Bug Bounty Hunter
Pick a target, find a class of bug the automated scanners missed, and write it up so it gets triaged rather than closed.
- Level
- Intermediate
- Modules
- 5
- Lessons
- 38
- Time
- 32h
This path assumes you already know how to find a vulnerability and focuses on the two things that actually decide bounty income: choosing where to look, and demonstrating impact. It is honest about the economics. Most reports are duplicates or informational, and the modules on scope reading and impact demonstration exist because that is where the difference between a paid report and an unpaid one is made.
Roles and prerequisites
Roles
- Bug bounty hunter
- Penetration tester
- Security researcher
Aligned with
- PortSwigger BSCP
Before you start
- Completed the Web Application Penetration Tester path, or equivalent experience
- Able to read and modify a short script in Python or Bash
The modules, in order
Order is the pedagogy here rather than a gate. Each module assumes the one before it.
Reading a programme scope
What "in scope" means in practice, where the ambiguities are, and the classes a programme has already decided it will not pay for.
5 lessons · 2h 0m
Reconnaissance at scale
Subdomain and asset discovery, change monitoring, and building a pipeline that tells you when a target changes.
8 lessons · 4h 50m
Business logic and access control
The classes scanners cannot find, because they require knowing what the application is for.
10 lessons · 5h 50m · 1 lab
Chaining for impact
Turning a low-severity primitive into a demonstrated consequence, which is the entire difference between informational and paid.
9 lessons · 4h 10m · 1 lab
Writing for a triager
Reproduction steps that work on the first attempt, an impact statement that survives scrutiny, and how to handle a disagreement about severity.
6 lessons · 3h 30m
What you will be able to do
- Scope and programme selection
- Reconnaissance at scale
- Business logic testing
- Impact demonstration
- Report writing for triage
Terms this path relies on
Free to read, no account needed. Worth skimming before module one.
Cyber VK Security Curriculum
Pre-publication content owner
Internal ownership label for the web-security curriculum.
Technically reviewed by Cyber VK Lab Engineering
Updated
[ Related ]
- Learning pathWeb Application Penetration Tester pathTest a web application end to end and write a finding a developer can act on without asking you a follow-up question.
- Learning pathSOC Analyst pathTriage an alert to a decision, with the evidence written down, inside the time a real queue gives you.