Open in app

Sign in

Write

Sign in

Getting Started With Bug Bounty Hunting in 2022 | Shubham

Subh Dhungana
8 min readOct 17, 2021

--

If you were just wondering by seeing the bug bounty stories and posts of facebook friends and always wanted to get started with this bug bounty but never knew how to do it, then today I’ll give you the resources that I’ve accumulated so far. You may be wondering how I’ll get started with bug bounty because I don’t know anything about hacking.

DON’T WORRY TODAY I’LL SHOW YOU THE WAY TO GET STARTED WITH BUG BOUNTY HUNTING

Beginner’s Resources To Bug Hunting

In first step, I’ll give you all the resources that I’ve accumulated so far with links. My advice for you is to learn from those resources in a daily basis consistently for few months. You will find all the important learnings related to bug bounty hunting and other cyber security research learnings within it prepared by great infosec writers and hackers.

My Bug Hunting & Hacking Resources

1.1.1 Youtube Channels To Learn

(Links and points may be repeated and in unordered list because these are directly copied and pasted from my notes. Sorry for that.)

1.1.2 Websites To Learn

(Links and points may be repeated and in unordered list because these are directly copied and pasted from my notes. Sorry for that.)

https://securib.ee/beelog/the-best-bug-bounty-recon-methodology/

  1. https://thehackerish.com/category/hacking/bug-bounty/
  2. https://www.hacker101.com/

1.1.3 Hackers & Bug Bounty Hunter’s Twitter Account To Learn

1.1.4 Bug Bounty Vocabularies

This is one of the most important aspect of learning. You need to first know the vocabulary. I’ve listed the vocabularies of hacking and bug bounty hunting. You can search each word on youtube and google and learn about it. There are enough vocabularies here to learn. Just search the given word from youtube and google.

(Links and points may be repeated and in unordered list because these are directly copied and pasted from my notes. Sorry for that.)

  • OWASP TOP 10 Vulnerabilities
  1. Injection
  2. Broken authentication
  3. Sensitive data exposure
  4. XML external entities (XXE)
  5. Broken access control
  6. Security misconfigurations
  7. Cross-site scripting (XSS)
  8. Insecure deserialization
  9. Using components with known vulnerabilities
  10. Insufficient logging and monitoring
  • Cross-Site Request Forgery
  • Browser Vulnerabilities Name
  • Browser Hack Bug bounty
  • Websocket vulnerability
  • Cross-origin resource sharing (CORS)
  • Web Storage vulnerability
  • Geolocation
  • XML Vulnerability
  • HTMl Vulnerability
  • CSS Vulnerability
  • Web Storage Vulnerability
  • Webkit Vulnerability,
  • Trident Vulnerability
  • Document Object Model (DOM) Vulnerability
  • VB Script Vulnerability
  • JS files vulnerability
  • WebRTC Api vulnerability
  • Same Origin Policy (SOP)
  • Bypassing Same Origin Policy (SOP)
  • Exploitation of SOP Bypass
  • SOP with the DOM bug bounty
  • SOP with CORS bug bounty
  • SOP with plugins vulnerability or bug bounty
  • SOP with UI redressing
  • SOP with Browser History
  • SOP Bypasses
  • Bypassing SOP in Java
  • Bypassing SOP in Internet Explorer, Safari, Fireforx, Opera, Adobe reader, Silverlight, Adobe Flash, Cloud Storage, CORS
  • Exploiting UI Redressing Attacks by
  • Using Clickjacking
  • Using Filejacking
  • Using Drag and Drop
  • Exploiting Browser History by
  • Using CSS Colors
  • Using Cache Timing
  • Using Browser APIs
  • Attacking Extension
  • Fingerprinting using
  • Fingerprinting using HTTP Headers
  • Fingerprinting using DOM
  • Lastpass fingerprinting
  • Fingerprinting using the manifest
  • Bypassing Web Application CSP
  • Fireforx RCE
  • OS Command Execution
  • Attacking DOM Event Handlers
  • Attacking Drag and Drop
  • Broken Access Control
  • Insecure Direct Request Forgery (IDOR)
  • Local File Disclosure (LFD)
  • SQL Injection
  • Business Logic Flaws
  • XXE
  • Template Injections
  • Cross Site Scripting
  • Server Side Request Forgery (SSRF)
  • XML External Entity (XXE)
  • OS Command Injection
  • Open Redirect
  • Subdomain Takeover
  • Remote Command Execution (RCE)
  • Testing File Uploaders
  • Clickjacking
  • XXE Vulnerability
  • File Upload Vulnerabilities
  • Local File Inclusion vulnerabilities
  • Remote File Inclusion Vulnerabilities
  • Broken Access Control
  • Subdomain Takeover
  • Business Logic Vulnerability
  • Click Jacking
  • Broken Link Hijacking
  • Command Injection
  • Information Disclosure Bug
  • Denial of Service (DOS)
  • Violation of secure design principle
  • HTTP Parameter Pollution
  • Bug Bounty Methodology
  • Reconnaissance
  • Bash
  • Browser Hacks
  • XML Bug Bounty
  • Information Gathering Tool
  • API Bug Bounty; API Endpoints
  • Js files; Endpoints
  • Testing Environment
  • Waybackmachine
  • Eyewitness tool
  • Docker For Bug Bounty
  • Google Dorking
  • Brute Forcing
  • Fuzzing
  • Bug Bounty Manual and Automation
  • Recon
  • Subdomain Enumeration
  • Recon Workflow; Bug Bounty Workflow
  • Bug Bounty Platforms: Major Platforms, Regional Platforms, Private Platforms, Self Hosted Platforms.
  • Vulnerability Disclosure Program
  • CTF
  • Burp Suite
  • Vulnerability Scanner

1.1.5 Bug Bounty Platforms

(Links and points may be repeated and in unordered list because these are directly copied and pasted from my notes. Sorry for that.)

1.1.6 Bug Bounty & Ethical Hacking Books

(Links and points may be repeated and in unordered list because these are directly copied and pasted from my notes. Sorry for that.)

Books

  1. The web application hacker’s handbook
  2. owasp testing guide
  3. web hacking 101
  4. breaking into infromation security
  5. mastering mordern web peneteration testing
  6. https://github.com/jhaddix/tbhm
  7. https://www.gitbook.com/?utm_source=legacy&utm_medium=redirect&utm_campaign=close_legacy

Web and browser

Mobile

Cryptography

Penetration Testing

There are many aspects yet to learn first learn from above resources. I’ll keep writing articles in detail in next parts. Till then study these.

Thank You,

Shubham Dhungana

404 Error :)

Ethical Hacking
Bug Bounty

--

--

Subh Dhungana
Subh Dhungana

Written by Subh Dhungana

340 Followers
22 Following

Offensive Side | Bug Bounty Hunter | Programmer Having Affair With Cyber Sec

No responses yet

Help

Status

About

Careers

Press

Blog

Privacy

Terms

Text to speech

Teams