> For the complete documentation index, see [llms.txt](https://experience-hacking.gitbook.io/hackthebox/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://experience-hacking.gitbook.io/hackthebox/bug-bounty/how-to-bug-bounty-in-2023-resources.md).

# How To Bug Bounty in 2023 (Resources)

Hello Everyone, In this Blog we are going to discuss how to get started in Bug Bounty Hunting from scratch, although I am also a beginner I am going to share my experience of what I have learned. What to do and what not to do.

*So Lets Begin!*

For those who don’t know,

## What is Bug Bounty ? <a href="#id-92cc" id="id-92cc"></a>

<figure><img src="https://miro.medium.com/v2/resize:fit:656/0*ZwZGevBfDuq8qlg-.png" alt="" height="394" width="700"><figcaption></figcaption></figure>

***Bug bounty*** is a reward program where people find and report security issues in websites and software to make them safer. They get ***paid*** for helping companies fix these problems before bad hackers can exploit them. It’s a win-win for everyone.

## How To Get Started ? <a href="#f275" id="f275"></a>

Start with the Basics! Yes I know you hear this everywhere and you probably want to just get into the fun stuff and start earning money, I wanted the same and didn’t learn the basics perfectly, And I struggled a lot due to it.

### What do I mean by Basics ? <a href="#id-3ae4" id="id-3ae4"></a>

If you don’t have any technical knowledge you need to start from the scratch as it is critical to have a solid understanding of how the internet and computer networks work.

You can start with ***HTTP Basics,*** In order to be able to learn what and how an application works, you need to be able to understand how you are communicating with it. Although don’t spend too much time into this as the basics are enough.

You can refer the following resources-:

<https://www.youtube.com/watch?v=iYM2zFP3Zn0>

[The Web In DepthHacker101 is a free class for web security. Whether you're a programmer with an interest in bug bounties or a seasoned…www.hacker101.com](https://www.hacker101.com/sessions/web_in_depth)[HTTP TutorialHTTP Tutorial - The Hypertext Transfer Protocol (HTTP) is an application-level protocol for distributed, collaborative…www.tutorialspoint.com](https://www.tutorialspoint.com/http/index.htm)

## Networking: <a href="#id-914e" id="id-914e"></a>

<figure><img src="https://miro.medium.com/v2/resize:fit:589/0*DLUDnvVfiliRhp0m.jpg" alt="" height="363" width="628"><figcaption></figcaption></figure>

In bug bounties, “recon” means gathering critical information about the target to find potential vulnerabilities and weaknesses before using automated tools to scan IPs and subdomains. Understanding its significance is essential for effective bug hunting.

**Some Good Resources:**

<https://www.youtube.com/playlist?list=PLDQaRcbiSnqF5U8ffMgZzS7fq1rHUI3Q8>

**TOTAL CompTIA A+ Certification (220–1002):**

[14.14 GB folder on MEGA262 files and 22 subfoldersmega.nz](https://mega.nz/folder/zSpnzKKD#UPhqD2NZBoM3ImhvMsx9qA)

**CompTIA Network+ Cert. (N10–007):**

[24.98 GB folder on MEGA371 files and 23 subfoldersmega.nz](https://mega.nz/folder/fC5njSyR#NMw88ZzRaYhDTSmYewodXA)

<https://www.udemy.com/course/free-ccna-200-301-network-fundamentals/>

**Linux Essentials For Hackers:**\
<https://mega.nz/folder/mSZm0ToD#eHVXlQEZqjvy7wtOjr6bsQ>

## Programming: <a href="#c76b" id="c76b"></a>

<figure><img src="https://miro.medium.com/v2/resize:fit:467/0*-oO24LkGt9e6xYX_.gif" alt="" height="277" width="498"><figcaption></figcaption></figure>

Many people say that you don’t need programming to start bug bounty, but I don’t agree with it, you should at least know the basics of programming languages to at least understand what is written. You can use codeacademy or youtube for just the basics.

For automation you can learn:

### 1.) Bash <a href="#id-07d0" id="id-07d0"></a>

[Learn Shell - Free Interactive Shell Tutoriallearnshell.org is a free interactive Shell tutorial for people who want to learn Shell, fast.www.learnshell.org](https://www.learnshell.org/)[explainshell.com - match command-line arguments to their help textmatch command-line arguments to their help textmatch command-line arguments to their help textexplainshell.com](https://explainshell.com/)

### 2.) Python <a href="#id-8f58" id="id-8f58"></a>

[The Python TutorialPython is an easy to learn, powerful programming language. It has efficient high-level data structures and a simple but…docs.python.org](https://docs.python.org/3/tutorial/)

### Now That We Are Done With The Basics Let’s Get To The FUN STUFF! <a href="#id-613e" id="id-613e"></a>

<figure><img src="https://miro.medium.com/v2/resize:fit:600/0*seammDPZZsLQnRRY.gif" alt="" height="640" width="640"><figcaption></figcaption></figure>

## Bug Bounty <a href="#a831" id="a831"></a>

First You will need to choose your path

* Web Pentesting
* Android Application Pentesting
* IOS Application Pentesting

Of course you can do all of them but as a beginner I think you should start with one of them.

Now to learn Web Pentesting you need to learn about the various attacks and practice them.

I would not suggest buying paid course until you get your first bounty, as there is more than enough resources online for free. Here Are some of them:

**My Process of Learning For Bug Bounty:**

1. Reading the theory and understand

2\. Watching videos in Youtube or other platforms

3\. Reading Blogs and Hackerone reports

4\. Practicing Labs

5\. Hunting On Real Websites

## Some Books For Bug Bounty: <a href="#f1b6" id="f1b6"></a>

* Web app hackers handbook
* Web hacking 101
* Mastering modern web pen testing
* Bug Bounty Playbook
* Real-World Bug Hunting
* OWASP Testing Guide

You can find these books online easily and is a great resource to learn.

## Media Resources: <a href="#id-157f" id="id-157f"></a>

Youtube is a great resource for learning and there are a lots of creators out there with amazing content you can find them at <https://securitycreators.video/>

```
- [IppSec Channel - Hack The Box Writeups](https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA)
- [LiveOverflow - Explore weird machines...](https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w)
- [GynvaelEN - Podcasts about CTFs, computer security, programing and similar things.](https://www.youtube.com/channel/UCCkVMojdBWS-JtH7TliWkVg)
- [John Hammond - Wargames and CTF writeups](https://www.youtube.com/channel/UCVeW9qkBjo3zosnqUbG7CFw)
- [Murmus CTF - Weekly live streamings](https://www.youtube.com/channel/UCUB9vOGEUpw7IKJRoR4PK-A)
- [PwnFunction](https://www.youtube.com/channel/UCW6MNdOsqv2E9AjQkv9we7A)
- [OJ Reeves](https://www.youtube.com/channel/UCz2aqRQWMhJ4wcJq3XneqRg)
- [Hacksplained - A Beginner Friendly Guide to Hacking](https://www.youtube.com/c/hacksplained)
- [STÖK](https://www.youtube.com/c/STOKfredrik)
- [Defcon](https://www.youtube.com/user/DEFCONConference)
- [Hackersploit](https://www.youtube.com/channel/UC0ZTPkdxlAKf-V33tqXwi3Q)
- [The Cyber Mentor](https://www.youtube.com/channel/UC0ArlFuFYMpEewyRBzdLHiw)
- [Nahamsec](https://www.youtube.com/c/Nahamsec)
- [Hackerone](https://www.youtube.com/channel/UCsgzmECky2Q9lQMWzDwMhYw)
- [The Hated one](https://www.youtube.com/channel/UCjr2bPAyPV7t35MvcgT3W8Q)
- [stacksmashing / Ghidra Ninja](https://www.youtube.com/channel/UC3S8vxwRfqLBdIhgRlDRVzw)
- [Hak5](https://www.youtube.com/channel/UC3s0BtrBJpwNDaflRSoiieQ)
```

### Twitter <a href="#id-2724" id="id-2724"></a>

Twitter is very common in the InfoSec area. Many advices and tips on bug hunting or CTF games are posted every day. It is worth following the feeds of some successful security researchers and hackers.

```
- [@Stö6B - Bug bounty hunter, cybersecurity educational content creator](https://twitter.com/stokfredrik)
- [@NahamSec - Hacker & content creator & co-founder bugbountyforum and http://recon.dev](https://twitter.com/NahamSec)
- [@dawgyg - Bug bounty hunter, reformed blackhat, Synack red team member](https://twitter.com/thedawgyg)
- [@putsi - Bug bounty hunter and white hat hacker in Team ROT](https://twitter.com/putsi)
- [@thecybermentor - Offers cybersecurity and hacking courses](https://twitter.com/thecybermentor)
- [@InsiderPhD - PhD student, occasional bug bounty hunter & educational cyber security youtuber](https://twitter.com/InsiderPhD)
- [@LiveOverflow - Content creator and hacker producing videos on various IT security topics and participating in hacking contests](https://twitter.com/LiveOverflow)
- [@EdOverflow - Web developer, security researcher and triager for numerous vulnerability disclosure programs](https://twitter.com/edoverflow)
- [@r0bre - Bug Hunter for web- and systemsecurity, iOS Security researcher](https://twitter.com/r0bre)
- [@intigriti - European ethical hacking & bug bounty platform](https://twitter.com/intigriti)
- [@Hacker0x01 - American bug bounty platform](https://twitter.com/Hacker0x01)
- [@bugcrowd - Another american bug bounty platform](https://twitter.com/Bugcrowd)
- [@hakluke - Bug bounty hunter, content creator, creator of some great pentesting tools like hakrawler](https://twitter.com/hakluke)
- [@spaceraccoon - Security researcher and white hat hacker. Has worked on several bug bounty programs](https://twitter.com/spaceraccoonsec)
- [@samwcyo - Full time bug bounty hunter](https://twitter.com/samwcyo)
- [@Th3G3nt3lman - Security Reasearch & Bug bounty hunter](https://twitter.com/Th3G3nt3lman)
- [@securinti - Dutch bug bounty hunter & head of hackers and bord member @ intigriti](https://twitter.com/securinti)
- [@jobertabma - Co-founder of HackerOne, security researcher](https://twitter.com/jobertabma)
- [@codingo_ - Global Head of Security Ops and Researcher Enablement bugcrowd, Maintainer of some great pentesting tools like NoSQLMap or VHostScan](https://twitter.com/codingo_)
- [@TomNomNom - security researcher, maintainer of many very useful pentesting tools](https://twitter.com/TomNomNom)
- [@orange_8361 - bug bounty hunter and security researcher, specialized on RCE bugs](https://twitter.com/orange_8361)
- [@d0nutptr - part-time bug hunter, Lead Security Engineer at graplsec](https://twitter.com/d0nutptr)
- [@filedescriptor - security researcher, bug hunter and content creator at 0xReconless](https://twitter.com/filedescriptor)
- [@0xReconless - Security research, blogs, and videos by filedescriptor, ngalongc & EdOverflow](https://twitter.com/0xReconless)
- [@pentest_swissky - Author of PayloadsAllTheThings & SSRFmap](https://twitter.com/pentest_swissky)
- [@GentilKiwi - Author of Mimikatz & Kekeo](https://twitter.com/gentilkiwi)
```

### Courses: <a href="#c5e8" id="c5e8"></a>

**Website Hacking Penetration Testing & Bug Bounty Hunting:** <https://mega.nz/folder/rLwGFBqL#fypM_Tl6_PqMLDllXPhdhw>

**Intro to Bug Bounty Hunting and Web Application Hacking:**

[2.87 GB folder on MEGA196 files and 18 subfoldersmega.nz](https://mega.nz/folder/HD5kFLIb#0GL5H-vCZ97egfYQDgGHOg)

## Blogs & Writeups: <a href="#id-35c3" id="id-35c3"></a>

These are one of the best resources ever, you can learn the most from blogs. You can view things from other people’s perspective and understand the real world scenarios. The best place to read blogs is Medium and for reports is hackerone hacktivity.

[InfoSec Write-upsA collection of write-ups from the best hackers in the world on topics ranging from bug bounties and CTFs to vulnhub…infosecwriteups.com](https://infosecwriteups.com/)[HackerOneEdit descriptionhackerone.com](https://hackerone.com/hacktivity/overview)[Managed bug bounty programs, a better approach to securityBugcrowd's bug bounty and vulnerability disclosure platform connects the global security researcher community with your…bugcrowd.com](https://bugcrowd.com/crowdstream)[The Daily SwigWeb security news about attacks, defense, and vulnerabilities affecting companies, users, researchers, governments…portswigger.net](https://portswigger.net/daily-swig)

## Labs: <a href="#id-840c" id="id-840c"></a>

### Free <a href="#e7e8" id="e7e8"></a>

* [Hacker101](https://www.hacker101.com/)
* [Web Security Academ](https://portswigger.net/web-security)y
* [HackThisSite](https://hackthissite.org/)
* [CTFChallenge](https://ctfchallenge.co.uk/)
* [Hacksplaining](https://www.hacksplaining.com/)

### Downloadables <a href="#id-4f7e" id="id-4f7e"></a>

* [NahamSec.Training](https://github.com/nahamsec/nahamsec.training/)
* [OWASP Juiceshop](https://owasp.org/www-project-juice-shop/)
* [Google Gruyere](https://google-gruyere.appspot.com/)
* [DVWA](http://www.dvwa.co.uk/)

### Premium <a href="#id-544f" id="id-544f"></a>

* [Pentesterlab](https://pentesterlab.com/referral/olaL4k8btE8wqA)

[PentesterLab: PentesterLab ProWe've been teaching web security for years and have put together many well thought-out exercises to get you from zero…pentesterlab.com](https://pentesterlab.com/pro)

* [BugBountyHunter](https://www.bugbountyhunter.com/)

[Become a bug bounty hunter - Learn about web application vulnerabilities and how to find them on…BugBountyHunter is a training platform created by bug bounty hunter zseano designed to help you learn all about web…www.bugbountyhunter.com](https://www.bugbountyhunter.com/)

Labs are great for getting a hands on experience, Portswigger web security is the best and the most vast resource for learning. But in a lab you know that its vulnerable and have some hints. So don’t entirely rely on the labs because the real website hunting is a complete different thing.

### Now It’s Time That You’re Finally Ready To Hunt On Real Websites! <a href="#id-2b68" id="id-2b68"></a>

Most people get stuck in a constant loop of learning and don’t actually hunt on real websites, I did the same mistake but when I actually started Hunting I learned the most I could.

### Types of Bug Bounty program: <a href="#dfe6" id="dfe6"></a>

* Only Hall of Fame
* Hall of Fame With Certificate of Appreciation
* HoF with Swags / only Swags
* Hall of Fame with Bounty
* Only Bounty

### Bug Bounty Platforms: <a href="#id-14ad" id="id-14ad"></a>

**Integriti:** <https://www.intigriti.com/>

**Bugcrowd:** <https://www.bugcrowd.com/>

**Hackerone:** <https://www.hackerone.com/>

**Synack:** <https://www.synack.com/>

**Japan Bug bounty Program:** <https://bugbounty.jp/>

**Cobalt:** <https://cobalt.io/>

**Zerocopter:** <https://zerocopter.com/>

**Hackenproof:** <https://hackenproof.com/>

### Report Writing/Bug Submission: <a href="#id-917b" id="id-917b"></a>

* Create a descriptive report.
* Follow responsible disclosure policy.
* Create POC and steps to reproduce

### Sample format of the report: <a href="#b66c" id="b66c"></a>

* Vulnerability Name
* Vulnerability Description
* Vulnerable URL
* Payload
* Steps to Reproduce
* Impact
* Mitigation

Now I would suggest getting started with VDP’s where there is no reward but you get a hall of fame, because there is less competition in VDP’s than the BBP’s and comparatively easier to find bugs. Once you get enough confidence and experience you can switch to BBP. You can also find programs through google dorks:

* inurl:”bug bounty” and intext:”€” and inurl:/security
* intext:bounty inurl:/security
* intext:”BugBounty” and intext:”BTC” and intext:”reward“
* intext:”BugBounty” and inurl:”/bounty” and intext:”reward

### Some Tips And Other Resources: <a href="#d0b4" id="d0b4"></a>

* Do not expect someone will spoon feed you everything.
* Never Give Up
* Never hunt for money
* If you don’t find anything don’t give up hope
* Have confidence
* <https://gowsundar.gitbook.io/book-of-bugbounty-tips/>
* <https://book.hacktricks.xyz/>

That’s It for this Blog, If you want to know about the best tools and methodology do let me know I will post it in next blog.

If this blog helped you in any way please consider following me.

Website: <https://experience-hacking.gitbook.io/hackthebox/>

Blog Website: <https://experiencehacking.blogspot.com/>