Become a Bug Bounty Hunter

Dear readers,

Bug bounty programs are rapidly becoming popular, and with that come enormous opportunities for hackers or security specialists to earn rewards by using their skills to make the internet safer.

“How to get started in Bug Bounties?” is a common question nowadays, and we keep on getting messages about it every day. To meet expectations we decided to prepare a whole edition dedicated to the Bug Bounty Hunting topic. It is said that anyone with computer skills and a high degree of curiosity can become a successful finder of vulnerabilities. You can be young or old when you start. We hope that this edition will help you get started.

The magazine contains 12 interviews with people that went through the process of becoming a Bug Bounty Hunter and were willing to share their experience. While reading their stories you will learn about the best and most efficient tools for finding exploits, what resources are available for beginners, whether it's worth it to become part of the community to seek support. There is plenty of other information inside, and we hope that they will help in your own journey.

But that’s not all! Inside you will also find writeups on bug bounty findings. This more hands-on approach will show you how to use your skills in practice.

We would like to thank all participants for joining in this project. We appreciate it a lot! If you like this publication you can share it and tell your friends about it! Every comment means a lot to us. Thank you!

Enjoy the reading,

Hakin9 Editorial Team

This magazine is free to download, just register as a  free user and enjoy your reading!

Interview: German Namestnikov

Chain of hacks leading to Database Compromise! 

Avinash Jain

Interview: Wai Yan Aung

Account Takeover Using Cross-Site WebSocket Hijacking 

Sharan Panegav

Interview: Joas Antonio

Hacking into Tinder’s Premium Model

Sanskar Jethi

Interview: David Kosorok

Blocked User Can Send Notification Due to Logical Bug in Instagram

Divyanshu Shukla

Interview: Gaurang Bhatnagar

[Case Study] OAuth Misconfiguration leads to Account Takeover

Interview: Harmeet Bawa

Exposed JIRA server leaks NASA staff and project data! 

Avinash Jain

Interview: Faizal Abroni

The target application - Dropbox

Muhammad Asim Shahzad

Interview: Vishal Bharad

Account Takeover Through Password Reset Poisoning

Interview: Eka Syahwan

Vimeo SSRF with code execution potential

Harsh Jaiswal

Interview: Rakesh Mane

How Recon helped me to find a Facebook domain takeover

Sudhanshu Rajbhar

Interview: Júlio César

Interview: Shivam Kamboj Dattana