Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I really want to prove myself (to my parents) by winning a proper bug bounty

How should I best prepare for this and go about actually finding bugs?

Edit So can anyone give some web sites which I could read that would help me understand better how to win, and what free training materials are useful? I'm working through pentesterlab already.

I've the looked up the most common vulnerabilities from OWASP things like XSS, SQL injection, PHP inclusion, CSRF, error disclosure. I've studied each of these and understand how they occur and how to demonstrate them.

I've tried to audit many lines of source code from open source projects looking for parts that haven't properly escaped user input or other important things. I also tried to do black-box testing for things like XSS on staged sites (ones hosted separate from the in-use production server, for the purpose of testing) but nothing has really turned up. I've also read the public disclosure writeups of the bugs other people found.

I understand that part of the problem is that there are people with years of experience who will find things first. And there are also people (like researchers) with much deeper knowledge in specific areas.

But even so I think I should be able to make a positive contribution if I work hard, so I would appreciate any guidance

share|improve this question
When a company starts a bug bounty program, you can assume that they already invested lots of internal resources into finding and closing any obvious and easy to find vulnerabilities. Otherwise they would risk that such a program could become both expensive and embarrassing. In fact, bug bounty programs are often intended as a marketing campaign to show how much they trust the security of their product, not as a method to outsource their security auditing. – Philipp Jun 4 '14 at 23:27

The fact that you are trying to 'prove' something to someone else confuses the process.

  1. Look for bug bounty programs
  2. Look for the most error-prone service
  3. Use your knowledge to find a bug

If you try to look at the major products/services, you are aiming too high. Choose something small and overlooked.

share|improve this answer
Thanks, This is very helpful. Also I was just stating my motivation. – emberfang Jun 4 '14 at 23:00

With my bug bounty experience, I would suggest certain things that would help and make the task easy:

1) If the website you are testing has any sub domains, please go for those first as the main website domain is the first which is tried by many.

2) Do not use automated tools as many of the results are false positives and those bugs have high probability of being reported already.

3) Do not go directly for SQL injection or XSS as they are the most common bugs out there and everyone tries them. Rather, go for Business Logic flaws which are equally important and less time consuming.

4) Last but not least, you should have patience. Don't jump from one website to another without testing one completely. Learn new exploit methodologies and try it on them as it will help you increase your knowledge, too.

As far as practice is concerned, there are many websites like , hax.tor available outside to practice and also there are Virtual machines like DVWA, Mutillidae.

All the best.

PS: Focus more on gaining knowledge than winning bounty, you'll surely succeed

share|improve this answer
Last line: PS: Focus more on gaining knowledge than winning bounty, you'll surely succeed is very impressive – Jassi Mar 11 at 10:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.