Hello Everyone, In this Blog we are going to discuss how to get started in Bug Bounty Hunting from scratch, although I am also a beginner I am going to share my experience of what I have learned. What to do and what not to do.

So Lets Begin!

For those who don’t know,

Bug bounty is a reward program where people find and report security issues in websites and software to make them safer. They get paid for helping companies fix these problems before bad hackers can exploit them. It’s a win-win for everyone.

Start with the Basics! Yes I know you hear this everywhere and you probably want to just get into the fun stuff and start earning money, I wanted the same and didn’t learn the basics perfectly, And I struggled a lot due to it.

What do I mean by Basics ?

If you don’t have any technical knowledge you need to start from the scratch as it is critical to have a solid understanding of how the internet and computer networks work.

You can start with HTTP Basics, In order to be able to learn what and how an application works, you need to be able to understand how you are communicating with it. Although don’t spend too much time into this as the basics are enough.

You can refer the following resources-:

https://www.youtube.com/watch?v=iYM2zFP3Zn0

In bug bounties, “recon” means gathering critical information about the target to find potential vulnerabilities and weaknesses before using automated tools to scan IPs and subdomains. Understanding its significance is essential for effective bug hunting.

Some Good Resources:

https://www.youtube.com/playlist?list=PLDQaRcbiSnqF5U8ffMgZzS7fq1rHUI3Q8

TOTAL CompTIA A+ Certification (220–1002):

CompTIA Network+ Cert. (N10–007):

https://www.udemy.com/course/free-ccna-200-301-network-fundamentals/

Linux Essentials For Hackers:
https://mega.nz/folder/mSZm0ToD#eHVXlQEZqjvy7wtOjr6bsQ

Many people say that you don’t need programming to start bug bounty, but I don’t agree with it, you should at least know the basics of programming languages to at least understand what is written. You can use codeacademy or youtube for just the basics.

For automation you can learn:

1.) Bash

2.) Python

Now That We Are Done With The Basics Let’s Get To The FUN STUFF!

First You will need to choose your path

• Web Pentesting
• Android Application Pentesting
• IOS Application Pentesting

Of course you can do all of them but as a beginner I think you should start with one of them.

Now to learn Web Pentesting you need to learn about the various attacks and practice them.

I would not suggest buying paid course until you get your first bounty, as there is more than enough resources online for free. Here Are some of them:

My Process of Learning For Bug Bounty:

1. Reading the theory and understand

2. Watching videos in Youtube or other platforms

3. Reading Blogs and Hackerone reports

4. Practicing Labs

5. Hunting On Real Websites

• Web app hackers handbook
• Web hacking 101
• Mastering modern web pen testing
• Bug Bounty Playbook
• Real-World Bug Hunting
• OWASP Testing Guide

You can find these books online easily and is a great resource to learn.

Youtube is a great resource for learning and there are a lots of creators out there with amazing content you can find them at https://securitycreators.video/

- [IppSec Channel - Hack The Box Writeups](https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA)
- [LiveOverflow - Explore weird machines...](https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w)
- [GynvaelEN - Podcasts about CTFs, computer security, programing and similar things.](https://www.youtube.com/channel/UCCkVMojdBWS-JtH7TliWkVg)
- [John Hammond - Wargames and CTF writeups](https://www.youtube.com/channel/UCVeW9qkBjo3zosnqUbG7CFw)
- [Murmus CTF - Weekly live streamings](https://www.youtube.com/channel/UCUB9vOGEUpw7IKJRoR4PK-A)
- [PwnFunction](https://www.youtube.com/channel/UCW6MNdOsqv2E9AjQkv9we7A)
- [OJ Reeves](https://www.youtube.com/channel/UCz2aqRQWMhJ4wcJq3XneqRg)
- [Hacksplained - A Beginner Friendly Guide to Hacking](https://www.youtube.com/c/hacksplained)
- [STÖK](https://www.youtube.com/c/STOKfredrik)
- [Defcon](https://www.youtube.com/user/DEFCONConference)
- [Hackersploit](https://www.youtube.com/channel/UC0ZTPkdxlAKf-V33tqXwi3Q)
- [The Cyber Mentor](https://www.youtube.com/channel/UC0ArlFuFYMpEewyRBzdLHiw)
- [Nahamsec](https://www.youtube.com/c/Nahamsec)
- [Hackerone](https://www.youtube.com/channel/UCsgzmECky2Q9lQMWzDwMhYw)
- [The Hated one](https://www.youtube.com/channel/UCjr2bPAyPV7t35MvcgT3W8Q)
- [stacksmashing / Ghidra Ninja](https://www.youtube.com/channel/UC3S8vxwRfqLBdIhgRlDRVzw)
- [Hak5](https://www.youtube.com/channel/UC3s0BtrBJpwNDaflRSoiieQ)

Twitter

Twitter is very common in the InfoSec area. Many advices and tips on bug hunting or CTF games are posted every day. It is worth following the feeds of some successful security researchers and hackers.

- [@Stö6B - Bug bounty hunter, cybersecurity educational content creator](https://twitter.com/stokfredrik)
- [@NahamSec - Hacker & content creator & co-founder bugbountyforum and http://recon.dev](https://twitter.com/NahamSec)
- [@dawgyg - Bug bounty hunter, reformed blackhat, Synack red team member](https://twitter.com/thedawgyg)
- [@putsi - Bug bounty hunter and white hat hacker in Team ROT](https://twitter.com/putsi)
- [@thecybermentor - Offers cybersecurity and hacking courses](https://twitter.com/thecybermentor)
- [@InsiderPhD - PhD student, occasional bug bounty hunter & educational cyber security youtuber](https://twitter.com/InsiderPhD)
- [@LiveOverflow - Content creator and hacker producing videos on various IT security topics and participating in hacking contests](https://twitter.com/LiveOverflow)
- [@EdOverflow - Web developer, security researcher and triager for numerous vulnerability disclosure programs](https://twitter.com/edoverflow)
- [@r0bre - Bug Hunter for web- and systemsecurity, iOS Security researcher](https://twitter.com/r0bre)
- [@intigriti - European ethical hacking & bug bounty platform](https://twitter.com/intigriti)
- [@Hacker0x01 - American bug bounty platform](https://twitter.com/Hacker0x01)
- [@bugcrowd - Another american bug bounty platform](https://twitter.com/Bugcrowd)
- [@hakluke - Bug bounty hunter, content creator, creator of some great pentesting tools like hakrawler](https://twitter.com/hakluke)
- [@spaceraccoon - Security researcher and white hat hacker. Has worked on several bug bounty programs](https://twitter.com/spaceraccoonsec)
- [@samwcyo - Full time bug bounty hunter](https://twitter.com/samwcyo)
- [@Th3G3nt3lman - Security Reasearch & Bug bounty hunter](https://twitter.com/Th3G3nt3lman)
- [@securinti - Dutch bug bounty hunter & head of hackers and bord member @ intigriti](https://twitter.com/securinti)
- [@jobertabma - Co-founder of HackerOne, security researcher](https://twitter.com/jobertabma)
- [@codingo_ - Global Head of Security Ops and Researcher Enablement bugcrowd, Maintainer of some great pentesting tools like NoSQLMap or VHostScan](https://twitter.com/codingo_)
- [@TomNomNom - security researcher, maintainer of many very useful pentesting tools](https://twitter.com/TomNomNom)
- [@orange_8361 - bug bounty hunter and security researcher, specialized on RCE bugs](https://twitter.com/orange_8361)
- [@d0nutptr - part-time bug hunter, Lead Security Engineer at graplsec](https://twitter.com/d0nutptr)
- [@filedescriptor - security researcher, bug hunter and content creator at 0xReconless](https://twitter.com/filedescriptor)
- [@0xReconless - Security research, blogs, and videos by filedescriptor, ngalongc & EdOverflow](https://twitter.com/0xReconless)
- [@pentest_swissky - Author of PayloadsAllTheThings & SSRFmap](https://twitter.com/pentest_swissky)
- [@GentilKiwi - Author of Mimikatz & Kekeo](https://twitter.com/gentilkiwi)

Courses:

Website Hacking Penetration Testing & Bug Bounty Hunting: https://mega.nz/folder/rLwGFBqL#fypM_Tl6_PqMLDllXPhdhw

Intro to Bug Bounty Hunting and Web Application Hacking:

These are one of the best resources ever, you can learn the most from blogs. You can view things from other people’s perspective and understand the real world scenarios. The best place to read blogs is Medium and for reports is hackerone hacktivity.

Free

• Hacker101
• Web Security Academy
• HackThisSite
• CTFChallenge
• Hacksplaining

Downloadables

• NahamSec.Training
• OWASP Juiceshop
• Google Gruyere
• DVWA

Premium

• Pentesterlab

• BugBountyHunter

Labs are great for getting a hands on experience, Portswigger web security is the best and the most vast resource for learning. But in a lab you know that its vulnerable and have some hints. So don’t entirely rely on the labs because the real website hunting is a complete different thing.

Now It’s Time That You’re Finally Ready To Hunt On Real Websites!

Most people get stuck in a constant loop of learning and don’t actually hunt on real websites, I did the same mistake but when I actually started Hunting I learned the most I could.

Types of Bug Bounty program:

• Only Hall of Fame
• Hall of Fame With Certificate of Appreciation
• HoF with Swags / only Swags
• Hall of Fame with Bounty
• Only Bounty

Bug Bounty Platforms:

Integriti: https://www.intigriti.com/

Bugcrowd: https://www.bugcrowd.com/

Hackerone: https://www.hackerone.com/

Synack: https://www.synack.com/

Japan Bug bounty Program: https://bugbounty.jp/

Cobalt: https://cobalt.io/

Zerocopter: https://zerocopter.com/

Hackenproof: https://hackenproof.com/

Report Writing/Bug Submission:

• Create a descriptive report.
• Follow responsible disclosure policy.
• Create POC and steps to reproduce

Sample format of the report:

• Vulnerability Name
• Vulnerability Description
• Vulnerable URL
• Payload
• Steps to Reproduce
• Impact
• Mitigation

Now I would suggest getting started with VDP’s where there is no reward but you get a hall of fame, because there is less competition in VDP’s than the BBP’s and comparatively easier to find bugs. Once you get enough confidence and experience you can switch to BBP. You can also find programs through google dorks:

• inurl:”bug bounty” and intext:”€” and inurl:/security
• intext:bounty inurl:/security
• intext:”BugBounty” and intext:”BTC” and intext:”reward“
• intext:”BugBounty” and inurl:”/bounty” and intext:”reward

Some Tips And Other Resources:

• Do not expect someone will spoon feed you everything.
• Never Give Up
• Never hunt for money
• If you don’t find anything don’t give up hope
• Have confidence
• https://gowsundar.gitbook.io/book-of-bugbounty-tips/
• https://book.hacktricks.xyz/

That’s It for this Blog, If you want to know about the best tools and methodology do let me know I will post it in next blog.

If this blog helped you in any way please consider following me.

You can also show some support from this:

Website: https://experience-hacking.gitbook.io/hackthebox/

Blog Website: https://experiencehacking.blogspot.com/