Getting Your First Bug (Part I)
In the name of Allah, the Compassionate, the Merciful
Assalamu Alaikum peace be upon you
Note
This is not a How To Get Started type of write up. I assume you already know the basics now struggling to get your first bug.
Introduction
I am Mehedi Hasan Remon, known as remonsec. I am a CSE student & doing bug bounties as part time to learn things practically. I am not a pro hunter or a smart guy, so you are free to escape my words.
Why you want to become a Bug Hunter ?
Well, Its so important. Before starting doing bug bounties, ask yourself why you want to do it. You want do it for only Money! Or you want to do it coz you are passionate with it! or what ? Why I mentioned that, the road map will be different as a bug hunter depending on your interest or aim. What I mean actually, if you want to do it for only money then the path is different if someone want to do it to learn more and feel passionate with it Today I am going to separate those paths and will be showing what type of approaches available.
Bug Bounty for Money !
Okay, Your aim is only money. You don’t care about the community, you don’t care about the platforms. You just want to do it, as you saw bug hunters are getting paid so high ! Fine, telling you the path then
Passive Bug Bounty
If only money is your intention then you can’t earn as a beginner by doing bug bounty actively. My words will make sense later on. just keep the idea on your mind. What I mean by passive bug bounty, you have to take it as a static workflow.
Passive Bug Bounty Methodology
Pick some non technical bug, keep looking for them on several less crowded programs. You don’t even have to read a single write up. Just collect the reproduce part from of those bugs. And try to reproduce them blindly on tons of programs. If you try them on 1000 programs at least 50 of them will reply you back with something interesting. Cool ha ! no technical work. just put your time and energy get paid!
Bug Bounty for learning & passion
Well, Here is the time for do some real hard work. If you want to learn by doing bug bounties and you feel like, oh man I am falling love with it. Then this is the path for you
Active Bug Bounty
So now you have to do bug bounty actively. You can’t just relay on non technical low hanging fruits. Even you can’t relay on publicly disclosed vulnerabilities only. You have to get your very own bugs also. Coz now this is the time you are doing kind of research things
Active Bug Bounty Methodology
First of all clear the basics. Like there a lot of things you have to cover. But you can’t do them in one shot or don’t have to. Pick one specific area and dig there then pick another part then another and so and so on. Now put things in a practical and visible way Pick one bug class, Use bug bounty programs as your target to practice. experiment with the knowledge you gained. when you think you are done then move on pick another bug class. so and so on
Give me a Break!
Hold on this write-up is going wrong ! you don’t feel its a regular write-up right! Didn’t showed anything practical. well till now I was just showing you kind of theatrical ideas. Now time to make hands dirty
Passive Approach
As you don’t have to do any faking work (sorry for using bad word) just pick an automated framework and keep putting programs.
Resources
Now shut up, pick those bugs and shooting them on tons of programs
Active Approach Well bro, have to do a lot of hard work. This journey will be so painful. All the best. Can’t wait more to see you hitting things harder.
Resource focused for Active Bug Bounties
End Note This is the part I, and I just discussed some of the mindset and non technical terms. In part II, I will be showing real world web application test cases. So you may get the proper idea where and what to look into !
Allah Hafiz Till that, Happy Hunting :)
wanna support my work! well just buy me a coffee
