How to start Bug Hunting?

-

1. First of all, you need to understand what is Bug Bounty and why it is done?

 A bug bounty program is a deal offered by many websites and software developers by which individuals can receive recognition and compensation for reporting bugs, especially those about exploits and vulnerabilities.
2.Some Books online books for Bug Bounty!!!

 There are some books for Web application penetration testing methodology and hunting the web. Through this, you learn the basics and essentials of penetration testing and bug hunting.
  1. The Web Application Hacker’s Handbook
  2. OWASP Testing Guide
  3. Highly suggested by Bugcrowd’s Jason Haddix
  4. Penetration Testing
  5. The Hacker Playbook 2: Practical Guide to Penetration Testing
  6. The Tangled Web: A Guide to Securing Web Applications
  7. Jhaddix Bug Hunting Methodology
  8. The Hacker Playbook-3
  9. Ethical Hacking and Penetration Guide
  10. Web Penetration Testing with Kali Linux
Here are some mobile application for Bug Hunting


  1. The Mobile Application Hacker’s Handbook
  2. iOS Application Security
  3. Owasp Mobile AppSec

3. Practice makes Perfect!

While you’re learning it’s important to make sure that you’re also understanding and retaining what you learn. Practicing on vulnerable applications and systems is a great way to test your skills in simulated environments. 

 Some website provides you real websites to practice your skills!!
  1. BWAPP
  2. Webgoat
  3. Rootme
  4. OWASP Juicy Shop
  5. Hacker101
  6. Hacksplaining
  7. Penetration Testing Practice Labs
  8. Damn Vulnerable iOS App (DVIA)
  9. Mutillidae
  10. Trytohack
  11. HackTheBox
  12. SQL Injection Practice
4. Read tech Vulnerabilities POCs (Proof of Concepts) and write-ups from other hackers

Now that you’ve got a baseline understanding of how to find and exploit security vulnerabilities, it’s time to start checking out what other hackers are finding in the wild. Luckily the security community is quite generous with sharing knowledge and we’ve collected a list of write-ups & tutorials:
  1. Bug Bounty write-ups and POC
  2. Awesome Bug Bounty
  3. SecurityBreached-BugBounty POC
  4. Facebook Hunting POC
  5. Bug Hunting Tutorials
  6. PentesterLand Bug Bounty Writeups
  7. Hackerone POC Reports
  8. Bug Bounty POC
  9. Netsec on Reddit
  10. Bug Bounty World


5. Some youtube channels for making concepts clear for you!!
  1. JackkTutorials on YouTube
  2. DEFCON Conference videos on YouTube
  3. Hak5 on YouTube
  4. How To Shot Web — Jason Haddix, 2015
  5. Bug Bounty Hunting Methodology v2 — Jason Haddix, 2017
  6. Hunting for Top Bounties — Nicolas Grégoire, 2014
  7. The Secret Life of a Bug Bounty Hunter — Frans Rosén, 2016
  8. Finding Bugs with Burp Plugins & Bug Bounty 101 — Bugcrowd, 2014
  9. How to hack all the bug bounty things automagically reap the rewards profit — Mike Baker, 2016
  10. SecurityIdiots
  11. BlackHat
  12. Injector PCA
  13. DevilKiller
  14. SulemanMalik
  15. Penetration Testing in Linux
6. Web Vulnerability Scanners Tools for Bug Bounty!!
  1. Netsparker Application Security Scanner — Application security scanner to automatically find security flaws.
  2. Nikto — Noisy but fast black box web server and web application vulnerability scanner.
  3. Arachni — Scriptable framework for evaluating the security of web applications.
  4. w3af — Web application attack and audit framework.
  5. Wapiti — Black box web application vulnerability scanner with built-in fuzzer.
  6. SecApps — In-browser web application security testing suite.
  7. WebReaver — Commercial, graphical web application vulnerability scanner designed for macOS.
  8. WPScan — Black box WordPress vulnerability scanner.
  9. Zoom — Powerful WordPress username enumerator with infinite scanning.
  10. cms-explorer — Reveal the specific modules, plugins, components, and themes that various websites powered by content management systems are running.
  11. joomscan — Joomla vulnerability scanner.
  12. ACSTIS — Automated client-side template injection (sandbox escape/bypass) detection for AngularJS.
  13. SQLmate — A friend of sqlmap that identifies sqli vulnerabilities based on a given dork and website (optional).

Comments

Post a Comment

Popular posts from this blog

Some Dark web Links

-
Image
Here are some of the Forum/Website to visit on dark web related to cybersecurity and hacking. Before visiting this website please follow the steps to be safe on the dark web/ Deepweb. Security Steps to be taken before opening the links: First of All, To browse these dark web forums, first close all active programs and applications in your computer then start Your NordVPN or any Paid and HQ VPN that have TOR service and select Onion Over VPN Server.  Now start Tor Browser and disable Javascript. In this way, you have created a completely secure and untraceable environment for you. If you think Tor Browser gives you full anonymity then you are wrong.  Only premium VPN services can provide you fully secure and untraceable environment. I have tried my hands on many premium VPN services, and I found NordVPN beats its competitor in all features. Disclaimer ⚠ : This info are shared for educational purpose only, neither the website nor creator hold any info or liabl...
Read more

How to join Cyber Cell or Cyber Crime Department in India || Exam or Direct or Skills???

-
Image
 How to join Cyber Cell or Cyber Crime Department in India || Exam or Direct or Skills??? Hello Guys, today's topic is How to join Cyber Cell in India. All of us has dreamed of joining the cybercrime department and working as an officer for the nation. Some of us have tried to search it on the internet asked our colleagues and friends relatives but somewhere we are not able to find the correct and satisfying answer o our question. Don't worry today Career Technology is going help you out to find all your questions answered in a single post. Welcome Everyone :)  Let's get started  HOW TO JOIN CYBER CELL THROUGH EXAM?? In the cyber cell department, there is no specific exam to join the cyber cell. Now What if there is no exam for cyber cell??? You can join cyber cell by applying for the exam of CBI or IB and then after getting selected for this you can apply for the cyber cell. HOW TO JOIN CBI OR IB?? Firstly you need to apply for this post to join cyber cell and to join C...
Read more

ATM HACKING TOOL TRENDING ON DARK WEB

-
Image
ATM HACKING TOOL TRENDING ON DARK WEB Latest hacking tools and devices have a great sale on the dark web, an ATM can be hacked within 15 to 20 minutes by any amateur person too. The one should know basics of it before buying such things, cybersecurity startup knowledge. The person who discovers this is CloudSEK Rakesh Krishnan says "The seller on the dark web has latyest ready-made tools such has malware cards, USB ATM Malware and many more such tools to dispense money from the ATM". HE also said that "Earlier, though these were slightly complicated, now with these devices, anybody can control these machines,” . WHAT HE DISCOVERED? HE talked to the seller as a buyer to many online shops and One of the shops offered him  ATM Malware Card, PIN Descriptor, Trigger Card and an instruction guide which tells how to suspend the cash from the machine. Once installed, it captures all card details stealthily. The amount can be withdrawn using Trigger Card, that d...
Read more