My Bug Bounty Diary

Why I Started Bug Bounty

Hey everyone! I'm a cybersecurity student, and like many of you, I've spent the last few years consuming many articles and videos about ethical hacking. But theory can only take you so far. That's why I took an intensive 10-day bug bounty training.

This first post is the start of my journey sharing my experience, the tools I'm learning, and the real "Aha!" moments of Day 1.

What Exactly is a Bug Bounty?

Before you can hunt, you need to understand the game. Bug bounty programs are an essential part of modern security.

Definition :

Bug bounty programs are crowdsourced security initiatives where ethical hackers identify and report security vulnerabilities in an organization's systems in exchange for recognition or monetary reward.

Think of a bug bounty as a "Wanted Poster" for software flaws. A company basically says: "We know we have weaknesses, but we can't find them all. We'll pay you, a skilled ethical hacker, to find the holes before the bad guys do." You get paid, the company gets secure, and you build an amazing resume. It's a win-win-win!

The Hunter's Starter Kit:

​Burp Suite:

This is the essential HTTP intercepting proxy. It sits between your browser and the website, allowing you to see, intercept, and modify all the traffic. You cannot do serious bug hunting without it.

​Subfinder:

This tool is used for Subdomain Enumeration. Its purpose is to find every single sub-domain (like blog.target.com or test.target.com) that belongs to your target domain.

​httpx:

This powerful tool's purpose is to filter the huge list of subdomains you get from subfinder and quickly check which ones are actually live and running, eliminating dead links and saving time.

​waybackurls:

This tool's purpose is to fetch historical, archived URLs and endpoints from the Internet Archive's Wayback Machine. This is crucial for finding old, forgotten files.

​ReconFTW (Automation):

While I only fully dive into this later, it's the ultimate goal. Its purpose is to automate the entire reconnaissance process, allowing you to focus on testing, not just data gathering.

Mastering Reconnaissance (Finding the Forgotten Targets)

"You can't hack what you can't see."

Recon is the process of mapping out a company's entire digital footprint. We focused on two main techniques:

1. Subdomain Enumeration:

The Goal: A company might have a secured main website, but a forgotten, old subdomain (e.g., test.target.com) running outdated software.

The Process: We used subfinder to recursively search for every subdomain, and then used httpx to filter that list down to live websites. This dramatically expands the size of our attack surface.

2. The Wayback Machine:

This was the most eye-opening lesson. I learned that the Internet Archive's Wayback Machine isn't just for looking at old Geocities pages.

The Trick: Developers sometimes upload highly sensitive files (like database backups, configuration files, or temporary credentials) and forget to remove them. Even if they're removed from the live site, the Wayback Machine often has an archived copy of the link.

The Hunt: We learned to pipe our target domain into waybackurls and then use grep (a command-line search utility) to specifically hunt for critical file extensions: .sql, .env, .pdf, .zip, and .git. Finding one of these files is instant gold.

In summary, Day 1 taught me that the best bug hunters are excellent digital detectives. I didn't find a Remote Code Execution bug, but I learned how to find the forgotten corner of the internet where those bugs are hiding.