Upgrade to Pro — share decks privately, control downloads, hide ads and more …

METHODOLOGIES AND APPROACH TO START BUG BOUNTY ...

Tushar Verma
July 25, 2021
Technology
0
560

METHODOLOGIES AND APPROACH TO START BUG BOUNTY HUNTING

Tushar Verma

July 25, 2021
Tweet

More Decks by Tushar Verma

See All by Tushar Verma
The Power of Recon_ Leveraging Recon for Easy $$$$
e11i0t_4lders0n
0
160
AWS Cloud Forensics & Incident Response
e11i0t_4lders0n
1
650
Hacking OAuth Applications
e11i0t_4lders0n
1
2k
Exploiting SSRF like a Boss
e11i0t_4lders0n
2
1.1k
How to Fail at Bug Bounty Hunting
e11i0t_4lders0n
1
1.7k
The Bug Hunter’s Recon Methodology
e11i0t_4lders0n
2
760
Bypassing 2FA Misconfiguration
e11i0t_4lders0n
1
2.3k
How to get started in bug bounty
e11i0t_4lders0n
1
470

Other Decks in Technology

See All in Technology
速くて安いWebサイトを作る
nishiharatsubasa
10
13k
飲食店予約台帳を支えるインタラクティブ UI 設計と実装
siropaca
7
1.8k
「海外登壇」という 選択肢を与えるために 〜Gophers EX
logica0419
0
710
Data-centric AI入門第6章：Data-centric AIの実践例
x_ttyszk
1
410
Moved to https://speakerdeck.com/toshihue/presales-engineer-career-bridging-tech-biz-ja
toshihue
2
740
Culture Deck
optfit
0
420
JEDAI Meetup! Databricks AI/BI概要
databricksjapan
0
100
あれは良かった、あれは苦労したB2B2C型SaaSの新規開発におけるCloud Spanner
hirohito1108
2
590
ユーザーストーリーマッピングから始めるアジャイルチームと並走するQA / Starting QA with User Story Mapping
katawara
0
210
OpenID Connect for Identity Assurance の概要と翻訳版のご紹介 / 20250219-BizDay17-OIDC4IDA-Intro
oidfj
0
280
次世代KYC活動報告 / 20250219-BizDay17-KYC-nextgen
oidfj
0
260
利用終了したドメイン名の最強終活〜観測環境を育てて、分析・供養している件〜 / The Ultimate End-of-Life Preparation for Discontinued Domain Names
nttcom
2
200

Featured

See All Featured
jQuery: Nuts, Bolts and Bling
dougneiner
63
7.6k
We Have a Design System, Now What?
morganepeng
51
7.4k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
stephaniewalter
280
13k
Speed Design
sergeychernyshev
27
790
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
21
2.5k
Designing Dashboards & Data Visualisations in Web Apps
destraynor
231
53k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
40
2k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
3.7k
Visualization
eitanlees
146
15k
Fontdeck: Realign not Redesign
paulrobertlloyd
83
5.4k
A designer walks into a library…
pauljervisheath
205
24k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
danielanewman
226
22k

Transcript

  1. METHODOLOGIES AND APPROACH TO START BUG BOUNTY HUNTING By: Tushar

    Verma

  2. WHOAMI Application Security Engineer Synack Red Team Member Bug Bounty

    Hunter

  3. AGENDA What is Bug Bounty Hunting Bug Bounty Platform Scope

    Review and Target Selection Recon Methodologies Manual Testing Approach

  4. WHAT IS BUG BOUNTY HUNTING

  5. Bug Bounty Platform Bugcrowd Hackerone Intigriti YesWeHack HackenProof Cesspa Synack

    Private Programs

  6. Scope Review and Target Selection Check the Description and Focus

    Area Check the In-Scope and Out-scope of the target Check the average response time Check the pay-out and How many vulnerabilities reported

  7. Recon Methodologies Small Scope Recon – Specific sets of single

    URLs Medium Scope Recon - Specific set of “*.target.com” Large Scope Recon – Everything in Scope

  8. Automating Recon Project Bheem ReconFTW Osmedeus

  9. MANUAL TESTING APPROACH

  10. GET IN TOUCH AT ◦ Twitter: @e11i0t_4lders0n ◦ LinkedIn: /in/tushars25

    ◦ Instagram: @e11i0t_4lders0n__ ◦ Email: [email protected]