How to Start a Career in Bug Bounty Hunting

•

2 likes•1,324 views

Arbin Godar

What is Bug Bounty?
Paying monetary reward to security researchers for certain
qualifying security bugs.
Hacker find security bug and reported bug on Example
Example security team triaged the bug
Example pays $$$ according to it’s impact

Why companies run bug bounty program?
- Fastest way to improve security publicly
- Safety
- Cost effective

Why bug hunting?
- To make money
- To have fun
- To build strong portfolio
- To be challenged etc.

“ Hacking is a lifelong journey of
learning. ”
- https://www.owasp.org/index.php/
Category:OWASP_Top_Ten_Proje
ct
- https://hackerone.com/blog/what-
great-hackers-share
- https://forum.bugcrowd.com/t/rese
archer-resources-how-to-become-
a-bug-bounty-hunter/1102
References / Links:

How to start bug hunting ?
- Practice makes a man perfect
- Reading : books , proof of concepts
- Requires little programming knowledge
- Think logically

Popular bug bounty programs and platforms
- Facebook, Google, Twitter, Yahoo, PayPal etc.
- Platforms: HackerOne , Bugcrowd, Cobalt, Synack etc.

Submitting Bug Report
- Title
- Description of bug
- Step to Reproduce the bug
- Impact
- Suggested Fix

Thank You!
Arbin Godar (@arbingodar)
pentester.arbin@gmail.com
www.arbingodar.com

What's hot

Bug Bounty #Defconlucknow2016Shubham Gupta

Ethical Hacking n VAPT presentation by Suvrat jainSuvrat Jain

Bug bountyn|u - The Open Security Community

Vulnerabilities in modern web applicationsNiyas Nazar

Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...Sam Bowne

Cross Site Scripting: Prevention and Detection(XSS)Aman Singh

Web application securityKapil Sharma

WTF is Penetration Testing v.2Scott Sutherland

Hackfest presentation.pptxPeter Yaworski

Penetration Testing BasicsRick Wanner

Introduction to Web Application Penetration TestingAnurag Srivastava

Top 10 Web Security Vulnerabilities (OWASP Top 10)Brian Huff

OWASP Top 10 Vulnerabilities - A5-Broken Access Control; A6-Security Misconfi...Lenur Dzhemiliev

Security testingKhizra Sammad

Sql injectionManjushree Mashal

Bounty Craft: Bug bounty reports how do they work, @sushihack presents at Nu...HackerOne

IDA Vulnerabilities and Bug Bounty　 by Masaaki ChidaCODE BLUE

Bug Bounty Programs For The WebMichael Coates

Privilege escalation from 1 to 0 Workshop Hossam .M Hamed

Server-side template injection- Slides Amit Dubey

What's hot (20)

Bug Bounty #Defconlucknow2016

Ethical Hacking n VAPT presentation by Suvrat jain

Bug bounty

Vulnerabilities in modern web applications

Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...

Cross Site Scripting: Prevention and Detection(XSS)

Web application security

WTF is Penetration Testing v.2

Hackfest presentation.pptx

Penetration Testing Basics

Introduction to Web Application Penetration Testing

Top 10 Web Security Vulnerabilities (OWASP Top 10)

OWASP Top 10 Vulnerabilities - A5-Broken Access Control; A6-Security Misconfi...

Security testing

Sql injection

Bounty Craft: Bug bounty reports how do they work, @sushihack presents at Nu...

IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida

Bug Bounty Programs For The Web

Privilege escalation from 1 to 0 Workshop

Server-side template injection- Slides

Similar to How to Start a Career in Bug Bounty Hunting

Cyber Security Workshop @SPIT- 3rd October 2015Nilesh Sapariya

Statistical Analysis of Phished Email Users, Intercepted by the APWG/CMU Phis...Jason Hong

Saying Hello to Bug BountyNull Bhubaneswar

Release The Hounds: Part 2 “11 Years Is A Long Ass Time”Casey Ellis

4 Synthesis Essay Examples Which. Online assignment writing service.Danielle Davis

RELEASE THE HOUNDS, PART 2: 9 YEARS IS A LONG ASS TIMECasey Ellis

apidays LIVE New York 2021 - Why Software Teams Struggle with API Security Te...apidays

Nbt con december-2014-slidesBehrouz Sadeghipour

BugBounty Roadmap with Mohammed AdamMohammed Adam

Bug bounty huntingredteamacademypromo

Social Enterprise Rises! …and so are the Risks - DefCamp 2012DefCamp

Protect Yourself From Internet Pestspeterhitch

Bug Bounty Hunting for Companies & Researchers: Bounty Hunting in Sudan and A...Mazin Ahmed

NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...CiNPA Security SIG

Best practices to shape and secure your 1:1 programSecurly

DIY guide to runbooks, incident reports, and incident responseNathan Case

OISF Aniversary: Active Defense - Helping threat actors hack themselves!CiNPA Security SIG

Defcamp 2013 - Does it pay to be a blackhat hackerDefCamp

Dan Catalin Vasile - Defcamp2013 - Does it pay to be a blackhat hackerDan Vasile

Similar to How to Start a Career in Bug Bounty Hunting (20)

Cyber Security Workshop @SPIT- 3rd October 2015

Statistical Analysis of Phished Email Users, Intercepted by the APWG/CMU Phis...

Saying Hello to Bug Bounty

Release The Hounds: Part 2 “11 Years Is A Long Ass Time”

4 Synthesis Essay Examples Which. Online assignment writing service.

RELEASE THE HOUNDS, PART 2: 9 YEARS IS A LONG ASS TIME

apidays LIVE New York 2021 - Why Software Teams Struggle with API Security Te...

Nbt con december-2014-slides

BugBounty Roadmap with Mohammed Adam

Bug bounty hunting

Social Enterprise Rises! …and so are the Risks - DefCamp 2012

Protect Yourself From Internet Pests

Bug Bounty Hunting for Companies & Researchers: Bounty Hunting in Sudan and A...

NKU Cybersecurity Symposium: Active Defense - Helping threat actors hack them...

Best practices to shape and secure your 1:1 program

DIY guide to runbooks, incident reports, and incident response

OISF Aniversary: Active Defense - Helping threat actors hack themselves!

Defcamp 2013 - Does it pay to be a blackhat hacker

Dan Catalin Vasile - Defcamp2013 - Does it pay to be a blackhat hacker

How to Start a Career in Bug Bounty Hunting

1. Bug Bounty - Hackers Job Arbin Godar (@arbingodar)

2. Arbin Godar #whoami - Student @ Trinity International College - Guy interested in web security - A mediocre programmer, hobbyist etc.

3. Acknowledged by etc….

4. What is Bug Bounty? Paying monetary reward to security researchers for certain qualifying security bugs. Hacker find security bug and reported bug on Example Example security team triaged the bug Example pays $$$ according to it’s impact

5. Why companies run bug bounty program? - Fastest way to improve security publicly - Safety - Cost effective

6. Why bug hunting? - To make money - To have fun - To build strong portfolio - To be challenged etc.

7. “ Hacking is a lifelong journey of learning. ” - https://www.owasp.org/index.php/ Category:OWASP_Top_Ten_Proje ct - https://hackerone.com/blog/what- great-hackers-share - https://forum.bugcrowd.com/t/rese archer-resources-how-to-become- a-bug-bounty-hunter/1102 References / Links:

8. How to start bug hunting ? - Practice makes a man perfect - Reading : books , proof of concepts - Requires little programming knowledge - Think logically

9. Popular bug bounty programs and platforms - Facebook, Google, Twitter, Yahoo, PayPal etc. - Platforms: HackerOne , Bugcrowd, Cobalt, Synack etc.

10. Submitting Bug Report - Title - Description of bug - Step to Reproduce the bug - Impact - Suggested Fix

11. For Motivation

12. Thank You! Arbin Godar (@arbingodar) pentester.arbin@gmail.com www.arbingodar.com

How to Start a Career in Bug Bounty Hunting

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to How to Start a Career in Bug Bounty Hunting

Similar to How to Start a Career in Bug Bounty Hunting (20)

How to Start a Career in Bug Bounty Hunting