Bug Bounty Hunting

Program Types

Type

Description

Private

Invite only, based on track record

Public

Open to all hackers

VDP

Vulnerability Disclosure Program - no rewards, just guidelines

BBP

Bug Bounty Program - rewards for valid findings

Finding Programs

Program Structure Checklist

Element

Check

Scope

In-scope domains, IPs, apps

Out of Scope

Excluded targets, vuln types

Rules of Engagement

Testing limitations

Rewards

Bounty amounts by severity

Response SLAs

Expected response times

Safe Harbor

Legal protection

Reporting Format

Required info in reports

Bug Report Structure

Section

Content

Title

[VulnType] in [Component] - [Impact]

CWE

Common Weakness Enumeration ID

CVSS

Severity score (use calculator)

Description

What the vuln is, where it exists

POC

Step-by-step reproduction

Impact

Business impact, what attacker can achieve

Remediation

Fix suggestion (optional)

CVSS 3.1 Calculator

https://www.first.org/cvss/calculator/3.1

Attack Vector (AV)

Value

Meaning

N (Network)

Remotely exploitable

A (Adjacent)

Same network required

L (Local)

Local access required

P (Physical)

Physical access required

Attack Complexity (AC)

Value

Meaning

L (Low)

No special conditions

H (High)

Special prep/info gathering needed

Privileges Required (PR)

Value

Meaning

N (None)

Unauth exploitation

L (Low)

Standard user privs

H (High)

Admin privs needed

User Interaction (UI)

Value

Meaning

N (None)

No user action needed

R (Required)

User must click/visit

Scope (S)

Value

Meaning

U (Unchanged)

Only affects vuln component

C (Changed)

Affects other components

CIA Impact

Value

C/I/A Impact

N (None)

No impact

L (Low)

Limited impact

H (High)

Total/serious impact

CVSS Score Examples

Critical (9.8) - RCE Unauth

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

High (8.8) - SQLi Auth Required

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Medium (5.4) - CSRF

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Medium (5.5) - Stored XSS (Admin Panel)

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Low (3.5) - Reflected XSS

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Common CWEs

CWE

Vulnerability

CWE-79

XSS

CWE-89

SQL Injection

CWE-352

CSRF

CWE-502

Deserialization

CWE-918

SSRF

CWE-22

Path Traversal

CWE-78

OS Command Injection

CWE-287

Improper Authentication

CWE-639

IDOR

CWE-611

XXE

Report Title Examples

Stored XSS in Profile Bio leads to Account Takeover
SQLi in Search Parameter allows Database Dump  
SSRF in PDF Generator exposes Internal Services
IDOR in /api/users/{id} exposes PII of all users
CSRF in Password Change lacks Token Validation

Good Report Examples (HackerOne)

Communication Rules

Don't

Wait for response

Spam triage team

Tag same team member

Use unofficial channels

Stay professional

Argue over severity

Reference program policy

Demand specific bounty

Use mediation if stuck

Disclose before resolution

Disagreement Process

Explain CVSS metric rationale
Reference program policy/scope
Request mediation (platform service)

Quick POC Templates

XSS POC

1. Navigate to http://target.com/profile
2. In "Bio" field, enter: `"><script>alert(document.cookie)</script>`
3. Save profile
4. View profile → alert fires

SQLi POC

1. Navigate to http://target.com/search
2. In search field, enter: `' OR 1=1--`
3. All records returned (expected: none)
4. Enter: `' UNION SELECT username,password FROM users--`
5. Credentials dumped

CSRF POC

<html>
<body onload="document.forms[0].submit()">
<form action="http://target.com/change-email" method="POST">
  <input name="email" value="[email protected]">
</form>
</body>
</html>

SSRF POC

1. Navigate to http://target.com/fetch-url
2. Enter URL: `http://169.254.169.254/latest/meta-data/`
3. AWS metadata returned

PreviousBroken Authentication NextMass Assignment

Last updated 4 days ago

hashtagProgram Types

hashtagFinding Programs

hashtagProgram Structure Checklist

hashtagBug Report Structure

hashtagCVSS 3.1 Calculator

hashtagAttack Vector (AV)

hashtagAttack Complexity (AC)

hashtagPrivileges Required (PR)

hashtagUser Interaction (UI)

hashtagScope (S)

hashtagCIA Impact

hashtagCVSS Score Examples

hashtagCritical (9.8) - RCE Unauth

hashtagHigh (8.8) - SQLi Auth Required

hashtagMedium (5.4) - CSRF

hashtagMedium (5.5) - Stored XSS (Admin Panel)

hashtagLow (3.5) - Reflected XSS

hashtagCommon CWEs

hashtagReport Title Examples

hashtagGood Report Examples (HackerOne)

hashtagCommunication Rules

hashtagDisagreement Process

hashtagQuick POC Templates

hashtagXSS POC

hashtagSQLi POC

hashtagCSRF POC

hashtagSSRF POC

Program Types

Finding Programs

Program Structure Checklist

Bug Report Structure

CVSS 3.1 Calculator

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

CIA Impact

CVSS Score Examples

Critical (9.8) - RCE Unauth

High (8.8) - SQLi Auth Required

Medium (5.4) - CSRF

Medium (5.5) - Stored XSS (Admin Panel)

Low (3.5) - Reflected XSS

Common CWEs

Report Title Examples

Good Report Examples (HackerOne)

Communication Rules

Disagreement Process

Quick POC Templates

XSS POC

SQLi POC

CSRF POC

SSRF POC