Listen to this Post
Introduction:
Bug bounty hunting has evolved from a niche hobby into a professional cybersecurity discipline, with platforms offering substantial rewards for critical vulnerability disclosures. This professional pursuit requires a deep toolkit of commands and techniques to identify, exploit, and report security flaws ethically.
Learning Objectives:
- Master fundamental and advanced command-line tools for reconnaissance and vulnerability assessment.
- Understand the practical application of commands for testing web application and API security.
- Develop a methodology for documenting and responsibly disclosing discovered vulnerabilities.
You Should Know:
1. Network Reconnaissance with Nmap
Nmap is the undisputed king of network discovery and security auditing. It is used to discover hosts and services on a computer network by sending packets and analyzing the responses.
`nmap -sC -sV -O -p- 192.168.1.1`
-sC: Runs a script scan using default NSE scripts. Useful for discovering common vulnerabilities.
-sV: Probes open ports to determine service/version information.
`-O`: Enables OS detection.
-p-: Scans all 65,535 ports, not just the common ones.
Step-by-step guide:
- Install Nmap if not present: `sudo apt-get install nmap` (Linux) or download from nmap.org (Windows).
2. Identify your target’s IP address or domain.
- Run the command above, substituting `192.168.1.1` with your target’s IP.
- Analyze the output for open ports, running services, versions, and OS details. This map will guide your entire attack surface assessment.
2. Subdomain Enumeration with Amass
Discovering subdomains is critical for expanding the attack surface. Amass is a powerful tool for network mapping and external asset discovery.
`amass enum -passive -d example.com`
`enum`: The subcommand for enumeration.
-passive: Performs a passive enumeration, avoiding direct contact with the target.
`-d`: Specifies the target domain.
Step-by-step guide:
- Install Amass: `sudo apt-get install amass` or via GitHub releases.
- Run the command to passively discover subdomains associated with
example.com. - The output will be a list of subdomains, which you can then feed into other tools for further analysis.
3. Content Discovery with FFuf
Fast web fuzzer (FFuf) is a blazing-fast tool for fuzzing web endpoints, useful for discovering hidden directories, files, and virtual hosts.
`ffuf -w /usr/share/wordlists/dirb/common.txt -u http://example.com/FUZZ -mc 200,403`
`-w`: Specifies the path to the wordlist.
-u: The target URL, with `FUZZ` indicating where to inject words.
-mc: Match HTTP status codes (e.g., 200 for success, 403 for forbidden).
Step-by-step guide:
- Install FFuf: `go install github.com/ffuf/ffuf@latest` or download a pre-compiled binary.
- Choose a wordlist (e.g., `common.txt` from Dirb, `directory-list-2.3-medium.txt` from SecLists).
- Execute the command. FFuf will rapidly test each word in the list and show you endpoints that exist on the server.
4. API Endpoint Analysis with curl and jq
APIs are a prime target. `curl` fetches resources, and `jq` parses JSON output, allowing you to probe and analyze API responses.
`curl -s -H “Authorization: Bearer TOKEN” http://api.example.com/v1/users | jq .`
`-s`: Silent mode.
-H: Adds a header (in this case, an Authorization header).
| jq .: Pipes the JSON output to `jq` for pretty-printing and analysis.
Step-by-step guide:
- Ensure `curl` and `jq` are installed (
sudo apt-get install curl jq). - Discover an API endpoint (e.g., through JS file analysis or documentation).
- Craft a `curl` request, often requiring specific headers like
Authorization,X-API-Key, orContent-Type: application/json. - Pipe the output to `jq` to easily read the structure and identify potential data exposure or interesting fields to target.
5. SQL Injection Testing with SQLmap
SQLmap automates the process of detecting and exploiting SQL injection flaws, a classic yet critical vulnerability.
`sqlmap -u “http://example.com/page?id=1” –batch –level=3 –risk=3`
-u: Target URL with a potentially injectable parameter.
--batch: Runs without requiring user input, using default behaviors.
--level/--risk: Increases the scope and depth of the tests.
Step-by-step guide:
- Crucial: Only run this on targets you are explicitly authorized to test.
- Identify a parameter that interacts with a database (e.g.,
?id=1,?user=admin). - Run the command, replacing the URL. SQLmap will automatically test the parameter and confirm if it’s vulnerable.
- Upon finding a vulnerability, you can use additional flags like `–dbs` to enumerate databases or `–os-shell` to attempt command execution.
6. Analyzing JavaScript for Hidden Secrets
Modern web apps ship logic and secrets within JavaScript files. Command-line tools can quickly sift through them.
`cat .js | grep -E “(api|key|token|secret|auth|password)” | sort -u`
cat .js: Concatenates the contents of all `.js` files in the current directory.
grep -E: Uses extended regex to search for patterns related to secrets.
sort -u: Sorts the results and removes duplicates.
Step-by-step guide:
- Use a tool like `wget` or a browser extension to download all JS files from a target application.
- Navigate to the directory containing the files in your terminal.
- Run the command. It will output any hardcoded strings that look like API keys, tokens, or other sensitive information, which are prime targets for exploitation.
7. Session and Cookie Security Analysis
Browser developer tools are essential, but the command line offers powerful scripting for analysis.
`curl -I -H “Cookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9” http://example.com/admin`
`-I`: Fetches headers only.
-H "Cookie: ...": Injects a specific session cookie.
Step-by-step guide:
- Log into a web application and capture your session cookie using browser dev tools (F12 > Application/Storage tab).
- Use `curl -I` to send a HEAD request to a privileged endpoint (e.g.,
/admin) without the cookie. Note the response (likely 302 Redirect or 403 Forbidden). - Re-run the command, adding the `-H “Cookie: session=YOUR_COOKIE”` header. If you now get a 200 OK, the session is valid. This is the basis for testing for insecure direct object references (IDOR) and privilege escalation by manipulating session values.
What Undercode Say:
- Tool mastery is only half the battle; the real skill lies in connecting the dots between the data these commands reveal to form a viable attack path.
- Ethical rigor is non-negotiable. Every command must be executed within the strict boundaries of authorized testing and responsible disclosure protocols.
The professionalization of bug bounty hunting signifies a major shift in cybersecurity defense. It crowdsources the identification of vulnerabilities to a global community of skilled ethical hackers, creating a scalable and continuous security assessment model. For hunters, success is no longer just about technical prowess but also about developing a professional methodology, from initial recon to clear, impactful reporting. The future of security will be shaped by this synergy between automated tools and human ingenuity.
Prediction:
The bug bounty economy will continue to mature, leading to increased specialization (e.g., API-specific hunters, IoT experts) and higher rewards for critical vulnerabilities in complex systems like cloud infrastructure and AI models. This will force organizations to adopt more proactive, continuous security postures, fundamentally integrating ethical hacking into the software development lifecycle (SDLC).
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Riya Nair – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
