Kali Linux + OWASP-Top10 Bug Bounty Guide ( How to Bug Bounty)

Bug-Bounty Using Kali-Linux & OWASP-Top10

OWASP Top 10 Vulnerabilities

The OWASP Top 10 list includes the most critical security risks for web applications:

Rank	Vulnerability
A01:2021	Broken Access Control
A02:2021	Cryptographic Failures
A03:2021	Injection
A04:2021	Insecure Design
A05:2021	Security Misconfiguration
A06:2021	Vulnerable and Outdated Components
A07:2021	Identification and Authentication Failures
A08:2021	Software and Data Integrity Failures
A09:2021	Security Logging and Monitoring Failures
A10:2021	Server-Side Request Forgery (SSRF)

Overview

1. Getting Started with Bug Bounties

1.1 Research and Registration
- Step 1: Research and choose bug bounty platforms like HackerOne or Bugcrowd.
- Step 2: Register on these platforms by creating a hacker profile.
- Step 3: Review the rules of engagement for each program you wish to participate in (make sure you follow the target's scope).
- Step 4: Start by choosing beginner-friendly programs with open scopes. I know it sucks but doing bounties that are unpaid is one of the best ways to get invited to private programs. (( My advice utilize HackTheBox or TryHackMe Bug Bounty Paths

2. Preparing Your Environment

2.1 Setting up the Tools
- SubFinder (Subdomain Enumeration):
  - Step 1: Install Go language: sudo apt install golang-go.
  - Step 2: Install SubFinder: go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest.
  - Step 3: Test SubFinder installation: subfinder -v.
- httpx (Check Alive Subdomains):
  - Step 1: Install httpx: go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest.
  - Step 2: Verify the installation: httpx -v.
- Katana (Content Discovery):
  - Step 1: Install Katana: go install github.com/projectdiscovery/katana/cmd/katana@latest.
  - Step 2: Run and verify: katana -v.
- Dirsearch (Directory Brute-forcing):
  - Step 1: Install using Git: git clone <https://github.com/maurosoria/dirsearch.git>.
  - Step 2: Navigate to the directory: cd dirsearch.
  - Step 3: Run Dirsearch: python3 dirsearch.py.
- Nuclei (Vulnerability Scanning):
  - Step 1: Install: go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest.
  - Step 2: Verify: nuclei -v.

3. OWASP Top 10 Vulnerabilities

The OWASP Top 10 list includes the most critical security risks for web applications:

Rank	Vulnerability
A01:2021	Broken Access Control
A02:2021	Cryptographic Failures
A03:2021	Injection
A04:2021	Insecure Design
A05:2021	Security Misconfiguration
A06:2021	Vulnerable and Outdated Components
A07:2021	Identification and Authentication Failures
A08:2021	Software and Data Integrity Failures
A09:2021	Security Logging and Monitoring Failures
A10:2021	Server-Side Request Forgery (SSRF)

4. Bug Bounty Methodology

4.1 Reconnaissance
- Nmap: This is a OWASP focused walk-through so you can use nmap but the steps below utilize OWASP Tools but for a basic nmap scan run `nmap -sC -sV -oN bountyprojectname.nmap
- SubFinder: Start by running SubFinder to discover subdomains of your target.
  - Command: subfinder -d <target_domain> -o subdomains.txt.
  - Sub-Step: Store the output and analyze the domain structure.
- httpx: Check which subdomains are alive and gather information.
  - Command: cat subdomains.txt | httpx -title -status-code -o alive_subdomains.txt.
  - Sub-Step: Analyze active subdomains to prioritize them.
- OWASP Top 10 Focus: Look for possible security misconfigurations (A05) by checking SSL and headers.
4.2 Content Discovery
- Katana: Use Katana to find directories and sensitive content across subdomains.
  - Command: katana -u https://<target_domain> -o content.txt.
  - Sub-Step: Look for directories, files, and JavaScript endpoints that may expose sensitive information.
- Dirsearch: Use Dirsearch to brute-force hidden files and directories.
  - Command: python3 dirsearch.py -u https://<target_domain> -w /path/to/wordlist.txt -o dir_results.txt.
  - Sub-Step: Analyze results for possible sensitive directories such as admin panels or configuration files (A03 Injection, A05 Misconfiguration).
- OWASP Top 10 Focus: Hidden directories can lead to unauthorized access or information leaks (A01 Broken Access Control).

5. Identifying Vulnerabilities

5.1 Injection Attacks
- SQL Injection (A03): Use SQLMap or manual techniques to check for SQL injection vulnerabilities.
  - Command: sqlmap -u '<https://target.com?id=1>' --batch --dbs.
- Command Injection (A03): Look for command injection points in forms or URL parameters.
5.2 Cross-Site Scripting (XSS)
- Step 1: Test for reflected or stored XSS vulnerabilities in input fields.
- Step 2: Use payloads like "><script>alert(1)</script>.
- OWASP Focus: XSS falls under A03 (Injection).

6. Advanced Vulnerability Scanning

6.1 Nuclei for Vulnerability Scanning
- Command: nuclei -u https://<target_domain> -t cves/ -o vuln_report.txt.
- Sub-Step: Use the default templates and CVE detection for rapid scanning.
- Custom Templates: Add your own YAML templates for custom vulnerability detection.
- OWASP Top 10 Focus: Use Nuclei to find vulnerabilities in components (A06 Vulnerable and Outdated Components).

7. Reporting

7.1 Creating the Report
- Step 1: Organize your findings by vulnerability type.
- Step 2: Provide proof of concept (PoC) for each vulnerability.
- Step 3: Offer remediation steps where possible.
- Step 4: Submit the report through the appropriate bug bounty platform.
7.2 Follow-Up
- Be prepared for follow-up questions from the security team.

8. Continuous Improvement

8.1 Learning from the Community
- Join bug bounty forums and participate in discussions.
- Engage with write-ups from experienced hackers on platforms like Hacker1 or Bugcrowd.

Stay on the look out for the Ultimate Bug Bounty Guide i will be releasing soon. I made sure it is extremely detailed in depth and easy to follow.