # Web Vulnerability Scanners 63 | nuclei -l urls.txt -t nuclei-templates # Template-based scanning 64 | nikto -h https://target.com # Classic web scanner 65 | wpscan --url https://wordpress-site.com # WordPress scanning 66 | 67 | # Specific Vulnerability Tools 68 | xsstrike -u "https://target.com/?param=test" # XSS testing 69 | sqlmap -u "https://target.com/?id=1" # SQL injection 70 | jwt_tool decode [token] # JWT analysis 71 | ``` 72 | 73 | ### Proxy Tools 74 | | Tool | Type | Purpose | 75 | |------|------|---------| 76 | | Burp Suite Community | Proxy & Scanner | Web app testing | 77 | | OWASP ZAP | Security Tool | Vulnerability scanning | 78 | | Fiddler | Web Debugger | Traffic analysis | 79 | 80 | ### API Testing Tools 81 | ```bash 82 | # API Reconnaissance & Testing 83 | postman # API development and testing client 84 | kiterunner scan https://target.com -w routes.txt # API endpoint discovery 85 | ``` 86 | 87 | ### Cloud Security Tools 88 | ```bash 89 | # Cloud Misconfiguration Scanners 90 | prowler aws --profile # AWS security assessment 91 | scoutsuite aws --profile # Multi-cloud security auditing 92 | ``` 93 | 94 | ## 🎯 Getting Started 95 | 96 | ### Latest Bug Bounty Programs 97 | | Site | Description | Link | 98 | |----------|-------|------| 99 | | bbradar | Find the Latest Bug Bounty Programs. Programs auto-refresh every 7 mins. | [Link](https://bbradar.io/) | 100 | 101 | 102 | ### Bug Bounty Platforms 103 | | Platform | Focus | Link | 104 | |----------|-------|------| 105 | | HackerOne | Wide range of programs | [Link](https://hackerone.com) | 106 | | Bugcrowd | Managed programs | [Link](https://bugcrowd.com) | 107 | | Intigriti | European programs | [Link](https://intigriti.com) | 108 | | YesWeHack | Global programs | [Link](https://yeswehack.com) | 109 | 110 | ### Beginner-Friendly Programs 111 | - GitHub Security Lab 112 | - Department of Defense VDP 113 | - Internet Bug Bounty 114 | - Open-source projects 115 | 116 | ### Common Entry-Level Vulnerabilities 117 | 1. XSS (Cross-Site Scripting) 118 | 2. IDOR (Insecure Direct Object References) 119 | 3. Information Disclosure 120 | 4. Security Misconfiguration 121 | 5. Subdomain Takeover 122 | 123 | ## πŸ“ Basic Methodology 124 | 125 | ### 1. Reconnaissance 126 | ```bash 127 | # Initial Enumeration 128 | subfinder -d target.com > domains.txt 129 | assetfinder target.com >> domains.txt 130 | amass enum -d target.com >> domains.txt 131 | 132 | # Live Host Discovery 133 | cat domains.txt | httpx > live_domains.txt 134 | 135 | # Screenshot 136 | aquatone -out ./aquatone < live_domains.txt 137 | ``` 138 | 139 | ### 2. Content Discovery 140 | ```bash 141 | # Directory Enumeration 142 | ffuf -w wordlist.txt -u https://target.com/FUZZ 143 | 144 | # Parameter Discovery 145 | arjun -u https://target.com/path 146 | 147 | # JavaScript Analysis 148 | subjs -i live_domains.txt 149 | ``` 150 | 151 | ### 3. Vulnerability Assessment 152 | ```bash 153 | # Automated Scanning 154 | nuclei -l urls.txt -t nuclei-templates 155 | 156 | # Manual Testing 157 | # - Test input fields 158 | # - Check file uploads 159 | # - Analyze API endpoints 160 | # - Review JavaScript files 161 | ``` 162 | 163 | ## πŸ“ Reporting Vulnerabilities 164 | 165 | Writing a clear, concise, and actionable bug report is crucial for getting your findings validated and rewarded. A good report demonstrates professionalism and makes the triage process easier for the security team. 166 | 167 | ### Key Components of a Good Report 168 | - **Clear Title:** Summarize the vulnerability and its location (e.g., "Stored XSS in User Profile Name via POST /settings"). 169 | - **Vulnerability Details:** Explain the type of vulnerability, where it was found, and the technical details. 170 | - **Steps to Reproduce (PoC):** Provide clear, step-by-step instructions that allow the team to reliably reproduce the issue. Include necessary code snippets, commands, or URLs. Screenshots or video recordings are often helpful. 171 | - **Impact:** Describe the potential impact of the vulnerability. What could an attacker achieve? (e.g., steal user sessions, modify data, gain unauthorized access). 172 | - **Remediation Suggestion (Optional but helpful):** Briefly suggest how the vulnerability might be fixed. 173 | 174 | ### Tips for Effective Reporting 175 | - **Be Clear and Concise:** Avoid jargon where possible and get straight to the point. 176 | - **Ensure Reproducibility:** Double-check your steps before submitting. 177 | - **Demonstrate Impact:** Clearly explain why the vulnerability matters. 178 | - **Stay Professional:** Maintain a respectful tone, even if discussing sensitive issues. 179 | - **Check Scope:** Ensure the vulnerability is within the program's scope before reporting. 180 | - **Proofread:** Check for typos and grammatical errors. 181 | 182 | ## πŸ’‘ Pro Tips 183 | 184 | ### Getting Started 185 | 1. Focus on one vulnerability type 186 | 2. Master one tool at a time 187 | 3. Read disclosed reports 188 | 4. Join bug bounty Discord communities 189 | 5. **Specialize:** Focus on specific vulnerability classes or target types (e.g., APIs, mobile). 190 | 191 | ### Documentation 192 | - Take detailed notes 193 | - Create reproducible steps 194 | - Record proof-of-concept videos 195 | - Use templates for reports 196 | - **Be Patient:** Finding bugs takes time and persistence. 197 | 198 | ### Safety First 199 | - Always read program policies 200 | - Use VPN when testing 201 | - Never test without authorization 202 | - Respect scope and rules 203 | - **Understand Safe Harbor:** Know the legal protections offered by the program policy. 204 | 205 | ### General Tips 206 | - **Network:** Connect with other hunters and researchers. 207 | - **Handle Duplicates/NA Gracefully:** Learn from them and move on. It's part of the process. 208 | - **Don't Chase Leaderboards:** Focus on learning and quality reports over quantity. 209 | 210 | ## πŸ“š Must-Read Resources 211 | 212 | ### Books 213 | | Title | Author | Focus | 214 | |-------|--------|-------| 215 | | Web Application Hacker's Handbook | Dafydd Stuttard | Web Security | 216 | | Real-World Bug Hunting | Peter Yaworski | Bug Bounty Tips | 217 | | Bug Bounty Bootcamp | Vickie Li | Methodology | 218 | 219 | ### Blogs and Write-ups 220 | - [PortSwigger Research](https://portswigger.net/research) 221 | - [HackerOne Hacktivity](https://hackerone.com/hacktivity) 222 | - [Bug Bounty Write-ups](https://pentester.land/list-of-bug-bounty-writeups.html) 223 | 224 | ## πŸŽ“ Practice Environments 225 | | Platform | Type | Link | 226 | |----------|------|------| 227 | | DVWA | Vulnerable Web App | [Link](http://www.dvwa.co.uk/) | 228 | | Juice Shop | OWASP Project | [Link](https://owasp.org/www-project-juice-shop/) | 229 | | VulnHub | Vulnerable VMs | [Link](https://www.vulnhub.com/) | 230 | | Hack The Box | CTF Platform | [Link](https://www.hackthebox.eu/) | 231 | 232 | ## πŸ”„ Continuous Learning 233 | 234 | ### Stay Updated 235 | - Follow security researchers on Twitter 236 | - Join bug bounty Discord servers 237 | - Subscribe to security newsletters 238 | - Participate in CTFs 239 | 240 | ### Build Your Brand 241 | - Share your findings (after disclosure) 242 | - Write blog posts 243 | - Create YouTube content 244 | - Help others learn 245 | 246 | --- 247 | 248 |
249 | Remember: 250 | - Start with the basics 251 | - Practice regularly 252 | - Learn from others 253 | - Stay ethical 254 | - Document everything 255 | - Never stop learning 256 |
257 | 258 | --- 259 | 260 |
261 | Guide Views 262 |
263 | --------------------------------------------------------------------------------