Bug Bounty Roadmap for Beginner’s

Hello, everyone! 👋

I’m Abhijeet Kumawat, a passionate security researcher 🕵️‍♂️.I am creating this repository for everyone to contribute as to guide the young and enthusiastic minds for starting their career in bug bounties. More content will be added regularly. Keep following. So let’s get started!

NOTE: The bug bounty landscape has changed since the last few years. The issues we used to find easily an year ago would not be easy now. Automation is being used rigorously and most of the “low hanging fruits” are being duplicated if you are out of luck. If you want to start doing bug bounty, you will have to be determined to be consistent and focused, as the competition is very high.

What is a bug?Security bug or vulnerability is “a weakness in the computational logic (e.g., code) found in software and hardware components that, when exploited, results in a negative impact to confidentiality, integrity, OR availability.What is Bug Bounty?A bug bounty or bug bounty program is IT jargon for a reward or bounty program given for finding and reporting a bug in a particular software product. Many IT companies offer bug bounties to drive product improvement and get more interaction from end users or clients. Companies that operate bug bounty programs may get hundreds of bug reports, including security bugs and security vulnerabilities, and many who report those bugs stand to receive awards.What is the Reward?There are all types of rewards based on the severity of the issue and the cost to fix. They may range from real money (most prevalent) to premium subscriptions (Prime/Netflix), discount coupons (for e commerce of shopping sites), gift vouchers, swags (apparels, badges, customized stationery, etc.). Money may range from 50$ to 50,000$ and even more.

ServersShodan — Search Engine for the Internet of EverythingCensys Search — Search Engine for every server on the Internet to reduce exposure and improve securityOnyphe.io — Cyber Defense Search Engine for open-source and cyber threat intelligence dataZoomEye — Global cyberspace mappingGreyNoise — The source for understanding internet noiseNatlas — Scaling Network ScanningNetlas.io — Discover, Research and Monitor any Assets Available OnlineFOFA — Cyberspace mappingQuake — Cyberspace surveying and mapping systemHunter — Internet Search Engines For Security Researchers

Exploit-DB — Exploit DatabaseSploitus — Convenient central place for identifying the newest exploitsRapid7 — DB — Vulnerability & Exploit DatabaseVulmon — Vulnerability and exploit search enginepacketstormsecurity.com — Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers0day.today — Ultimate database of exploits and vulnerabilitiesLOLBAS — Living Off The Land Binaries, Scripts and LibrariesGTFOBins — Curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systemsPayloads All The Things — A list of useful payloads and bypasses for Web Application SecurityXSS Payloads — The wonderland of JavaScript unexpected usages, and moreexploitalert.com — Database of ExploitsReverse Shell generator — Online Reverse Shell generator with Local Storage functionality, URI & Base64 Encoding, MSFVenom Generator, and Raw ModeHackerOne hacktivity — See the latest hacker activity on HackerOneBugcrowd Crowdstream — Showcase of accepted and disclosed submissions on Bugcrowd programsGTFOArgs — Curated list of Unix binaries that can be manipulated for argument injectionshell-storm.org/shellcode — Shellcodes database for study casesHacking the Cloud — Encyclopedia of the attacks/tactics/techniques that offensive security professionals can use on their next cloud exploitation adventureLOLDrivers — Open-source project that brings together vulnerable, malicious, and known malicious Windows driversPwnWiki — Collection of TTPs (tools, tactics, and procedures) for what to do after access has been gainedCVExploits Search — Your comprehensive database for CVE exploits from across the internetVARIoT — VARIoT IoT exploits databaseLOOBins — Detailed information on various built-in macOS binaries and how they can be used by threat actors for malicious purposesCoalition Exploit Scoring System — Model that dynamically scores new and existing vulnerabilities to reflect their exploit likelihoodWADComs — Interactive cheat sheet containing a curated list of offensive security tools and their respective commands to be used against Windows/AD environmentsLOLAPPS — Compendium of applications that can be used to carry out day-to-day exploitationLiving off the Hardware — Resource collection that provides guidance on identifying and utilizing malicious hardware and malicious devicesLiving Off the Pipeline — How development tools commonly used in CI/CD pipelines can be used to achieve arbitrary code execution

TitleThe first impression is the last impression, the security engineer looks at the title first and he should be able to identify the issue.Write about what kind of functionality you can able to abuse or what kind of protection you can bypass. Write in just one line.Include the Impact of the issue in the title if possible.DescriptionThis component provides details of the vulnerability, you can explain the vulnerability here, write about the paths, endpoints, error messages you got while testing. You can also attach HTTP requests, vulnerable source code.Steps to ReproduceWrite the stepwise process to recreate the bug. It is important for an app owner to be able to verify what you’ve found and understand the scenario.You must write each step clearly in-order to demonstrate the issue. that helps security engineers to triage fast.Proof of ConceptThis component is the visual of the whole work. You can record a demonstration video or attach screenshots.ImpactWrite about the real-life impact, How an attacker can take advantage if he/she successfully exploits the vulnerability.What type of possible damages could be done? (avoid writing about the theoretical impact)Should align with the business objective of the organization

Sample Report

Don’t do bug bounty as a full time in the beginning (although I suggest don’t do it full time at any point). There is no guarantee to get bugs every other day, there is no stability. Always keep multiple sources of income (bug bounty not being the primary).Stay updated, learning should never stop. Join twitter, follow good people, maintain the curiosity to learn something new every day. Read writeups, blogs and keep expanding your knowledge.Always see bug bounty as a medium to enhance your skills. Money will come only after you have the skills. Take money as a motivation only.Don’t be dependent on automation. You can’t expect a tool to generate money for you. Automation is everywhere. The key to success in Bug Bounty is to be unique. Build your own methodology, learn from others and apply on your own.Always try to escalate the severity of the bug, Keep a broader mindset. An RCE always has higher impact than arbitrary file upload.It’s not necessary that a vulnerability will be rewarded based on the industry defined standard impact. The asset owners rate the issue with a risk rating, often calculated as impact * likelyhood (exploitability). For example, an SQL Injection by default has a Critical impact, but if the application is accessible only inside the organization VPN and doesn’t contain any user data/PII in the database, the likelyhood of the exploitation is reduced, so does the risk.Stay connected to the community. Learn and contribute. There is always someone better than you in something. don’t miss an opportunity to network. Join forums, go to conferences and hacking events, meet people, learn from their experiences.Always be helpful.