I have practiced oswap documentation and their vulnerability lab. I also read some books like the web app penetration hackers handbook. But I have no success in bug bounty hunting.

I have read an article about bug bounty hunting which provides the same relevant information which are mentione above. So what should I do to get better in bug bounty hunting? Should I continue to bug bounty or I am missing something? Also, what do bug bounties generally expect when they want a "proof of concept" for a bug?

  • 2
    Bug bounty hunting takes a lot more effort and work than just using existing tools and techniques. You will need to seriously up your level of effort and start to become the person creating the POCs instead of the person using them to successfully achieve the bounty. Where have you previously tried? – Joe Dec 1 '15 at 8:37
  • A good bug bounty hunter needs to be thinking of ideas for flaws that might not have been fixed, ways to abuse them, and different ways to bypass any fixes that might be applied. It is not an easy way to make money, despite the media perception of it. It takes skills in code analysis, memory investigation, networking, and, basically, lots of digging through potentially vulnerable apps, with very little chance of success - a company who knows their software is buggy won't offer bounties. – Matthew Dec 1 '15 at 9:08
  • You talk about owasp, I think? – davidbaumann Dec 1 '15 at 10:47
  • I got good information from the answer in this question. Thanks for asking it. – ojblass Dec 10 '15 at 14:49

Security-related bug bounties are usually more of a PR event than an attempt at outsourcing a security audit. The message they want to communicate is "Our software is secure, and we are so sure about that that we bet $$$$$ that nobody can find a vulnerability".

When a company places a bug bounty, you can assume that they have also read the standard literature about penetration testing and already patched those vulnerabilities you can find with the usual methods. When any newbie could find their bugs, the bug bounty offer would become both expensive and bad for PR.

When you enjoy looking for vulnerabilities, want to improve your skills and want to do good while doing so, you might want to consider to support some smaller open source projects which don't have the resources for a security audit. You won't get paid, but you will collect valuable experience.

A "proof of concept" for a vulnerability is a demonstration which shows that the bug happens. This illustrates that the bug is really there and not just a theoretical approach. It can be a series of instruction like "Click here, click there, enter that, cancle then, click there, clap your hands twice and you have administrator access". Or it can be an exploit: A program which causes the application to misbehave when executed. When proving a bug with an exploit, it is usually expected that you don't just deliver the binary but also the sourcecode and an explanation how it works.

  • Excellent advice. It's win win for the OP as well as for the open source project. – void_in Dec 1 '15 at 9:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.