The top 9 bug bounty resources to stay up to date
In this episode, we will explore the best bug bounty resources and how you can properly use them to efficiently stay up to date. Some are robust resources provided by the bug bounty platforms and the community. Others are general websites which you can customize to fit your bug bounty needs.
Last time we talked about how bad habits lead to burnout. In this episode, we will explore the best bug bounty resources and how you can properly use them to efficiently stay up to date. Some are robust resources provided by the bug bounty platforms and the community. Others are general websites which you can customize to fit your bug bounty needs.
Why and how should you stay up to date in bug bounty hunting?
I can’t stress it enough, but staying up to date is essential in this career. As we saw in the first episode where we discussed the bug bounty ecosystem, the community here is so active! Every day, it produces new tools, discloses new reports, publishes new videos, tweets about all kinds of bug bounty tips, and the list goes on and on forever.
It’s easy to get lost in the huge amount of information. That’s why it’s important to be strategic in your choices. The idea is to maximize your return on the time you invest. Besides, you should pick the channels that suit your taste. Some prefer to engage in forums, others like to use social networks, while other bug bounty hunters combine them all. It all depends on your favourite style of learning.
Hacktivity is your first bug bounty resource
What’s better than reading findings of other bug bounty hunters? They can teach you a lot in one shot. Firstly, you learn how to practically exploit a vulnerability. Secondly, you understand the hacker’s thinking process. Finally, you get to know how to write a good report. Well, this is all possible thanks to Hackerone’s Hacktivity.
What is Hacktivity?
This awesome feature allows the bug bounty hunter and the hacked program to agree on disclosing the report to the public. When they do, the report automatically gets published on Hacktivity. You can sort them by popularity or age, filter them or search through them using keywords. You can even vote for the reports you like to increase their popularity!
How do I use Hacktivity?
By default, Hacktivity shows you all popular disclosed reports, which are not necessarily the latest. That’s why you can sort by age to see the latest reports first. However, this can result in irrelevant reports.
If I’m looking for inspiration, I search for specific keywords, like SQL injection or Sensitive data exposure. When I find a great report, I usually follow the bug bounty hunter. Next time I use Hacktivity, I sort the reports by age and filter only the hackers I follow to see just the new best reports. This will reduce the noise significantly.
Bug bounty resources for real-time interactions between hackers
If you feel alone when you hunt for bugs, one of the great ways to get updates and combat loneliness is to engage with the bug bounty community. There are many ways you can do that.
For instance, the Hacker101 Discord server allows you to connect in real-time with nearly two thousand active members in the bug bounty community. You can ask questions, read new posts, chat with specific bug bounty hunters, and many more. The topics are not restricted to bug bounty hunting only but cover hacking in general. Who knows, you might find your hacking buddy there!
Another place you can engage with the bug bounty community is Bugcrowd’s forum. If you enjoy learning and interacting using forums, this one is full of bug bounty topics. From how to get started to how to report a bug, it’s all there!
Turning Twitter into a Bug bounty resource
Although I’m not a big fan of social networks, I use Twitter every day. That’s because I think most of the bug bounty community is active there. When I first started using Twitter, I followed big names in bug bounties and my feed got flooded with tweets. However, most of them were noise and I realized that I’m spending too much time and effort reading irrelevant tweets.
If you are struggling as I did, I got you covered! First, unfollow all the accounts which generate noise. Then, create a list where you add only the tweets related to bug bounty tips. There are many bots which collect tweets based on such hashtags. For instance, I am using @TheBugBot. Finally, add blacklist expressions to filter out any patterns of irrelevant tweets which you don’t find interesting. For example, Hackerone allows you to tweet about your bounties when you get one. They use a pattern like “Yay! I was awarded X amount of money”. So I just blacklist the expression “Yay! I was awarded”.
Bug bounty newsletters are great resources
If you get overwhelmed with online discussion spaces and forums, you might prefer subscribing to newsletters instead and receive updates about bug bounty content directly to your email inbox. Rest assured, the community has your back here as well.
For example, the Pentester Land’s newsletter is one of the best newsletters in the bug bounty world! It sends you a weekly curated list of the best bug bounty content. I recommend you give it a try and take your time reading most of the content you receive. Trust me when I tell you that it’s worth it!
If you want to see through the eyes of a bug bounty hunter, you can also subscribe to thehackerish newsletter and get updates about bug bounty related topics from my humble experience.
Bug bounty resources for practice
Reading bug bounty content is good, but developing new skills through practice is far better. After all, you can’t find a security flaw in a bug bounty program without knowing how to practically exploit them. Guess what, the community shines in this area as well!
Portswigger Academy as a bug bounty resource
This online learning platform is a gold mine for every bug bounty hunter! Developed by the creators of the famous BurpSuite web proxy, it teaches you security vulnerabilities and bug bounty step by step, both in theory and practice. The best part is that it’s free!
If you want to learn a new security vulnerability, make sure to check if they have it there first. You will thank me later.
The great Hacker101 bug bounty resource
There are many online hacking platforms, which we will explore on another occasion. However, the most relevant in the context of this episode is the Hacker101 platform. In fact, it’s a great bug bounty training resource which offers great bug bounty tutorials in the form of videos, as well as a free playground for hackers to practice their skills. The idea is simple, you solve challenges and collect points based on the level of difficulty. When you accumulate a certain number of points, you earn a private invite from a bug bounty program. This is your best go-to if you’re wondering how to start bug bounty in Hackerone.
PentesterLab membership
If you’d like to invest in yourself, PentesterLab is a great bug bounty resource. In fact, it’s a membership platform which teaches you hacking skills through pragmatic bug bounty-like challenges. There are some free topics which you can learn from. However, the Pro version provides you with ready-to-use labs and more interesting bug bounty tips.
Conclusion
As you might have noticed, there are so many bug bounty resources you can choose from to stay at the edge of your career and continue to find meaningful bugs. I’m sure there are other resources, but I feel these are the most important ones in my opinion.
If you use other interesting bug bounty resources and you’d like to share them with the community, feel free to drop a comment. I’ll make sure to include them in my next episode. Until then, stay curious, keep learning, and go find some bugs!