How to Get Into Bug Bounties
By: Vickie Li
Tags: Hacking, Cybersecurity, Bug Bounty, Programming, Technology

How to Get Into Bug Bounties

Your guide to hacking and earning on bug bounty programs

Photo by NeONBRAND on Unsplash

Bug bounties are a great way to gain experience in cybersecurity and earn some extra bucks.

But it is also getting a lot more competitive recently. As more people are discovering bug bounties and getting involved in it, it has become increasingly difficult for beginners to get started.

Here are some tips that would make it easier for you to find your first bug.

How to Pick a Program

There are two places where bug bounty programs can be found. One of them is on bug bounty platforms. These are platforms on which many different companies host their programs, and hackers are awards points and money for their results. Some of the largest platforms are HackerOne and Bugcrowd.

Another one is the organization’s own website. A lot of companies host their own bug bounty programs instead of using a bug bounty platform. Companies like Google, Facebook, and Medium take this approach.

Public versus private

On bug bounty platforms, there is a distinction between “public” and “private” programs.

Public programs are programs that are open to the public: anyone can hack and submit bugs to the program, as long as they abide by the laws and the bug bounty contract.

On the other hand, private programs are only open to invited hackers. Only a few select hackers are able to hack the company and submit bugs to it.

Picking a program

When you are first starting out, it is important to pick a program that you can succeed in from the very start.

Bug bounty depends a lot on experience, so it’s a good idea to pick a program that is passed over by more experienced bug hunters to avoid competition. There are two ways of finding these underpopulated programs: look for unpaid programs or go for programs with big scopes.

When you haven’t developed an intuition for bug hunting, you often have to rely on “low hanging fruits” and well-known techniques for finding bugs. This means that many other hackers would be able to find the same bugs much faster than you. This is why it’s a good idea to go for unpaid programs first. Unpaid programs are often ignored by experience bug hunters since they don’t pay money. But they still earn you points and recognition! And that recognition might just be what you need to get an invite to a private, paid program.

A program with a large scope is also a good place to start. Scope refers to the number of target applications and webpages. When a program has a large scope, you can often find obscure applications in the scope that are overlooked by other hackers. These applications are a lot easier to find bugs in.

In addition, prioritize programs with fast response time. When you first start out, you are going to make a lot of mistakes. You might misjudge the severity of a bug, write an unclear report or make technical mistakes in the report. Rapid feedback from program managers will help you improve, and turn you into a competent hacker faster.

Getting private invites

Hurrah! You’ve got an invite!

Getting private invites on bug bounty platforms is not difficult once you’ve found a couple of bugs. Different platforms will have different algorithms to determine who get the invites, but here are some general guidelines to stick to:

Submit bugs to public programs first. In order to get private invites, you often need “points” or “reputation” on a platform. The only way to gain these is to submit a few valid bugs to public programs first.

Don’t spam. Spamming and submitting non-issues often causes a decrease in points or reputations. Most bug bounty platforms limit private invites to hackers with points above a certain threshold.

Be polite and courteous. Being rude or abusive to program managers will probably get you banned from the program as well as prevent you from getting private invites.

On some bug bounty platforms, like HackerOne, you can also get private invites by completing tutorials or solving CTF challenges.

Private programs are a lot less crowded than public ones and it would become much easier to find bugs once you start hacking on private programs.

How to Find your First Bug

Now that you’ve decided on the program you are going to work on, it’s time to find some bugs!

All bug hunters have types of vulnerabilities that they specialize in. Usually, they start out looking for everything and eventually settle into something that they are particularly good at. So before you find your niche, it’s a good idea to try to look for everything.

The bug classes that are the easiest to find are:

Cross-Site Scripting (XSS),

Insecure Direct Object Reference (IDOR),

Cross-Site Request Forgery (CSRF),

Race Conditions,

Information Disclosure.

There are, of course, more classes of vulnerabilities that you could look for, but these are the simplest to get started with. Try looking for these bugs and see if any of them comes naturally to you, or if you prefer looking for some of them over the others. And before you know it, you’ve become an XSS specialist.

You can find tutorials on how to find these bugs in some of my previous posts:

Note: Do not look for all of the bug classes all at once! Focus on one at a time only, so you can get familiar with the methodology of looking for a certain type of bug.

How to Write your First Report

Have you spotted your first bug? Great, it’s time to write your first bug report.

When I first started writing reports, I would spend a lot of time answering questions from the program’s engineers because I was not clear on something, or I did not provide enough details for them to reproduce the report. Be sure to put some effort into writing a bug report because this will save you a lot of time down the road and can potentially increase your bounty amount.

Here’s a guide to writing a good bug report:

A note on Dupes and Informatives

It’s very normal to get a ton of duplicates and informatives when you first start out. So don’t get discouraged by them!

Remember that dupes and informatives mean one thing: that you were technically correct! It’s just that someone has found the bug before you, or that the company is accepting the risk at this time.

They by no means dismiss the quality of your work. Even if you don’t earn money or reputation, you still gained experience from the learning opportunity.

Just keep going and you will develop your own unique methodology and start finding unique, valuable bugs!

Lastly, a few words of Experience

It’s difficult. It really is. When I first started hunting for bugs, I would go weeks or even months without finding a bug. And when I do find a bug, it would be something trivial and low severity.

The key to getting better at finding vulnerabilities is practice. If you are willing to put in the time and effort, your bug hunting skills will improve and you will soon see yourself on leaderboards and private invite lists!

If you ever get frustrated during this process, remember that everything will get easier after you find your first bug and get your first private invite. Good luck! And reach out to the community if you need any help.