35. Careers, Certifications and Bug Bounty
35.5 Bug Bounty
Bug bounty programmes let companies invite outside researchers to find security bugs in their systems and reward valid reports, sometimes with money, swag or a hall-of-fame mention.
| Platform / route | Notes |
|---|---|
| HackerOne | Large global platform with public and private programmes |
| Bugcrowd | Another major platform |
| Intigriti, YesWeHack | European platforms with many programmes |
| Company-run programmes | Some companies run their own pages (look for "security", "responsible disclosure" or /.well-known/security.txt) |
Golden rules:
- Read the programme policy fully. Only test assets listed in scope, only with allowed methods. Out-of-scope testing is unauthorised access (IT Act s. 43/66, Chapter 18).
- No damage: no denial of service, no mass automated scanning unless allowed, no accessing or downloading other users' data beyond what proves the issue.
- Use your own test accounts to show IDOR or access control issues (Chapter 29).
- Write a clear report: title, affected URL, severity, steps to reproduce, proof (screenshots, request/response), impact, and suggested fix.
- Keep it confidential until the company allows disclosure.
Sample report skeleton:
Title: IDOR allows viewing other users' invoices at /api/invoice?id=
Severity: High (CVSS reasoning included)
Steps: 1) Log in as test user A ... 2) Change id from 1041 to 1042 ... 3) Invoice of test user B is returned
Impact: Any logged-in user can read other customers' invoices (names, addresses, amounts)
Fix: Check invoice ownership on the server for every request
Ravindra Bagale's Tip
In bug bounty you get a lot of "duplicate" and "informative" results – don't be discouraged. At the start, focus not on easy targets but on new scope that few people have tested, do good recon, and write a very clear report. And don't send a single request without reading the policy.
Ravindra Bagale's Tip – मराठी
Bug bounty मध्ये "duplicate" आणि "informative" reports खूप येतात – निराश होऊ नका. सुरुवातीला सोप्या targets वर नाही तर नवीन आणि कमी लोकांनी तपासलेल्या scope वर लक्ष द्या, recon चांगले करा, आणि report एकदम clear लिहा. आणि policy वाचल्याशिवाय एक पण request पाठवू नका.
Ravindra Bagale's Tip – हिंदी
Bug bounty में "duplicate" और "informative" reports बहुत आते हैं – निराश मत हो. शुरुआत में आसान targets पर नहीं बल्कि नए और कम लोगों द्वारा जाँचे गए scope पर ध्यान दो, recon अच्छा करो, और report बिलकुल clear लिखो. और policy पढ़े बिना एक भी request मत भेजो.
Practice task
Open two public programmes on HackerOne or Bugcrowd and read their policies. For each, list: in-scope assets, out-of-scope assets, forbidden testing methods, and reward rules. Then write a practice report in the skeleton above for an IDOR you find in OWASP Juice Shop (local lab).