As mentioned in the previous lecture,
HackerOne is a really nice platform,
but it's really big
and that's why it might be intimidating
for someone that is just starting bug hunting,
like yourself.
That's why you should create an account
and have a look at it,
but do not limit yourself to it.
So again, as I said, if you do a quick Google search
you'll find a lot of other bug bounty platforms.
And there is no harm into signing up
to as many as these platforms.
Because once you sign up to them,
you will be able to participate in more programs,
which will increase your chances
of actually discovering bugs
and cashing out more bounties.
Anyway, signing up is free
in all of these bug bounty platforms,
so you've got nothing to lose.
So in my opinion,
smaller bug bounty platforms, such as bugbounty.com,
which is the platform that we run ourselves,
or Integrity right here,
are better places for you to start bug hunting.
Now, there's also Bugcrowd.
It's pretty much as big as HackerOne.
So again, you should spend some time
signing up and seeing the programs,
but I don't think this is a great place
to start with as well.
And honestly, in my opinion,
not because we are the owners of Bug Bounty,
but I really do think it's a great place to start,
because this is a very new bug bounty platform
that we only created recently,
and right now there aren't that many programs on it
and that's why our chances
of discovering bugs in them is pretty high.
You're not gonna make a lot of money
because the bounty or the rewards are pretty low.
But like I said in the previous lecture,
these should be the programs that you target
as someone that is only starting,
because your chances of discovering bugs in here are higher
and you're gonna get familiar
with the process of discovering bugs,
sticking to the scope,
and then once you have better experience,
you can move on and start discovering bugs
and vulnerabilities in bigger platforms.
But anyway, what you learned from the previous lecture
will apply in here and in any bug bounty platform
that I'm gonna show you.
So I'm only gonna show you this one in this lecture
and we're gonna leave it at that
because I'm gonna be repeating myself after that.
So the process is the same.
You wanna, first of all, as a hacker,
you wanna register,
hunt for books, and then get your money,
get your bounties.
So, you wanna click on register to register.
You wanna make sure you register as a hacker.
You put your username, your email, your password,
your register, you're gonna get an email to verify.
Like I said, I'm not gonna cover this process
because it's very, very simple.
And once you're registered,
you can click on login
and log in with the information
that you're registered with.
So I'm gonna put my email
and I'm gonna put my password.
This is just a test account that I made for this.
And once you're logged in,
you're gonna be redirected to your dashboard.
You have a badge.
So this is a new, I only started, so I'm level one.
Because there is a leaderboard,
so there is a gamification element of this
to see the best hackers,
the ones that discovered the most bugs.
You can see my score, zero points,
that just started, my email.
You could see my reports in here.
So that's the reports that I submitted.
And we're gonna talk about report submission
in the next lecture.
How to actually formalize
and write a bug report.
Here, you'll have your saved programs
if you saved anything.
Alerts, you can set up your alerts
for whenever there's a new program.
You can review companies and you can work as an affiliate.
So if you work as an affiliate and get us companies,
you actually get 30% of whatever they pay.
But anyway, that's not the point of this lecture.
So the point of this lecture is to show you this platform.
So the main thing you wanna go to
is click programs to have a look
at the available programs.
And as you can see from the get go,
you can see that this is similar to HackerOne, but simpler.
So our searching here is much simpler.
The categories are also simpler.
Like I said, this is a much smaller website.
And if you click on one of these programs,
for example Crew Clothing right here,
again, similar to HackerOne.
You're gonna see an overview of the company,
this scope, so what's allowed to be tested.
You could see some important notes.
That you're not supposed
to use automated tools, for example.
Some rules about the JavaScript vulnerabilities
and that they don't want a simple alert,
they want more.
So they want you to see that you're able
to access cookies or demonstrate more impact.
You can see what's out of scope.
And you can see there is a lot of things out of scope.
So like I said, you wanna make sure
you stick to this and not do any of the things
mentioned in here because they are out scope.
So first of all, you're breaking the law.
And second, you're not gonna get your bounty for it.
You can see some notes about your submission,
how to formalize your submission.
We will talk more about that in the next lecture.
But like I said, in general,
the information that you see in here
is always different, depending on the program.
So some programs will not even give you submission notes
or what they are looking for submission,
and we'll talk about that later in the next lecture.
But the main thing is,
as you can see you simply have bug bounty programs.
You select which one you wanna test from here.
And as mentioned in the previous lecture,
you wanna spend some time going through the programs,
seeing which one is more appropriate for you.
So as you can see, this one has more details.
It's detailing how much is gonna be paid
for each type of vulnerability
for the low, medium, and high,
similar to what we seen previously.
It's being very concrete on what's considered
as low, medium, and high,
so that you know what you discover
where it's gonna fall within these vulnerabilities
and how much you will be paid for it.
You can also see here, it's very important
in the out of scope that the desktop application
and the mobile application are not in scope.
So again, if you go to this website, the ZSVPN,
it's a VPN company.
You'll notice that we have desktop
and mobile applications
and you might wanna go and test them.
And if you spend time, you test them,
and you discover something,
you still will not be paid anything
because it's clearly mentioned in here
that it is out of scope.
So anyway, the idea is the same.
Spend some time, go through the programs,
see which one is most appropriate for you.
And then once you select a program,
you wanna go ahead
and start discovering bugs and vulnerabilities.
Stick into the scope
and employing all the information
that I covered in my course.
And if you want, you can employ my method
of discovering bugs that I showed you before.
How I load the website first, get a feel of it,
and then start testing every single functionality.
And then proxy stuff through Burp,
get more information,
and then do a bit of manual testing.
And then once the process is a bit boring,
you could offset that to the intruder with Burp
until you discover something.
Once you discover a valid bug or vulnerability,
you wanna come back and click on submit report
to submit your report.
And I will cover how to do that
in the next lecture.