Ravindra BagaleCourses & study guides

35. Careers, Certifications and Bug Bounty

35.5 Bug Bounty

By Last updated:

Bug bounty programmes let companies invite outside researchers to find security bugs in their systems and reward valid reports, sometimes with money, swag or a hall-of-fame mention.

Platform / route Notes
HackerOne Large global platform with public and private programmes
Bugcrowd Another major platform
Intigriti, YesWeHack European platforms with many programmes
Company-run programmes Some companies run their own pages (look for "security", "responsible disclosure" or /.​well-​known/​security.​txt)

Golden rules:

  1. Read the programme policy fully. Only test assets listed in scope, only with allowed methods. Out-of-scope testing is unauthorised access (IT Act s. 43/66, Chapter 18).
  2. No damage: no denial of service, no mass automated scanning unless allowed, no accessing or downloading other users' data beyond what proves the issue.
  3. Use your own test accounts to show IDOR or access control issues (Chapter 29).
  4. Write a clear report: title, affected URL, severity, steps to reproduce, proof (screenshots, request/response), impact, and suggested fix.
  5. Keep it confidential until the company allows disclosure.

Sample report skeleton:

Title: IDOR allows viewing other users' invoices at /api/invoice?id=
Severity: High (CVSS reasoning included)
Steps: 1) Log in as test user A ... 2) Change id from 1041 to 1042 ... 3) Invoice of test user B is returned
Impact: Any logged-in user can read other customers' invoices (names, addresses, amounts)
Fix: Check invoice ownership on the server for every request

Ravindra Bagale's Tip

Bug bounty madhe "duplicate" ani "informative" reports khup yetat – nirash hou naka. Suruvatila sopya targets var nahi tar navin ani kami lokanni tapaslelya scope var laksha dya, recon changla kara, ani report ekdam clear liha. Aani policy vachlyashivay ek pan request pathvu naka.

Practice task

Open two public programmes on HackerOne or Bugcrowd and read their policies. For each, list: in-scope assets, out-of-scope assets, forbidden testing methods, and reward rules. Then write a practice report in the skeleton above for an IDOR you find in OWASP Juice Shop (local lab).