It is important to note that no course/book/video or spell will teach you how to be a bug bounty hunter. Learning is not linear, you could choose to learn about security, do some CTF’s and begin to find bugs. Don’t spend so much time trying to accumulate knowledge just start practicing you are gonna learn along the way. You really need to immerse yourself in hacking, listen to podcasts and read blogs this will help to engage your brain into technical activities. Read disclosure reports, write-ups to understand other people’s line of thinking. Following the top hackers on twitter will also help you get immersed into this hacking mentality.
Top resources
1) OWASP- This is a non-profit organization which publishes a ton of security resources. They have so many resources eg OWASP Top 10, information on bug classes.
2) CTFs- This lets you practice your skills and get a small reward for doing so. They are extremely vulnerable and can’t be trusted eg Hacker101 CTF, Damn Vulnerable Web Application and Juice shop.
3) Structured courses- they let you learn security from the start to the finish. Online courses are a great place to do this. The cyber mento, pentester lab and portswiggers web security academy are just few of them. Bug bounties are usually course independent.
4) Videos- They allow for security concepts to be delivered in more bitesized pieces. Some good creators are such as STOK, The Cyber Mentor, InsiderPHP among others. Some lecture style videos are such as CS50 and MIT Open Course Ware among others.
5) Podcasts- These let you listen to material when you are doing other things like travelling or household chores. A surprising amount of security podcasts such as The Bug Bounty podcast, Darknet Diaries, Security now and risky business are just among the few.
6) Books- These allow you to get through material at your own pace in your own time some of them are free eg- web hacking 101, OWASP Testing guide, Bug bounty cheat sheet Books.
7) Certificates can prove your expertise and prove you useful to your employer. The offensive security certified professional is considered the best one.
8) Writeups and disclosures give you an insight on how hackers think and what they found. Disclosures help you see what bugs pay out. Write ups give you an insight into the thought process. Google and the twitter are the best places to look.
9) Aggregators and newsletters- These let you find the newest stuff in a bunch of different categories. Pentester land newsletter is easily the best
10) ACTUALLY HACK SOMETHING!!-Just try anyways even if you don’t know. Just take that jump and actually go for it!!You really don’t need to know anything, you just have to start. Good hacking platforms are such as hackerone, bugcrowd, synack and Intigriti. Practical knowledge is highly recommended as compared to reading. Take that jump and just go for it.
TOOLS
It is important to know how to use your tools.
1) Burpsuite
2) Github Repos
CONFERENCES- are also a good place to learn specific techniques or just to be amazed by others. Most conferences record their sessions and put them up on youtube.
COMMUNITY ENGAGEMENT
Speaking to other bug bounty people can help you become more immersed, discuss cool resources you’ve found, bounce ideas off if you are stuck, and enthuse about new techniques and bugs. Highly recommended platforms are such as #BugBounty #bugbountytips on twitter, Hacker101 Discord and Bug Bounty Forum.
TEACHING OTHERS
Teaching others will help you solidify your knowledge of concepts, it can be through helping someone solve a CTF, making YouTube videos, writing tutorials or mentoring someone or even better yet creating a study group. This is best organized through the community on twitter, discord or slack.
Top comments (0)