📋 Bug Bounty Testing Methodology

A systematic approach to finding security vulnerabilities - follow these 5 phases for comprehensive testing

🔍 Phase 1: Reconnaissance

🎯 Goals

Understand the target application's architecture, technology stack, and attack surface. Gather as much information as possible without directly interacting with the target yet.

📝 What to Test

🛠️ Tools

# Subdomain enumeration subfinder -d target.com -all -recursive assetfinder --subs-only target.com amass enum -d target.com # DNS reconnaissance dig target.com ANY dnsenum target.com # Certificate transparency curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq # Technology detection whatweb target.com wappalyzer # Wayback URLs waybackurls target.com gau target.com

⚠️ Common Mistakes

💭 Mindset

"The more you know about the target, the better your chances of finding vulnerabilities. Recon is where most bugs are found indirectly - through forgotten subdomains, exposed services, and legacy systems."

🗺️ Phase 2: Mapping & Enumeration

🎯 Goals

Map out all endpoints, parameters, and functionality. Understand how the application works, what data it processes, and how different components interact with each other.

📝 What to Test

🛠️ Tools

# Web crawling katana -u https://target.com -js-crawl -depth 3 gospider -s https://target.com -c 10 -d 3 # Content discovery ffuf -u https://target.com/FUZZ -w wordlist.txt dirsearch -u https://target.com # Parameter discovery arjun -u https://target.com paramspider -d target.com # JavaScript analysis subjs -i domains.txt python3 linkfinder.py -i https://target.com -o results.html # API enumeration kiterunner scan https://target.com -w routes.txt # Proxy/Manual exploration Burp Suite Pro OWASP ZAP

⚠️ Common Mistakes

💭 Mindset

"Every input field, every parameter, every endpoint is a potential vulnerability. The goal is to know the application better than its developers do."

🔎 Phase 3: Vulnerability Discovery

🎯 Goals

Actively test for security vulnerabilities using the information gathered in previous phases. Focus on high-impact bugs first, then work your way through the OWASP Top 10 and beyond.

📝 What to Test

🛠️ Tools

# Automated scanning nuclei -l targets.txt -t cves/ -t vulnerabilities/ nikto -h https://target.com # XSS testing dalfox url https://target.com/page?param=value XSStrike # SQLi testing sqlmap -u "https://target.com/page?id=1" --batch ghauri -u "https://target.com/page?id=1" # SSRF testing ssrfmap -r request.txt interactsh-client # Fuzzing ffuf -u https://target.com/FUZZ -w payloads.txt wfuzz -u https://target.com/?param=FUZZ -w xss.txt # Manual testing Burp Suite Intruder Burp Suite Repeater

⚠️ Common Mistakes

💭 Mindset

"Think like an attacker, not a pentester. Don't just test for textbook vulnerabilities - understand the business logic and find creative ways to abuse it. The best bugs are often found by asking 'What if I do this unexpected thing?'"

💥 Phase 4: Exploitation & Validation

🎯 Goals

Prove the impact of discovered vulnerabilities with proof-of-concept exploits. Validate that the bug is real and demonstrate its severity without causing harm.

📝 What to Test

🛠️ Tools

# Generate PoC curl, wget, Python requests Postman collections Custom scripts # Screenshots & recordings Burp Suite screenshot tool FFMPEG for video PoC Browser developer tools # Traffic analysis Wireshark tcpdump # Exploitation frameworks (for authorized testing only) Metasploit BeEF (Browser Exploitation Framework)

⚠️ Common Mistakes

💭 Mindset

"The goal isn't just to find a bug - it's to help the company understand why it matters. A well-documented PoC with clear impact is worth 10x more than a vague report."

📝 Phase 5: Reporting & Validation

🎯 Goals

Write professional, actionable reports that help developers understand and fix the vulnerability. Maintain good communication throughout the triage and remediation process.

📝 What to Include

🛠️ Report Template

**Title:** [Type] in [Feature] leads to [Impact] **Severity:** High **Description:** The application is vulnerable to [vulnerability type] in the [affected feature]. An attacker can exploit this to [describe attack scenario]. **Steps to Reproduce:** 1. Navigate to https://target.com/vulnerable-page 2. Enter the following payload in [parameter]: [payload] 3. Observe that [what happens] 4. This allows [describe impact] **Proof of Concept:** [Include curl command, screenshots, or video] **Impact:** This vulnerability allows an attacker to: - [Impact point 1] - [Impact point 2] - [Impact point 3] **Remediation:** To fix this vulnerability, consider: - [Recommendation 1] - [Recommendation 2] **References:** - OWASP: [relevant link] - CWE: [relevant CWE]

⚠️ Common Mistakes

💭 Mindset

"You're helping the company, not attacking them. Professional, detailed reports build your reputation and lead to higher rewards. Remember: triagers are human too - treat them with respect and patience."

💡 Overall Best Practices