Bug Bounty Hunting Tutorial | Zero to Report | Zentrion

Bug Bounty Platforms

Companies pay independent researchers to find security vulnerabilities before malicious hackers do. Top earners make six figures. Start by registering on these free platforms:

HackerOne: The largest platform. Start with their Hacker101 CTF to get private invites.
Bugcrowd: Excellent platform with diverse targets (Web, IoT, API, Mobile).
Intigriti: Rapidly growing European platform with great community support.

Step 1: Reconnaissance (The Most Important Phase)

You cannot hack what you cannot see. Effective recon expands your attack surface, giving you targets other hackers missed.

Subdomain Enumeration

Combine multiple tools to get a complete picture of the target's infrastructure.

# 1. Passive collection with Subfinder
subfinder -d example.com -all -o subs.txt

# 2. Passive collection with Amass
amass enum -passive -d example.com -o amass_subs.txt

# 3. Combine and deduplicate
cat subs.txt amass_subs.txt | sort -u > all_subs.txt

# 4. Check which subdomains actually resolve/respond using httpx
httpx -l all_subs.txt -o alive_subs.txt

Wayback Machine (Historical URLs)

Old APIs and forgotten endpoints are often highly vulnerable. Scrape historical data.

# Extract URLs using waybackurls
waybackurls example.com | sort -u > wayback_urls.txt

# Extract using gau (Get All URLs)
gau --subs example.com | sort -u > gau_urls.txt

Step 2: Content Discovery

Now that you have alive hosts, you need to find hidden files, directories, and parameters.

Directory Brute Force (ffuf)

# Fuzz directories using ffuf (Fast Web Fuzzer)
# We filter out 404 (Not Found) responses
ffuf -u https://example.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -fc 404

JavaScript Analysis

Modern Web Apps (React/Angular/Vue) pack logic and endpoints into JS files. Download them and search for secrets or hidden API routes.

# Use LinkFinder to extract endpoints from JS files
python3 linkfinder.py -i https://example.com

Step 3: Vulnerability Testing

IDOR (Insecure Direct Object Reference)

The most common high-paying bug. Look for IDs in URLs, POST bodies, and headers.

# Example Target:
GET /api/orders/123

# Testing Methodology (while logged in as User A):
1. Change 123 -> 124 (Access someone else's order)
2. Change to 0 or -1 (Boundary testing)
3. Change to UUID format if predictable
# If you can view/edit User B's data, you found an IDOR.

Race Conditions

Can you redeem a one-time coupon multiple times? Send 50 requests simultaneously.

# Example bash loop for simple Race Condition testing
for i in $(seq 1 50); do
  curl -s -X POST "https://example.com/api/redeem_coupon" \
    -H "Content-Type: application/json" \
    -d '{"code":"WELCOME10"}' &
done
wait

Step 4: Logic Bugs

These bypass automated scanners entirely and pay the highest bounties. Think about how the application should behave, and do the opposite.

Price manipulation: Can you intercept a cart checkout and change the item price to $0.01?
Quantity manipulation: What happens if you order -1 items? Does it refund your account?
Coupon stacking: Apply multiple 10% off coupons until the price is zero.
Account takeover via OAuth: What if you register with a victim's email using a different OAuth provider (e.g., Apple Login instead of Google)?

Step 5: Report Writing

A bad report means your bug gets closed as "Not Applicable". Always include a clear summary, steps to reproduce, and impact.

Title: [Vulnerability Type] in [Component] e.g. IDOR in /api/v1/invoices

Severity: High

Summary:
The /api/v1/invoices endpoint lacks authorization checks. An attacker can view any user's invoice by incrementing the 'invoice_id' parameter.

Steps to Reproduce:
1. Log in as Attacker (User A).
2. Intercept the request to download an invoice: GET /api/v1/invoices?invoice_id=100
3. Modify 'invoice_id' to 101 (belonging to Victim User B).
4. Observe the server returns User B's private invoice PDF.

Impact:
An attacker can script this vulnerability to exfiltrate all financial invoices from the platform, leading to a massive PII data breach.

Proof of Concept:
[Insert Video/Screenshot Link Here]

Practice Targets (Legal Environments)

Never test on sites without a bug bounty program or explicit permission. Use these free platforms to practice:

Bug Bounty from Zero – Complete Workflow (Recon to Report)