Bug Hunting/Bug Bounty

Resources

There are a lot of books, but this guide touches on how to get started with the bug bounty trend. This reading should give you a great start to become an ethical hacker and start your bug bounties journey.

Books

=> OWASP Testing Guide
=> Web app hackers handbook
=> Web hacking 101
=> Hacker's playbook 1,2,3
=> Hacking art of exploitation
=> Mastering modern web pen testing
=> Mobile application hacker's handbook

BLOGS/WRITEUPS:

  1. Vickie Li @vickieli

  2. Over 600 writeups

LABS:

  1. PentesterLab

  2. PortSwigger's Web Security Academy

PROGRAMMING LANGUAGES:

Codecademy

Practice

Before jumping to the real bug bounties engagements you might need some web targets that have been made intentionally vulnerable, there are many CTF platforms offering 24/7 web targets:---

Start Now

Now after discussing many topics and tools, this is the right time to talk about the bug bounty platform itself here is a list of the well known platforms that offer many programs.

=> HackerOne -: world's largest community of hackers and bug hunters

=> Bugcrowd -: powerful bug bounty platform and team of security researchers, one of the best platforms that connects organizations with ethical hackers .

=> Intigriti -: Europe's biggest community of security researchers that help companies to protect their assets

=> Synack -: American intelligence platform automates the discovery of vulnerable endpoints & assets .

=> YesWeHack -: Bug Bounty protects applications the agile way with a wide community of white hackers using private and public programs.

=> HackenProof -: vulnerability coordination platform , connects companies with the global security researchers community to uncover any security issues . After understanding these vulnerabilities you can begin reading others reports ,POCs on the bug bounty platforms to figure out the common testing techniques

Introduction to Hunting Bugs

Firstly Why do we learn to hunt bugs?

Bug Bounty Platforms

How do I get started?

Programming

Programming is an important part of being a successful hacker. This isn’t a comprehensive list of programming languages and nearly any can be used for most hacking tasks, especially on the web, but rather a list of languages we find especially useful or notable.

=> JavaScript: This is the language used on the majority of web pages. Understanding it is useful for bug hunting because many bugs actually stem from JS code. => Python: Commonly used for automating various activities during testing, as well as being useful for general programming. => SQL: Used by most applications for accessing and manipulating data. Knowledge of SQL will help in discovering and exploiting critical SQL Injection vulnerabilities. => Python and Ruby: Useful for automation and quick testing and analysis, particularly for web hacking. => JavaScript: Can be used for the same tasks as Python and Ruby (albeit with fewer relevant libraries), but mostly useful to know for analysis of code on the web, as well as exploitation. => Objective-C and Swift: The ability to read these will be essential if you plan to do source code review of iOS applications. => Java and Kotlin: The ability to read these will be essential if you plan to do source code review of Android applications. Java is produced by decompilers for Android applications, which allows you to read code (roughly) equivalent to the original source, even when you only have a compiled application. => AArch64 assembly: For advanced embedded and mobile hacking, understanding the very lowest level of abstraction is essential.

Networking

=> Terminology guide: You’ll hear many terms from IP address to port to DNS. This guide will help you understand that. => Common Port Numbers: A useful list of common port numbers and the associated services.

Linux

=> Setting up your own web server: While not security-related in itself, this will teach you many of the commands and concepts you need to know to become a great hacker. => Setting up Kali Linux on Virtualbox: Kali is a hacking-oriented Linux distribution, used by many bug hunters. This guide will help you set it up in a virtual machine. => Command Line Guide: You’ll end up using many command-line tools as a hacker, so a familiarity with its structure and use is valuable.

Prerequisites

Before finding bugs in any platforms you need to understand how web applications work and understanding the architecture of these apps.

Web hacking tools

This is a curated list of web hacking tools and is not intended to be comprehensive; rather, we want to highlight the tools we find especially useful.

Miscellaneous hacking tools

This is a curated list of miscellaneous hacking tools and is not intended to be comprehensive; rather, we want to highlight the tools we find especially useful.

---> ### Burp Suite plugins Burp Suite: The quintessential web app hacking tool. Once you hit 500 reputation on HackerOne, you are eligible for a free 3-month license of Burp Suite Pro!

This is a curated list of Burp plugins and is not intended to be comprehensive; rather, we want to highlight the plugins we find especially useful.

Mobile hacking tools

This is a curated list of mobile hacking tools and is not intended to be comprehensive; rather, we want to highlight the tools we find especially useful.

Desktop/embedded hacking tools

This is a curated list of hacking tools for native applications and embedded devices and is not intended to be comprehensive; rather, we want to highlight the tools we find especially useful.

Setting up your Environment

====> To start with tools like BurpSuite, OWASP ZAP, WebGoat, you need to install Kali Linux in your Virtual Machine. We will do that for one reason: Kali Linux comes up with all these tools by default. Therefore you don't have to install them separately.

====> A virtual machine, or virtualisation, is not mandatory for the experienced Ethical Hacker. As an experienced Ethical Hacker, you can run Kali Linux as your main system and perform the hacking using mainly a terminal with the help of a programming language such as Python, or we can use selected tools like Metasploit.

As an aspiring Ethical Hacker and penetration tester, you should become capable of building Virtual and Physical Labs to use it for practice

Why do we need Virtual Environment? - Virtualisation is very important for any type of penetration testing. You are going to learn how to find security vulnerabilites in any web application, and that needs a lot of practice before you actually approach a client to do the same on their live system. So we need a simulated environment first, a network security lab where we can practice, to learn and understand every trick of hunting bugs so that we can impliment them on the live applications later as secuurity proffessionals.

Introduction to Kali Linux

Exploitation resources

This is a curated list of exploitation resources and is not intended to be comprehensive; rather, we want to highlight the tools we find especially useful.

Scanners / Frameworks

This is a curated list of scanners and frameworks and is not intended to be comprehensive; rather, we want to highlight the tools we find especially useful.

Datasets / Freemium services

This is a curated list of datasets and freemium services and is not intended to be comprehensive; rather, we want to highlight the tools we find especially useful.

Injection Request Forgery

What is Cross-Site Request Forgery?

For this session CSRF is also known as season riding or sea surfing

alt text

STEPS:--

Exploiting through Cross-Site Scripting(XSS)

Discovering XSS vulnerabilities

===> TO DO THIS - we can install OWASP blocking web application

Header Injection and URL Redirection

  <?php
  /* Redirecting Browser */
  header("Location: https://www.google.com");
  ?/


  <?php
  /* Taking untrusted input from a form and Redirecting browser */
  $RedirectingURL = $_GET["URL"];
  header("Location: " . $RedirectingURL);
  ?>

Cross-Site Scripting through Header Injection

-- So far we have learned that open redirections or URL redirections are potential vulnerabilities for any web application. Under the influence of untrusted user input data, any web application may fall into this phishing trap. In such cases, a redirection is performed to a location specified in user-supplied data. -- OWASP ZAP and Burp Suite is used here to perform the task

Malicious Files

Uploading Malicious Files to Own a system - The file upload_module needs a "file upload form". This form could easily be a major security risk because, if it is done without a full understanding of the risks associated with it, it might open the doors for the server compromise. However, despite the security concerns, you cannot imagine a web application without a file-upload module. It is one of the most common requirements. 

      <div class="vulnerable_code_area">

        <form enctype="multipart/form-data" action="#" method="POST" />
        <input type="hidden" name="MAX_FILE_SIZE" value="100000" />
        Choose an image to upload:
        <br />
        <input name="uploaded" type="file" /><br />
        <br />
        <input type="submit" name="Upload" value="Upload" />
        </form>
     </div>

Poisoning Sender Policy Framework(SPF)

Testing SPF Records - It specifically identifies which mail servers are permitted to send email on behalf of your domain, using IP addresses. - In any case the SPF record is included in an organization's DNS database as a specially formatted DNS text record. - There are simple steps that can help you write the SPF entries for your clients.

==> - The first step is to impliment SPF is to identify who is the email servers, each one to use to send email from your domains - make a list of your sending domains - after that you can create your SPF record.

   v=spf1 +a +mx +ip4:192.168.1.1 ~all

Injecting Unintended XML - Whenever we pen test an application and we see that the application functionality has XML parsing in the backend, we try to pen test the app with XML injection issues. - Usually we use an XML parser to check whether the client application's XML documents is properly formatted or not - We also validate the XML documents with that XML parser - Before pentesting in an aplication with XML injection issue, we examine injection using XML parser is a normal procedure.A type of XML injection can cause medium to severe kind of damages to the application. It can alter the intended logic of the application, ie, why we call it unintended XML injection

what is XML? -- XML is a software and hardware independent language for storing and transporting data -- It stands for Extensible Markup Language and is similar to HTML. -- XML was designed to be self-descriptive. -- so you can design the structure according to your necessity 

   <email>
     <to>Bob</to>
     <message>Hello, Bob.</message>
</email>

{
  "to": "Bob",
"from": "John",
"message": "Hello, Bob"
}

what is a DTD? -- A document type definition or DTD defines the legal elements and attributes of an XML document. With a DTD, developers agree on a standard data structure for storing and transporting data. Furthermore, an application can verify with the help of DTD that an XML document is properly formatted or not.

Finding common Injection Vulnerabilities

Bug Bounty Beginner's Roadmap

NOTE: The bug bounty landscape has changed since the last few years. The issues we used to find easily an year ago would not be easy now. Automation is being used rigorously and most of the "low hanging fruits" are being duplicated if you are out of luck. If you want to start doing bug bounty, you will have to be determined to be consistent and focused, as the competition is very high.

Introduction

Bug Bounty Report Format

Sample Report

Some additional Tips

  1. Don't do bug bounty as a full time in the beginning (although I suggest don't do it full time at any point). There is no guarantee to get bugs every other day, there is no stability. Always keep multiple sources of income (bug bounty not being the primary).
  2. Stay updated, learning should never stop. Join twitter, follow good people, maintain the curiosity to learn something new every day. Read writeups, blogs and keep expanding your knowledge.
  3. Always see bug bounty as a medium to enhance your skills. Money will come only after you have the skills. Take money as a motivation only.
  4. Don't be dependent on automation. You can't expect a tool to generate money for you. Automation is everywhere. The key to success in Bug Bounty is to be unique. Build your own methodology, learn from others and apply on your own.
  5. Always try to escalate the severity of the bug, keep a broader mindset.
  6. Stay connected to the community. Learn and contribute. There is always someone better than you in something. don't miss an opportunity to network. Join forums, go to conferences and hacking events, meet people, learn from their experiences.
  7. Always be helpful.