Okay, so the title may have been a little misleading but I promise you - the content is 100% relative. Whether you are new to the cyber security field or a long time vet, you have probably heard of a 'bug bounty'. Now, if you haven't heard of them before, they aren't too complex. Basically, a user finds a security flaw or weakness within a public piece of software, this could be a mobile application, web application etc. Once identified, the user will disclose the issues responsibly to the vendor and await their confirmation. Once confirmed, there may be an opportunity for a payout depending on the severity and validity of the issue. Bugs can range from informational, to critical, and are determined based on several factors (https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator).
Once confirmed by the vendor (commonly known as triaged), the vendor will fix and test the vulnerability. Once fixed, a payout can be made. This is the bounty.
There are several easy ways to get started with bug bounties, most of which start with signing up on a platform that helps make the process easier. Public programs are displayed freely to the user and agreed scopes are defined, as well as possible payments. A name you may have heard of before is 'HackerOne', a well structured, popular bug bounty program with thousands of hackers and millions of dollars worth of paid bounties. Not only do they have a large amount of public programs, users and a solid reputation, they also play host to a valuable academy (https://www.hacker101.com/) which helps newcomers, and veterans, clean up their skills and maybe learn a thing or two. If you are new to the field, I would highly recommend checking out the content and start digging around. You never know, you may find a few bugs along the way!
For anyone that does want to give it a go, I must warn you, it can take hundreds of hours of effort with potentially very little return. But, if you are like me and thrive on learning and enjoy the journey - it is 100% worth it!
Several platforms are free to use and sign up for. Have a look, have a read and dig in:
- https://www.hackerone.com/
- https://www.bugcrowd.com/
- https://www.intigriti.com/
- https://www.yeswehack.com/
The above list is not extensive, and more platforms can be found. But these are the ones I commonly hack on, and the feedback from the users/vendors is very positive across the board.
As everyone learns at their own pace, and enjoys doing different things, I can't really recommend a learning path or specific fields to study. I would suggest you sign up, run through the academy, pick a topic or bug type that you like the look of, join a public program and start chipping away. Take lots of notes to help track your progress and again, don't worry if you don't find anything or feel like you aren't making progress. I promise you, over time, it clicks.
A couple of common bugs that can be found in thousands of web applications include:
- Cross Site Scripting (XSS)
- Insecure Direct Object Reference (IDOR)
- Open Redirect
These may seem like jibberish at this time, but after some research and practice they will make more sense and should be a good place to start tracking down some bugs!
Final note, remember. Money isn't everything. If you want to start bug bounties just for quick cash, you might have a hard time. If you want to start it to learn, pursue a career in cybersecurity or even just as a hobby on the weekend - you will have far more enjoyment knowing the knowledge is the profit, and the bounty is a potential bonus!
Good luck :)