Finding the right bug bounty program to target is the crucial first step to becoming a successful bug bounty hunter. With the rapid emergence of many programs over the past few years, it’s challenging to figure out which ones will provide the best monetary rewards, experience, and learning opportunities.
A bug bounty program is an initiative in which a company invites ethical hackers to attack its products and service offerings to find security vulnerabilities. But how should you pick a program? And how should you prioritize their different metrics, such as the asset types involved, whether the program is hosted on a platform, whether it’s public or private, the program’s scope, the payout amounts, and response times
The State of the Industry
Bug bounties are currently one of the most popular ways for organizations to receive feedback about security flaws. Large corporations, like PayPal and Facebook, as well as government agencies like the US Department of Defense, have all embraced the idea. Yet, not too long ago, reporting a vulnerability to a company would have more likely landed a person in legal trouble than gotten them a reward.
In 1995, Netscape launched the first-ever bug bounty program. The company encouraged users to report bugs found in its brand-new browser, the Netscape Navigator 2.0, introducing the idea of crowdsourced security testing to the internet world. Mozilla launched the next corporate bug bounty program nine years later, in 2004, inviting users to identify bugs in the Firefox browser.
But it was not until the 2010s that offering bug bounties became a popular practice. That year, Google launched its program, and Facebook followed suit in 2011. These two programs truly kick-started the trend of using bug bounties to augment a corporation’s in-house security infrastructure.
The Rise of Bug Bounty Platforms
As bug bounties became a more well-known strategy, bug-bounty-as-a-service platforms emerged. These platforms help companies set up and operate their programs. For example, they provide a place for companies to host their programs, a way to process reward payments, and a centralized place to communicate with bug bounty hunters.
The two largest of these platforms, HackerOne and Bugcrowd, both launched in 2012. Following them, a few more platforms, such as Synack, Cobalt, and Intigriti, came to the market. These platforms and managed bug bounty services allow even companies with limited resources to run a security program. Today, large corporations, small startups, nonprofits, and government agencies alike have adopted bug bounties as an additional security measure and a fundamental piece of their security policies.
The term security program usually refers to information security policies, procedures, guidelines, and standards in the larger information security industry. In the context of bug bounties, the term program or bug bounty program refers specifically to a company’s bug bounty operations.
Today, tons of programs exist, all with their unique characteristics, benefits, and drawbacks. Let’s examine these factors to help you make an informed choice.
Asset Types: Choosing Your Attack Surface
In the context of a bug bounty program, an asset is an application, website, or product that a hacker can target. There are different types of assets, each with its own characteristics, requirements, and pros and cons. After considering these differences, you should choose a program with assets that play to your strengths, based on your skill set, experience level, and preferences.
Social Sites and Applications
Anything labeled social has a lot of potential for vulnerabilities because these applications tend to be complex and involve a lot of interaction among users, and between the user and the server. This first type of bug bounty program targets social websites and applications.
The term social application refers to any site that allows users to interact with each other. Many programs belong to this category: examples include the bug bounty program for HackerOne and programs for Facebook, Twitter, GitHub, and LINE.
- Vulnerability Potential: Social applications need to manage interactions among users, as well as each user’s roles, privileges, and account integrity. They are typically full of potential for critical web vulnerabilities such as:
- Insecure Direct Object References (IDORs)
- Information Leaks (Info leaks)
- Account Takeovers
- Injection Flaws: These complex applications also often provide a lot of user input opportunities. If input validation is not performed properly, these applications are prone to injection bugs, like SQL Injection (SQLi) or Cross-Site Scripting (XSS).
- Recommendation for Beginners: If you are a newcomer to bug bounties, it is highly recommended that you start with social sites. The large number of social applications means you’ll have many programs to choose from. The complex nature of social sites means you’ll encounter a vast attack surface (all of the application’s different points that an attacker can attempt to exploit) with which to experiment. Finally, the diverse range of vulnerabilities that show up on these sites means you will be able to quickly build a deep knowledge of web security.
- Skill Set: The skills needed include the ability to use a proxy, like the Burp Suite proxy, and knowledge about web vulnerabilities such as XSS and IDOR. It’s also helpful to have some JavaScript programming skills and knowledge about web development. However, these skills aren’t strictly required to succeed as a hacker.
- Major Downside: Because of the popularity of their products and the low barrier of entry, social programs are often very competitive and have many hackers hunting on them. Social media platforms such as Facebook and Twitter are some of the most targeted programs.
General Web Applications
General web applications are also a good target for beginners. This category refers to any web applications that do not involve user-to-user interaction. Instead, users interact with the server to access the application’s features. Targets that fall into these categories can include static websites, cloud applications, consumer services like banking sites, and web portals of Internet of Things (IoT) devices or other connected hardware. Like social sites, they are also quite diverse and lend themselves well to a variety of skill levels. Examples include the programs for Google, the US Department of Defense, and Credit Karma.
- Level of Difficulty: In general, these tend to be a little more difficult to hack than social applications, and their attack surface is often smaller. If you’re looking for account takeovers and info leak vulnerabilities, you won’t have as much luck because there aren’t many opportunities for users to interact with others and potentially steal their information.
- Vulnerability Focus: The types of bugs you’ll find are slightly different. You’ll need to look for server-side vulnerabilities and vulnerabilities specific to the application’s technology stack. You could also look for commonly found network vulnerabilities, like subdomain takeovers.
- Skill Set: This means you’ll have to know about both client-side and server-side web vulnerabilities, and you should have the ability to use a proxy. It’s also helpful to have some knowledge about web development and programming.
- Accessibility: These programs can range in popularity. However, most of them have a low barrier of entry, so you can most likely get started hacking right away!
Mobile Applications (Android, iOS, and Windows)
After you get the hang of hacking web applications, you may choose to specialize in mobile applications. Mobile programs are becoming prevalent, as most web apps have a mobile equivalent nowadays. They include programs for Facebook Messenger, the Twitter app, the LINE mobile app, the Yelp app, and the Gmail app.
- Required Knowledge: Hacking mobile applications requires the skill set you’ve built from hacking web applications, as well as additional knowledge about the structure of mobile apps and programming techniques related to the platform. You should understand attacks and analysis strategies like:
- Certificate Pinning Bypass
- Mobile Reverse Engineering
- Cryptography
- Setup Requirements: Hacking mobile applications also requires a little more setup than hacking web applications, as you’ll need to own a mobile device you can experiment on. A good mobile testing lab consists of a regular device, a rooted device (one for which you have admin privileges, allowing you to bypass mobile system’s safety constraints), and device emulators (virtual simulations of mobile environments run on your computer) for both Android and iOS.
- Competition: For these reasons, mobile applications are less popular among bug bounty hunters than web applications. However, the higher barrier of entry for mobile programs is an advantage for those who do participate, as these programs are less competitive, making it relatively easy to find bugs.
APIs
Application Programming Interfaces (APIs) are specifications that define how other applications can interact with an organization’s assets, such as to retrieve or alter their data. For example, another application might be able to retrieve an application’s data via HyperText Transfer Protocol (HTTP) messages to a certain endpoint, and the application will return data in the format of Extensible Markup Language (XML) or JavaScript Object Notation (JSON) messages.
- Focus Areas: Some programs put a heightened focus on API bugs in their bug bounty programs if they’re rolling out a new version of their API. A secure API implementation is key to preventing data breaches and protecting customer data. When testing APIs, you should focus on common API bugs like data leaks and injection flaws.
- Skill Set: Hacking APIs requires many of the same skills as hacking web applications, mobile applications, and IoT applications.
Source Code and Executables
If you have more advanced programming and reversing skills, you can give source code and executable programs a try. These programs encourage hackers to find vulnerabilities in an organization’s software by directly providing hackers with an open source codebase or the binary executable. Examples include the Internet Bug Bounty, the program for the PHP language, and the WordPress program.
- Hacking Methods: Hacking these programs can entail analyzing the source code of open source projects for web vulnerabilities and fuzzing binaries (testing software with massive amounts of unexpected or malformed inputs) for potential exploits.
- Required Skills: You usually have to understand coding and computer science concepts to be successful here. You’ll need knowledge of web vulnerabilities, programming skills related to the project’s codebase, and code analysis skills. Cryptography, software development, and reverse engineering skills are also helpful.
- Competition: Source code programs may sound intimidating, but they are diverse, offering many choices. Because these programs tend to require more skills, they are less competitive, and only a small proportion of hackers will ever attempt them.
Hardware and IoT
Last but not least are hardware and IoT (Internet of Things) programs. These programs ask you to hack devices like cars, smart televisions, and thermostats. Examples include the bug bounty programs of Tesla and Ford Motor Company.
- Specialized Skills: You’ll need highly specific skills to hack these programs: you’ll often have to acquire a deep familiarity with the type of device you’re hacking, in addition to understanding common IoT vulnerabilities. You should know about:
- Web vulnerabilities
- Programming
- Code analysis
- Reverse engineering
- IoT concepts and industry standards such as digital signing and asymmetric encryption schemes
- Cryptography, wireless hacking, and software development skills
- Barrier to Entry: Although some programs will provide you with a free device to hack, that often applies only to select hackers who’ve already established a relationship with the company. To begin hacking on these programs, you might need the funds to acquire the device on your own.
- Competition: Since these programs require specialized skills and often a device, they tend to be the least competitive.
Bug Bounty Platforms vs. Independently Hosted Programs
Companies can host bug bounty programs in two ways: through bug bounty platforms and on independently hosted websites.
- Bug Bounty Platforms: These are websites through which many companies host their programs. Usually, the platform directly awards hackers with reputation points and money for their results. Some of the largest bug bounty platforms are HackerOne, Bugcrowd, Intigriti, Synack, and Cobalt.
- Platform Function: Bug bounty platforms act as an intermediary between hackers and security teams. They provide companies with logistical assistance for tasks like payment and communication. They also often offer help managing incoming reports by filtering, deduplicating, and triaging (the confirmation of vulnerability) bug reports. Finally, these platforms provide a way for companies to gauge a hacker’s skill level via statistics and reputation, allowing them to invite experienced hackers to their private programs. Some of these platforms also screen or interview hackers before allowing them to participate.
- Independently Hosted Programs: Many organizations host and manage their bug bounty programs without the help of platforms. Companies like Google, Facebook, Apple, and Medium do this. You can find their bug bounty policy pages by visiting their websites, or by searching “CompanyName bug bounty program” online.
As a bug bounty hunter, should you hack on a bug bounty platform, or should you go for companies’ independently hosted programs?
The Pros of Platforms
- Transparency: The best thing about bug bounty platforms is that they provide a lot of transparency into a company’s process, because they post disclosed reports, metrics about the programs’ triage rates, payout amounts, and response times. Independently hosted programs often lack this type of transparency.
- Logistics: You won’t have to worry about the logistics of emailing security teams, following up on reports, and providing payment and tax information every time you submit a vulnerability report.
- Reputation System: Bug bounty platforms often have reputation systems that allow you to showcase your experience so you can gain access to invite-only bug bounty programs.
- Conflict Resolution: Another advantage of bug bounty platforms is that they often step in to provide conflict resolution and legal protection as a third party. If you submit a report to a non-platform program, you have no recourse in the final bounty decision.
The Cons of Platforms
- Triagers: Some hackers avoid bug bounty platforms because they dislike how those platforms deal with reports. Reports submitted to platform-managed bug bounty programs often get handled by triagers (third-party employees who often aren’t familiar with all the security details about a company’s product). Complaints about triagers handling reports improperly are common.
- Loss of Direct Connection: Programs on platforms often break the direct connection between hackers and developers. With a direct program, you often get to discuss the vulnerability with a company’s security engineers, making for a great learning experience.
- Crowding: Public programs on bug bounty platforms are often crowded because the platform gives them extra exposure. On the other hand, many privately hosted programs don’t get as much attention from hackers and are thus less competitive.
Other Key Metrics: Scope, Payouts, and Response Times
What other metrics should you consider when picking a program, besides its asset types and platform? On each bug bounty program’s page, metrics are often listed to help you assess the program. These metrics give insight into how easily you might be able to find bugs, how much you might get paid, and how well the program operates.
Program Scope
First, consider the scope. A program’s scope, specified on its policy pages, defines what and how you are allowed to hack. There are two types of scopes:
- Asset Scope: Tells you which subdomains, products, and applications you can hack.
- Vulnerability Scope: Specifies which vulnerabilities the company will accept as valid bugs.
Crucial Rule: Assets that are listed as in scope are the ones you are allowed to hack. Assets that are listed as out-of-scope are off-limits to bug bounty hunters. Be extra careful and abide by the rules! Hacking an out-of-scope asset is illegal.
Typical out-of-scope vulnerabilities include: Self-XSS, Clickjacking, Missing HTTP headers and other best practices without direct security impact, Denial-of-Service attacks, and Use of known-vulnerable libraries/automated scanner results without proof of exploitability.
- Recommendation: Any program with large asset and vulnerability scopes is a good place to start for a beginner. The larger the asset scope, the larger the number of target applications and web pages you can look at, and you can often find obscure applications that are overlooked by other hackers. This typically means less competition. The larger the vulnerability scope, the more types of bugs the organization is willing to hear reports about, making it easier to find bugs because you have more opportunities and can play to your strengths.
Payout Amounts
The next metric you should consider is the program’s payout amounts. There are two types of payment programs:
- Vulnerability Disclosure Programs (VDPs): These are reputation-only programs, meaning they do not pay monetary rewards for findings but often offer rewards such as reputation points and swag.
- VDP Benefits: They are a great way to learn about hacking if making money is not your primary objective. Since they don’t pay, they’re less competitive, and so easier to find bugs in. You can use them to practice finding common vulnerabilities and communicating with security engineers.
- Bug Bounty Programs: These offer varying amounts of monetary rewards for your findings. In general, the more severe the vulnerability, the more the report will pay.
- Payout Structure: Different programs have different payout averages for each level of severity. You can find a program’s payout information on its bug bounty pages, usually listed in a section called the payout table. Typically, low-impact issues will pay anywhere from $50 to $500 (USD), while critical issues can pay upward of $10,000. The bug bounty industry is evolving, and payout amounts are increasing for high-impact bugs (e.g., Apple now rewards up to $1 million for the most severe vulnerabilities).
Response Time
Finally, consider the program’s average response time. Some companies will handle and resolve your reports within a few days, while others take weeks or even months to finalize their fixes. Delays often happen because of the security team’s internal constraints (lack of personnel, delay in issuing security patches, lack of funds) or because researchers have sent bad reports without clear reproduction steps.
- Recommendation: Prioritize programs with fast response times. Rapid feedback from security teams will help you improve, especially when starting, because you’re likely to make mistakes (misjudging severity, writing unclear explanations, technical mistakes). Fast feedback will turn you into a competent hacker faster.
Public vs. Private Programs
Most bug bounty platforms distinguish between public and private programs.
- Public Programs: These are open to all; anyone can hack and submit bugs to these programs, as long as they abide by the laws and the bug bounty program’s policies.
- Private Programs: These are open to only invited hackers. Companies ask hackers with a certain level of experience and a proven track record to attack the company and submit bugs to it.
The Advantage of Private Programs
Participating in private programs can be extremely advantageous.
- Less Competitive: Private programs are a lot less competitive than public ones because of the limited number of hackers participating. Therefore, it’s much easier to find bugs in them.
- Faster Response Time: Private programs also often have a much faster response time because they receive fewer reports on average.
How to Get Invited to Private Programs
Companies send private invites to hackers who have proven their abilities. Getting invites to private programs isn’t difficult once you’ve found a couple of bugs. Different bug bounty platforms will have different algorithms to determine who gets the invites, but here are some tips:
- Submit Valid Bugs to Public Programs: To get private invites, you often need to gain a certain number of reputation points on a platform, and the only way to begin earning these is to submit valid bugs to public programs.
- Focus on High-Impact Vulnerabilities: These vulnerabilities will often reward you with higher reputation points and help you get private invites faster.
- Complete Platform Challenges: On some bug bounty platforms, like HackerOne, you can also get private invites by completing tutorials or solving Capture the Flag (CTF) challenges.
- Do Not Spam: Submitting nonissues often causes a decrease in reputation points. Most bug bounty platforms limit private invites to hackers with points above a certain threshold.
- Be Polite and Courteous: Be polite and courteous when communicating with security teams. Being rude or abusive will probably get you banned from the program and prevent you from getting private invites from other companies.
Choosing the Right Program for Success
Bug bounties are a great way to gain experience in cybersecurity and earn extra bucks. But the industry has been getting more competitive. As more people are discovering these programs and getting involved in hacking on them, it’s becoming increasingly difficult for beginners to get started. That’s why it’s important to pick a program that you can succeed in from the very start.
Before developing a bug hunter’s intuition, you often have to rely on low-hanging fruit and well-known techniques. This means many other hackers will be able to find the same bugs, often much faster than you can. It’s therefore a good idea to pick a program that more experienced bug hunters pass over to avoid competition. You can find these underpopulated programs in two ways:
- Look for Unpaid Programs (VDPs): Try going for Vulnerability Disclosure Programs (VDPs) first. Unpaid programs are often ignored by experienced bug hunters, since they don’t pay monetary rewards. But they still earn you points and recognition, which might be just what you need to get an invite to a private, paid program.
- Go for Programs with Big Scopes: Picking a program with a large scope means you’ll be able to look at a larger number of target applications and web pages. This dilutes the competition, as fewer hackers will report on any single asset or vulnerability type.
Remember to go for programs with fast response times to prevent frustration and get feedback as soon as possible.
One last thing that can be incorporated into your decision process is the reputation of the program. If you can, gather information about a company’s process through its disclosed reports and learn from other hackers’ experiences. Does the company treat its reporters well? Are they respectful and supportive? Do they help you learn? Pick programs that will be supportive while you are still learning, and programs that will reward you for the value that you provide.
Choosing the right program for your skill set is crucial if you want to break into the world of bug bounties. This guide should have helped you sort out the various programs that you might be interested in. Happy hacking!
A Quick Comparison of Popular Programs
After you’ve identified a few programs that you are interested in, you could list the properties of each one to compare them. Below, let’s compare a few of the popular programs.
| Program | Asset Type | In-Scope Assets (Examples) | Payout Amount (Min/Range) | Response Time Metrics (Average) |
|---|---|---|---|---|
| HackerOne | Social site | hackerone.com, api.hackerone.com, *.vpn.hackerone.net, etc. | $500–$15,000+ | Fast. Response: 5 hours. Triage: 15 hours. |
| Social site, non-social site, mobile site, IoT, and source code | Instagram, Internet.org / Free Basics, Oculus, Workplace, WhatsApp, Portal, etc. | $500 minimum | Based on experience, quite fast. | |
| GitHub | Social site | blog.github.com, community.github.com, resources.github.com, etc. | Not explicitly listed, but generally competitive | Metrics not provided in the original text. |