Bug Bounty Hunting
Program Types
Private
Invite only, based on track record
Public
Open to all hackers
VDP
Vulnerability Disclosure Program - no rewards, just guidelines
BBP
Bug Bounty Program - rewards for valid findings
Finding Programs
Program Structure Checklist
Scope
In-scope domains, IPs, apps
Out of Scope
Excluded targets, vuln types
Rules of Engagement
Testing limitations
Rewards
Bounty amounts by severity
Response SLAs
Expected response times
Safe Harbor
Legal protection
Reporting Format
Required info in reports
Bug Report Structure
Title
[VulnType] in [Component] - [Impact]
CWE
Common Weakness Enumeration ID
CVSS
Severity score (use calculator)
Description
What the vuln is, where it exists
POC
Step-by-step reproduction
Impact
Business impact, what attacker can achieve
Remediation
Fix suggestion (optional)
CVSS 3.1 Calculator
https://www.first.org/cvss/calculator/3.1
Attack Vector (AV)
N (Network)
Remotely exploitable
A (Adjacent)
Same network required
L (Local)
Local access required
P (Physical)
Physical access required
Attack Complexity (AC)
L (Low)
No special conditions
H (High)
Special prep/info gathering needed
Privileges Required (PR)
N (None)
Unauth exploitation
L (Low)
Standard user privs
H (High)
Admin privs needed
User Interaction (UI)
N (None)
No user action needed
R (Required)
User must click/visit
Scope (S)
U (Unchanged)
Only affects vuln component
C (Changed)
Affects other components
CIA Impact
N (None)
No impact
L (Low)
Limited impact
H (High)
Total/serious impact
CVSS Score Examples
Critical (9.8) - RCE Unauth
High (8.8) - SQLi Auth Required
Medium (5.4) - CSRF
Medium (5.5) - Stored XSS (Admin Panel)
Low (3.5) - Reflected XSS
Common CWEs
CWE-79
XSS
CWE-89
SQL Injection
CWE-352
CSRF
CWE-502
Deserialization
CWE-918
SSRF
CWE-22
Path Traversal
CWE-78
OS Command Injection
CWE-287
Improper Authentication
CWE-639
IDOR
CWE-611
XXE
Report Title Examples
Good Report Examples (HackerOne)
Communication Rules
Wait for response
Spam triage team
Tag same team member
Use unofficial channels
Stay professional
Argue over severity
Reference program policy
Demand specific bounty
Use mediation if stuck
Disclose before resolution
Disagreement Process
Explain CVSS metric rationale
Reference program policy/scope
Request mediation (platform service)
Quick POC Templates
XSS POC
SQLi POC
CSRF POC
SSRF POC
Last updated