Upgrade to Pro — share decks privately, control downloads, hide ads and more …

METHODOLOGIES AND APPROACH TO START BUG BOUNTY ...

Avatar for Tushar Verma Tushar Verma
July 25, 2021
Technology
0
580

METHODOLOGIES AND APPROACH TO START BUG BOUNTY HUNTING

Avatar for Tushar Verma

Tushar Verma

July 25, 2021
Tweet

More Decks by Tushar Verma

See All by Tushar Verma
The Power of Recon_ Leveraging Recon for Easy $$$$
Avatar for Tushar Verma e11i0t_4lders0n
0
170
AWS Cloud Forensics & Incident Response
Avatar for Tushar Verma e11i0t_4lders0n
1
670
Hacking OAuth Applications
Avatar for Tushar Verma e11i0t_4lders0n
1
2k
Exploiting SSRF like a Boss
Avatar for Tushar Verma e11i0t_4lders0n
2
1.1k
How to Fail at Bug Bounty Hunting
Avatar for Tushar Verma e11i0t_4lders0n
1
1.7k
The Bug Hunter’s Recon Methodology
Avatar for Tushar Verma e11i0t_4lders0n
2
770
Bypassing 2FA Misconfiguration
Avatar for Tushar Verma e11i0t_4lders0n
1
2.3k
How to get started in bug bounty
Avatar for Tushar Verma e11i0t_4lders0n
1
480

Other Decks in Technology

See All in Technology
いまさら聞けない Git 超入門 〜Gitって結局なに？から始める第一歩〜
Avatar for とことんDevOps devops_vtj
0
150
Oracle Database オプティマイザ・ヒントの活用
Avatar for oracle4engineer oracle4engineer
PRO
1
140
やさしいClaude Code入門
Avatar for みのるん minorun365
PRO
28
21k
エンジニアが組織に馴染むために勉強会を主催してチームの壁を越える
Avatar for uutan1108 ohmori_yusuke
2
110
OTel meets Wasm: プラグイン機構としてのWebAssemblyから見る次世代のObservability
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
1
290
GigaViewerにおけるMackerel APM導入の裏側
Avatar for koudenpa 7474
0
450
【５分でわかる】セーフィー エンジニア向け会社紹介
Avatar for Safie safie_recruit
0
24k
プラットフォームとしての Datadog / Datadog as Platforms
Avatar for Kento Kimura aoto
PRO
1
330
ソフトウェアテストのAI活用_ver1.10
Avatar for fumisuke fumisuke
0
220
データプレーンプログラミングとは？ DPU＆スイッチASICの開発経験から語る
Avatar for ebiken ebiken
PRO
1
260
プロジェクトマネジメント実践論｜現役エンジニアが語る！～チームでモノづくりをする時のコツとは？～
Avatar for MIXI ENGINEERS mixi_engineers
PRO
3
180
“⾞が通れるほど⼤きな”セキュリティーホールを抑えながらログインしたい
Avatar for taiseiue taiseiue
0
150

Featured

See All Featured
A designer walks into a library…
Avatar for Paul Jervis Heath pauljervisheath
205
24k
BBQ
Avatar for Matthew Crist matthewcrist
88
9.7k
Reflections from 52 weeks, 52 projects
Avatar for Jefferson Lam jeffersonlam
349
20k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
Avatar for Kevin Liebholz kevinliebholz
32
5.8k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
Avatar for Eileen M. Uchitelle eileencodes
137
34k
[Rails World 2023 - Day 1 Closing Keynote] - The Magic of Rails
Avatar for Eileen M. Uchitelle eileencodes
34
2.3k
The Language of Interfaces
Avatar for Des Traynor destraynor
158
25k
ピンチをチャンスに：未来をつくるプロダクトロードマップ #pmconf2020
Avatar for Aki / @LoveIdahoBurger aki_iinuma
123
52k
Fireside Chat
Avatar for paigeccino paigeccino
37
3.5k
Gamification - CAS2011
Avatar for David Bonilla davidbonilla
81
5.3k
The Art of Programming - Codeland 2020
Avatar for Erika Heidi erikaheidi
54
13k
Documentation Writing (for coders)
Avatar for Carmen Chung carmenintech
71
4.8k

Transcript

  1. METHODOLOGIES AND APPROACH TO START BUG BOUNTY HUNTING By: Tushar

    Verma

  2. WHOAMI Application Security Engineer Synack Red Team Member Bug Bounty

    Hunter

  3. AGENDA What is Bug Bounty Hunting Bug Bounty Platform Scope

    Review and Target Selection Recon Methodologies Manual Testing Approach

  4. WHAT IS BUG BOUNTY HUNTING

  5. Bug Bounty Platform Bugcrowd Hackerone Intigriti YesWeHack HackenProof Cesspa Synack

    Private Programs

  6. Scope Review and Target Selection Check the Description and Focus

    Area Check the In-Scope and Out-scope of the target Check the average response time Check the pay-out and How many vulnerabilities reported

  7. Recon Methodologies Small Scope Recon – Specific sets of single

    URLs Medium Scope Recon - Specific set of “*.target.com” Large Scope Recon – Everything in Scope

  8. Automating Recon Project Bheem ReconFTW Osmedeus

  9. MANUAL TESTING APPROACH

  10. GET IN TOUCH AT ◦ Twitter: @e11i0t_4lders0n ◦ LinkedIn: /in/tushars25

    ◦ Instagram: @e11i0t_4lders0n__ ◦ Email: [email protected]