BUG BOUNTY PROGRAMS ARE...
STANDOFF BUG BOUNTY IS...
Initiatives by companies to pay rewards for finding vulnerabilities in their systems, services, or products.
A platform where dozens of companies launch their bug bounty programs so that bug hunters can report vulnerabilities for rewards.
BUG HUNTING STARTER PACK
We've compiled a knowledge map containing 15 modules to help you start your bug hunting journey. Every week, we publish three information blocks so that you have time to study the materials. You are also expected to have a basic understanding of databases, Docker, and networks (TCP, DNS, VPN), and know how to use the command line.
01
Learn the basics of HTTP servers and clients, API, REST API, cookies, localStorage, and HTML
Materials
02
Understand the URL structure
Materials
03
Learn the basics of HTTP
Materials
04
Get basic proficiency in any popular web technology stack
Materials
We encourage you to study this topic on your own. Make sure you understand how web frameworks work (Django, Flask, PHP-FPM, Ruby on Rails)
05
Learn how to write simple scripts
Materials
Study the basics of programming using resources of your choice. This will help you to automate attacks
06
Understand authentication and authorization basics
Materials
07
Learn how to use a developer console in a browser (Inspector, Constructor, Network, and Memory tools)
Materials
08
Understand what a vulnerability is
Materials
09
Complete lab assignments on XSS using Burp Suite
Materials
Read related HackerOne reports that you can search in Google by typing site:hackerone.com "xss"
10
Complete lab assignments on Broken Access Control using Burp Suite
Materials
Read related HackerOne reports that you can search in Google by typing site:hackerone.com "idor"
11
Complete lab assignments on SSRF using Burp Suite
Materials
Read related HackerOne reports that you can search in Google by typing site:hackerone.com "ssrf"
12
Learn how to use basic console utilities: nuclei, waybackurls, subfinder, amass, nmap
Materials
13
Learn how to apply OSINT and reconnaissance methods for bug hunting
Materials
14
Get familiar with 10 publicly disclosed bugs on HackerOne
Materials
15
Study additional materials
Materials
Over time, methods become outdated, and attack techniques always evolve. We can't cover everything here, so we suggest that you follow decent resources to keep learning
START HUNTING WITH STANDOFF BUG BOUNTY
REGISTER ON STANDOFF BUG BOUNTY
CHOOSE A COMPANY AND PROGRAM
FIND A VULNERABILITY FOLLOWING THE PROGRAM RULES
REPORT THE DISCOVERED VULNERABILITY
GET A REWARD ONCE YOUR REPORT IS REVIEWED AND ACCEPTED
Tips for
bug hunters
bug hunters
Be sure to stick to a high standard in your report submissions. You can check out our recommendations in this YouTube video and this Habr article (both are in Russian). Remember: the more detailed and informative your report (PoC, screenshots), the faster the validation process.
1
Make an educated estimation about the severity of the vulnerability you've discovered. Think about how dangerous it could be for the company, how easily it could be exploited, and what impact it might have. This will help you figure out an approximate bounty.
2
Explore VK programs on Standoff Bug Bounty
Tips for
bug hunters
bug hunters
Keep an eye out for reports disclosed by other bug hunters (like the ones published at hackerone.com/hacktivity). You'll find plenty of insights in them.
1
Look out for business logic errors. They are quite common, but often overlooked.
2
Challenge yourself to dig deep and test hard-to-reach functionalities. Chances are that no one has gotten to them yet and there are more than a couple of bugs to find.
3
Join our Standoff 365 Telegram channel to get more tips for up-and-coming bug hunters.
Also check out the channel chat where you can get help and advice from our bug hunting community.