← Back to Home
Bug Bounty Hunter
Learning roadmap untuk menjadi bug bounty hunter
Phase 1
Fundamentals
HTTP/HTTPS Protocol
Request/response, headers, cookies, sessions, status codes
HTML, CSS, JavaScript Basics
DOM manipulation, form handling, client-side logic
Networking Basics
DNS, TCP/IP, ports, subnets, proxies
Linux Command Line
File system, permissions, bash scripting, SSH
How Web Apps Work
Frontend vs backend, APIs, databases, authentication flow
Phase 2
Reconnaissance
Subdomain Enumeration
Subfinder, Amass, crt.sh, brute-forcing subdomains
Port Scanning
Nmap, Masscan, identifying running services
Directory & File Discovery
Dirsearch, Gobuster, ffuf, wordlist selection
Technology Fingerprinting
Wappalyzer, WhatWeb, identifying CMS and frameworks
Google Dorking & OSINT
Advanced search operators, Shodan, Censys, archived pages
JavaScript Analysis
Finding endpoints, API keys, and secrets in JS files
Phase 3
Common Vulnerabilities
Cross-Site Scripting (XSS)
Reflected, Stored, DOM-based XSS, filter bypass, CSP bypass
SQL Injection
Union-based, blind, time-based, error-based, second-order SQLi
Server-Side Request Forgery (SSRF)
Internal service access, cloud metadata, protocol smuggling
Insecure Direct Object Reference (IDOR)
Broken access control, horizontal/vertical privilege escalation
Authentication Bypass
Broken auth, JWT attacks, OAuth misconfigurations, 2FA bypass
Cross-Site Request Forgery (CSRF)
Token bypass, SameSite cookies, clickjacking chains
File Upload Vulnerabilities
Extension bypass, content-type tricks, webshell upload
Phase 4
Advanced Techniques
Race Conditions
TOCTOU bugs, limit bypass, double-spending in web apps
Deserialization Attacks
Java, PHP, Python deserialization, gadget chains
Template Injection (SSTI)
Jinja2, Twig, Freemarker, server-side template exploitation
GraphQL Attacks
Introspection, batching, injection, authorization bypass
API Security Testing
REST/GraphQL fuzzing, broken object-level authorization (BOLA)
Business Logic Flaws
Price manipulation, coupon abuse, workflow bypass
Subdomain Takeover
Dangling DNS records, cloud service takeover
Phase 5
Reporting & Bounty Platforms
Writing Good Reports
Clear title, reproduction steps, impact assessment, PoC
Bug Bounty Platforms
HackerOne, Bugcrowd, Intigriti, YesWeHack, program selection
Severity & CVSS Scoring
Understanding critical/high/medium/low, CVSS calculator
Responsible Disclosure
Ethics, rules of engagement, legal considerations
Building Your Portfolio
Blog writeups, CVEs, public disclosures, building reputation