Listen to this Post
Introduction:
Bug bounty hunting is a high-stakes field where meticulous methodology and a deep toolkit separate beginners from elite researchers. By mastering a core set of commands and techniques across reconnaissance, vulnerability identification, and exploitation, security professionals can systematically uncover critical flaws that automated scanners miss.
Learning Objectives:
- Master a professional-grade reconnaissance workflow to discover hidden assets and endpoints.
- Identify and exploit common web application vulnerabilities like SQL injection and XSS.
- Utilize advanced command-line tools for efficient vulnerability assessment and validation.
You Should Know:
1. The Art of Subdomain Enumeration
Reconnaissance is the foundation of any successful bug bounty hunt. Discovering all associated subdomains dramatically expands the attack surface.
`$ subfinder -d target.com -o subdomains.txt`
`$ amass enum -passive -d target.com -o amass_subs.txt`
`$ assetfinder –subs-only target.com | tee assetfinder_subs.txt`
Step-by-step guide:
- Install the Tools: These tools (Subfinder, Amass, Assetfinder) are often available via package managers like `apt` or
go install. - Run Passive Enumeration: Execute the commands above, replacing `target.com` with your target domain. Each tool uses different data sources (certificate transparency logs, DNS, etc.) to discover subdomains without sending direct traffic to the target.
- Combine and Sort Results: Merge the results from all tools and remove duplicates.
`$ cat subdomains.txt amass_subs.txt assetfinder_subs.txt | sort -u > all_subs.txt`
4. Probe for Live Hosts: Use a tool like `httpx` to filter the list for live websites and web services.
`$ cat all_subs.txt | httpx -silent -o live_subs.txt`
2. Probing for Hidden Endpoints and APIs
Directories and files not linked from the main application are prime targets for discovery.
`$ gobuster dir -u https://target.com/ -w /usr/share/wordlists/dirb/common.txt -t 50`
`$ ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -u https://target.com/FUZZ -mc 200,301,302,403`
`$ nuclei -u https://target.com/ -t /path/to/nuclei-templates/exposures/`
Step-by-step guide:
- Choose Your Wordlist: Wordlists like `common.txt` or `raft-large-files.txt` contain common paths (e.g.,
/admin,/api,/config.json). - Run the Fuzzer: Execute `gobuster` or
ffuf. These tools iterate through the wordlist, sending requests to the target and reporting interesting responses (e.g., 200 OK, 403 Forbidden, 301 Redirect). - Analyze Results: Manually inspect every discovered endpoint. A 403 might be bypassable. A 302 might lead to a hidden login panel. Use `nuclei` with specific templates to automatically check for common exposed files.
3. The Hunter’s Eye: Identifying SQL Injection Flaws
SQL Injection remains a critical vulnerability, allowing attackers to manipulate database queries.
`$ sqlmap -u “https://target.com/page?id=1” –batch –level=3 –risk=3`
` Manual test: https://target.com/page?id=1’`
` Manual test: https://target.com/page?id=1′ AND ‘1’=’1′– -`
Step-by-step guide:
- Parameter Identification: Find all input fields (URL parameters, form fields, cookies).
- Initial Probing: Append a single quote (
') to the parameter value. Look for SQL errors, odd behavior, or a different HTTP response code. - Boolean Test: Test with a true condition (
' AND '1'='1) and a false condition (' AND '1'='2). If the page content changes between the two requests, it’s likely vulnerable. - Automate with Sqlmap: Feed the potentially vulnerable URL to
sqlmap. The `–batch` flag runs non-interactively, while `–level` and `–risk` increase the thoroughness of tests.
4. Cross-Site Scripting (XSS) Payload Crafting and Validation
XSS vulnerabilities allow attackers to execute malicious scripts in a victim’s browser.
` Basic payload test: `
` DOM-based test: 
`
`$ dalfox url “https://target.com/search?q=test”`
`$ nuclei -u https://target.com/ -t /path/to/nuclei-templates/xss/`
Step-by-step guide:
- Find Reflection Points: Identify every user-input point where data is reflected in the response HTML.
- Test Basic Payloads: Input simple payloads like
<script>alert(1)</script>. Observe if the script executes or is sanitized. - Context-Aware Testing: If your input is reflected inside an HTML attribute, you may need to break out:
" onmouseover="alert(1)". - Automate Discovery: Tools like `Dalfox` and `nuclei` can automatically probe parameters with a wide array of payloads, often catching more complex flaws.
5. Server-Side Request Forgery (SSRF) Exploitation
SSRF forces a server to make HTTP requests to an arbitrary domain of the attacker’s choosing, potentially accessing internal services.
` Basic test: http://169.254.169.254/latest/meta-data/`
` Using a collaborator: http://burpcollaborator.net`
`$ ffuf -w internal_ips.txt -u http://target.com/export?url=http://FUZZ:8080 -mr “success”`
Step-by-step guide:
- Find Vulnerable Parameters: Look for parameters that take URLs (e.g.,
url=,api=,export=). - Test with Internal IPs: Try replacing the URL with known internal IP addresses like `127.0.0.1` (localhost) or cloud metadata endpoints (
169.254.169.254). - Use a Collaborator: Use Burp Suite’s Collaborator or a similar tool to generate a unique domain. Submit this in the parameter. If the server makes a request to your domain, it is vulnerable and you will receive a DNS/HTTP interaction.
- Port Scan Internals: Use `ffuf` with a wordlist of internal IPs or hostnames to probe for open ports on the internal network.
6. Cloud Metadata API Exploitation
Cloud instances often have a metadata API accessible that can leak sensitive credentials, a common misconfiguration.
$ curl http://169.254.169.254/latest/meta-data/`$ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/`
`$ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
Step-by-step guide:
- Identify a Potential Vector: Find an SSRF vulnerability or a misconfigured application that allows you to make web requests from the server.
- Query the Metadata Endpoint: The standard endpoint for AWS is `http://169.254.169.254/`. A successful query will return available data paths.
- Traverse the API: Navigate the API paths. The most critical is
/latest/meta-data/iam/security-credentials/, which will list IAM roles. Querying a specific role will return temporary access keys, secret keys, and a token. - Use the Credentials: These credentials can be configured in the AWS CLI to gain access to the cloud environment:
aws configure --profile target_ssrf.
7. Validating JWT Tokens
JSON Web Tokens (JWTs) are common for authentication. Misconfigurations can lead to privilege escalation.
Check for the "none" algorithm vulnerability. Decode the token and change the alg to "none".
Use john-the-ripper to crack a weak JWT secret:
<h2 style="color: yellow;">$ john jwt.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=HMAC-SHA256
Step-by-step guide:
- Decode the Token: Use a tool like `jwt.io` to decode the token (header, payload, signature) without validating it.
- Test for Algorithm Confusion: If the `alg` field is set to
none, try removing the signature entirely and see if the application accepts it. - Crack the Secret: If the token uses a weak secret (HS256), you can offline crack it using `john` with a large wordlist. Once cracked, you can forge valid tokens for any user.
- Test for Kid Manipulation: If the header uses a `kid` (Key ID) parameter, try path traversal attacks (e.g.,
"kid": "../../../dev/null") to force the application to use a predictable key for verification.
What Undercode Say:
- Methodology Over Tools: Success is 10% tools and 90% process. A structured approach—recon, enumeration, fuzzing, manual testing—is irreplaceable. Tools simply automate parts of this process.
- Persistence is Key: Consistency in learning and testing, as highlighted by the researcher’s 21 HOFs, is the true differentiator. The deepest vulnerabilities are found by those who patiently explore beyond the obvious.
The journey to becoming a top bug hunter is not about knowing one magic trick. It is the rigorous application of a broad skill set, combining automated reconnaissance with deep, manual analysis. The commands listed are the fundamental building blocks of this process. Mastery comes from understanding not just what each command does, but when and why to use it, and—most importantly—how to interpret the results to guide your next step. This iterative, inquisitive mindset is what turns a script runner into a security researcher.
Prediction:
The automation of vulnerability discovery through AI-powered tools like Nuclei will raise the baseline skill required for bug bounty success. While low-hanging fruit will be automated away, the future will belong to hunters who can chain together complex, business-logic flaws that AI cannot yet comprehend. This will create a two-tiered ecosystem: automated tool users finding minimal rewards and deep thinkers commanding premium payouts for uncovering critical, novel attack chains.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Muralidharan K – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
