So now that you know how to find
valid bug bounty programs that are legal to test
and how to actually go ahead and test these programs,
'cause that's what we covered in the whole course,
let's assume that you actually managed to discover a bug
and you wanna go ahead and submit a report for that bug.
Now, before you go ahead
and think about submitting the report
there is a few things that you need to make sure
that you have satisfied.
First of all, you wanna make sure
that the vulnerability is valid.
Sometimes people discover bugs or not even vulnerabilities,
they will be bugs that are actually part
of the execution of the program or they're not actual bugs.
So you wanna make sure that what you discovered is valid
because there is nothing more embarrassing
than send a report thinking that you discovered something
and it's actually not a real valid bug,
it's just a misunderstanding from your side.
The next thing that you wanna make sure is
that you wanna make sure that the vulnerability is in scope.
And I mentioned that a few times in the previous lecture
but this is very, very important because like I said,
first of all it's illegal
to testings that are outside of the scope.
Second, you're gonna be wasting your time testing stuff
outside of the scope.
And third, you will never get a bounty for it.
Sometimes you would, but in most cases you will not.
You will just piss off the people that are managing
the bug bounty program.
So once you make sure that you discovered an actual bug
or vulnerability that is within scope, you wanna go ahead
to the program that you discovered the bug in.
So we're assuming you discovered it in this program, ZSVPN,
and you're gonna have to click on submit the report.
Now obviously you're gonna have to be signed in
to be able to do this,
and once you do this you can see the process
is simple enough.
So you have your name, you have your email
and you have a paragraph
in here where you're supposed to detail your discovery.
Now this could be slightly different dependent
on the program as well.
When you click on submit, you will actually see information
in here telling you exactly what they want
and you will be simply fill in in the blank.
Other programs
you might simply just have a blank right here
and you have to fill it your way.
But it's very important to remember
that once you submit this, whatever report I have,
once I submit it, it's gonna have to go through
a review process where somebody is gonna have to read it.
They will have to manually validate whatever
that you wrote in here.
If they cannot reproduce whatever you did
they will get back to you, ask you questions,
and you'll have to provide answers.
And then they go ahead and perform more tests trying
to replicate what you're saying.
And all of that results into you waiting for longer for
your bugs to be validated and for you to get your bounty.
That's why it is very important to actually provide as much
details as possible so that whenever they read
the report for the first time, they will fully understand
what you mean and they will be able to reproduce your bug
without having to ask you any questions and therefore,
you will get your bounty much quicker.
So you wanna provide as much details as possible,
you wanna provide screenshots, and I actually prefer
and love to provide videos.
And I know from our own team that they love to see videos
because once we see a video we can see everything we want.
So it's even better than screenshots
because we can see all of the requests,
we can see the full process that you're going through
and we can easily see whether the bug
that you are submitting is valid or not
and whether it is in scope or not.
And that's why we will be able to respond
to you very quickly and hopefully you'll be able to
get your bounty much quicker.
So even like I said,
there are some programs that will give you notes in here
and just telling you to fill the blank
into what they're asking for.
I would still at the end of all of that provide more details
if I felt like there is more details needed.
And I would always, always provide a video because that,
like I said, increases the chances
of them fully understanding what I'm saying
and giving me my bounty as quickly as possible.
We're just gonna write whatever in here,
we're just gonna say test, test.
I just wanna show you what this is gonna look like.
We're gonna say that we're not a robot, we're gonna agree
to the terms, and submit the bounty or the report.
And as you can see, you're gonna get more information
on how this process is gonna go.
So your report is gonna be manually reviewed
and that's why we said you wanna provide
as much information as possible.
If it's valid, it's gonna change to awaiting payment.
So that means that the team agreed
that you discovered a valid bug and right now you're
in the process of receiving your payment.
Once the payment is received from the company
it'll transfer to you and the status
of the submission is gonna change to paid,
and then the company is gonna be able to see your report.
So during all of these steps
the company is not gonna be able to see your report.
We will be the only ones that will see your report
and only once the company pays the bounty
if it was a valid report,
they will be able to see the report.
Now you can actually go back and go to my reports in here
and you'll be able to
see the submission that we just submitted.
We can see the date,
we can see that the status right now is spending approval.
And if you click on view you'll see the content.
So obviously there'll be much more
if you submitted a real valid bug.
And if the team did not understand the bug
or the report that you sent, they will be writing a reply
for you here where you could also reply
to them and add more attachments.
And that's why I said
if you don't provide enough information,
this could go for very long
and then you'll be waiting for your bounty for longer.
That's why make sure that you provide as much information
as possible.
And that's it, this is really as simple as it gets.
Let me quickly show you an example of submitting a report
in HackerOne.
So this is an example of Linktree.
And we're gonna click on submit report.
And like I said, the submit report changes
dependent on the company.
So this one might look a bit more complex than
other companies because this is the way that they
want it to be.
So in here they're asking you for the asset,
the domain that you discover the bug in.
So let's just just click the first one
assuming we discovered above in here.
And then the next thing that is gonna ask you what type
of a weakness it is.
So let's say it is an access vulnerability.
And then it's asking you to give it a rating.
It's optional 'cause they will be modifying this
once they get the response.
So you can leave this or you can set it if you want.
And then you're gonna get
to the part that we were talking about.
So you wanna give it a title.
We're gonna say XSS, for example,
you discovered a reflected XSS or whatever.
Again, always provide as much information as possible,
give meaningful names, even the title,
make sure it is meaningful.
All of this makes it easier to review your report
which will result into you getting your bounty quicker.
And then in here you can see
that they are actually telling you what they want.
So they're kind of making it seem
like it's a fill the blank kind of thing.
So you have to give them the steps in here,
they're asking for the attachments in here,
and then you wanna write the impact in here as well.
What were you able to do with that vulnerability?
Now there is programs where this could be much longer
where you will have to write so much more
than what they're asking in here.
So this is kind of just the basic stuff that you
would get asked for anyway.
You would've provided this anyway.
But like I said, even
if they are not asking for a lot of information
make sure you put a video and make sure you put screenshots
and provide as much information as possible.
If you scroll down again, there's some optional stuff,
how long it took you to discover it,
it's not really that important.
And then in many other cases, for example,
if you look at the PayPal program
there is much more information that you will be asked for
but nothing out of the ordinary.
If you manage to discover a bug in that platform
then you are familiar enough with it
and you will be able to fill up that information based on
the bug that you discovered.
So again, do not get intimidated by HackerOne.
It's a much bigger platform.
I would highly recommend starting with smaller platforms
like Bug Bounty and other smaller ones
and then build up your skills, build up your confidence
and move on to bigger bug bounty platforms
or bigger bug bounty programs.
But at the same time, there is no harm into signing up
to all of these platforms because like I said,
the more platforms you sign up for,
the more programs that you have,
therefore you have more platforms to test
and therefore your chances
of discovering bugs and getting bounties are much higher.