The most important habit for a bug bounty hunter is continuous learning. This is a challenging task, as it requires balancing the daily pursuit of new vulnerabilities and targets with reading papers, blogs, social network accounts, and completing formal training.
This comprehensive guide lists essential resources to help security researchers and bug bounty hunters stay updated on new technologies, advanced exploiting techniques, and the latest vulnerability disclosures. It is important to remember that these are not the only resources available; the internet is an infinite place for learning, but focusing your efforts will yield the best results.
Essential Training and Certifications
Basically, there are two kinds of training: formal and non-formal. The former includes online projects that offer courses in information security, application security, and network security, while the latter involves institutes and companies that offer professional courses and highly regarded certifications.
Online Learning Platforms
Platzi
Platzi is an online learning platform focused on offering IT courses, typically based on an annual subscription. Within the different learning paths designed by Platzi, there is one dedicated to information security. Specifically, two courses are of great interest for bug bounty hunters:
- Introducción a la seguridad informática (Introduction to Computer Security): This course describes the basics of information security and introduces some of the tools and techniques used in network security assessments.
- Curso de análisis de vulnerabilidades Web con OWASP (Web Vulnerability Analysis Course with OWASP): This course details the various vulnerabilities included in the OWASP testing guide, complete with practical examples.
You can find these courses on the platform’s security page: https://platzi.com/cursos/seguridad/.
Udemy
Udemy is an online training platform offering courses on virtually every topic imaginable, from cooking recipes to information security. Within the information security topics, one can find courses about network security, web application security, ethical hacking, penetration testing, and specialized courses focused on technologies such as Splunk, Checkpoint, and Cisco. The platform also features bug bounty courses that are often based on the methodologies explained in many industry guides.
The difference between Udemy and Platzi is that Udemy frequently offers significant discounts, and it is possible to just pay for one course rather than committing to a complete subscription model.
Check out the current offerings: https://www.udemy.com/courses/search/?src=ukw&q=bug+bounty.
Professional Security Certifications
GIAC
GIAC (Global Information Assurance Certification) is an institute focused on offering security certifications and training (https://www.giac.org/). They offer different types of training: online, on-demand, and face-to-face. While the material is the same across all formats, the experience offered by the professionals who impart the face-to-face courses makes a crucial difference.
The following certifications are recommended for security professionals looking to acquire deep knowledge relevant to bug bounty hunting:
- Penetration Tester (GPEN): Although penetration testing is often related to network assessments, some bug bounty programs include network targets or open programs that incorporate infrastructure analysis in their scope. Training in penetration testing is useful to create a solid basis for any bug bounty hunter, teaching how important technologies work and the basics of application security.
- Web Application Penetration Tester (GWAPT): This is perhaps the most relevant course from the bug bounty hunter perspective. Here, researchers learn all about web application security, the SANS methodology, and how to go further with exploitation during a web application assessment.
- Exploit Researcher and Advanced Penetration Tester (GXPN): This is a specialized course for penetration testers who want to acquire more advanced skills in exploit writing, reversing (decompiling or disassembling compiled code to understand its function), and post-exploitation techniques. It is not as immediately relevant for typical bug bounty work but is interesting for those who want to participate in highly advanced programs, such as Zerodium or ZDI (Zero Day Initiative).
Offensive Security
Offensive Security (https://www.offensive-security.com/) is the company created by the developers of Kali Linux, and it is renowned for having the most technical certification program on the market. They have two certifications that are ideal for bug bounty hunters looking for rigorous training:
- Offensive Security Certified Professional (OSCP): Similar to GPEN, this is a penetration testing certification, but it is more technical and less based on formal methodologies. It covers the security fundamentals useful for all bug bounty hunters and includes modules related to application security alongside its focus on network security assessments.
- Offensive Security Web Expert (OSWE): This is a course focused entirely on application security and the scope of bug bounty hunting, offering modules about authentication, authorization, input validation, data storage, and more. However, in Offensive Security’s program, it is generally necessary to complete the OSCP certification first before pursuing the OSWE.
Foundational Books and Resources
It is preferable to start learning the basics of formal security assessments and then move into the bug bounty hunting world. The bug bounty hunter’s scope is often limited, and a hunter sometimes has a different approach from formal security assessment. It is important to remember that bug bounties cannot entirely supply the normal security testing phases in a Secure Software Development Life Cycle (SDLC); they are another phase in the security model with a different purpose altogether.
Therefore, the books listed below are foundational security assessment books, not exclusively bug bounty hunting guides.
Web Application Hacker’s Handbook
The Web Application Hacker’s Handbook by Dafydd Stuttard and Marcus Pinto is the perfect place to start learning about web application security. It is structured so that a reader can start knowing nothing about web technologies and finish the book having mastered the solid basics of application security. The initial chapters relate to web technologies, such as how the HTTP protocol works and the latest dynamic technologies for the frontend (the client-side of an application). While not strictly based on OWASP, it includes all the same core content.
OWASP Testing Guide
The Open Web Application Security Project (OWASP) has numerous projects focused on documentation. The OWASP Testing Guide is a general resource that describes all kinds of vulnerabilities and outlines how to detect, exploit, and solve them. The OWASP Development Guide summarizes the development basics for security developers and documents various technologies.
For a bug bounty hunter, the OWASP Testing Guide (https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents) is a great reference guide. It can be used as a quick reference to solve doubts, to structure reports, or as a cheat sheet for common vulnerabilities.
Hacking 101
Hacking 101 by Peter Yaworski is a book written with HackerOne’s support (https://www.hacker101.com/). It is arguably the best resource for transitioning from common security assessments to bug bounty hunting. Peter Yaworski describes each kind of vulnerability by detailing bugs reported by him and other bug bounty hunters. While it is not the best place to start if you do not know the basics, it is an excellent resource that describes real-world bugs reported in bounty programs.
The Hacker Play Book
The Hacker Play Book by Peter Kim is a very original book, written as a story that describes each step in compromising a real target. It is focused on network security, but in some chapters, application vulnerabilities are explained in great detail. The level of detail is perfect to get real ideas about how to exploit a bug to create excellent reports, emphasizing the importance of being detailed and understandable when reporting a bug.
Exploiting Software
Exploiting Software by Gary McGraw was a famous book many years ago, and its core concepts are far from outdated. This book describes vulnerabilities that affect all kinds of software, not just web applications, explaining why they exist and the logic behind the bugs in detail. The interesting aspect of this book is that the fundamental logic of vulnerabilities is similar, regardless of whether you are looking at an old Perl script or the newest popular web framework.
CTFs and Wargames
An easy and very effective way to learn about computer security is through games called Capture The Flags (CTFs). These games are simulations of real environments, providing vulnerabilities and challenges to solve.
- Hack The Box: Hack The Box (https://www.hackthebox.eu/) is a complete and free laboratory. It has different scenarios to practice in real-world environments, often with detailed explanations about how to perform testing.
- Damn Vulnerable Web Application (DVWA): DVWA (http://www.dvwa.co.uk/) is a project developed in PHP specifically to teach application security. It is easy to install and has different levels to teach each topic, including those found in the OWASP testing guide.
- Badstore: Badstore (https://www.vulnhub.com/entry/badstore-123,41/) is an application that simulates an online store, developed with JavaScript and MySQL. It has the most common store features, allowing users to apply basic security application concepts to it.
- Metasploitable: Metasploitable (https://sourceforge.net/projects/metasploitable/) is a project more focused on infrastructure, strictly designed to teach the use of Metasploit, a popular exploitation framework, but it is useful for learning all kinds of security topics.
Streaming and Video Resources
YouTube is a great resource, where researchers and bug bounty hunters upload videos with proofs of concept and presentations about computer security.
- Web Hacking Pro Tips: This is Peter Yaworski’s YouTube channel (https://www.youtube.com/channel/UCS0y5e-AMsZO8GEFtKBAzkA). Here, you can find some of the material described in his book Hacking 101 with demos and more proofs of concept. The value lies in the mix of basic and advanced videos, ensuring all bug bounty hunters can benefit from the published material.
- BugCrowd University: BugCrowd has created a section in its YouTube channel named BugCrowd University (https://www.youtube.com/watch?v=OVr7pnwJ2m8&list=PLIK9nm3mu-S4K4jMHwtplbrE1JMg0jyN-). This video series explains the different concepts in bug bounty hunting, using the Bug Bounty Hunter’s methodology in an introductory way.
- HackerOne: HackerOne’s YouTube channel (https://www.youtube.com/channel/UCsgzmECky2Q9lQMWzDwMhYw/videos) also shows tutorials about the basics of bug bounty hunting. It is highly recommended to watch the interviews published on the channel to get tips and tricks from other successful bug bounty hunters.
- LiveOverflow: LiveOverflow’s YouTube channel (https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w) is focused on security research. The author explains in an easy way how to exploit real vulnerabilities and solve CTFs.
Blogs and Social Media
Logging on to social networking sites and going through the blogs of other bug bounty hunters is one of the best ways to stay up-to-date with all the developments happening in the field of security.
- Exploitware Labs: Exploitware Labs (https://www.facebook.com/ExWareLabs/) is a Facebook page that publishes daily information about new vulnerabilities, news, projects, and proofs of concept.
- Philippe Hare Wood: Philippe Hare Wood (https://philippeharewood.com/) is a bug bounty hunter who has discovered vulnerabilities mainly on Facebook and Instagram. The researcher also publishes the solutions to some CTFs.
- PortSwigger’s blog: PortSwigger (https://portswigger.net/blog), the company that developed Burp Suite, has its own blog. It features posts that provide information about extensions, analysis with Burp Suite, and development surrounding the tool.
Meetings and Networking Events
Sometimes, the best way to find out the latest news, vulnerabilities, techniques, and tools is face-to-face through meetings and conferences.
Local Meetings
- OWASP Meetings: The Open Web Application Security Project (OWASP) is organized globally, with local chapters in main cities around the world. Each chapter organizes periodic meetings that include fast talks, lectures, CTFs, workshops, and more. Go to OWASP’s website and look for your nearest chapter: https://www.owasp.org/index.php/OWASP_Chapter.
- DEFCON Meetings: DEFCON is the biggest security conference in the world, and its impact is so big that some communities started to create local groups to discuss security topics throughout the year, without waiting for the main conference. DEFCON is old-school, less formal or academic than the OWASP chapters, and is a totally free community for those who are serious about security. You can find DEFCON groups at this link: https://defcongroups.org/.
- 2600 Meetings: The 2600 magazine started in the 1980s as a hacker magazine. It began publishing groups sponsored by the magazine, with meetings focused on discussing the papers and vulnerabilities published. Nowadays, many of these groups have disappeared, but there are still some very active ones. This is a remnant of the old hacker community. You can find the meetings at this link: https://www.2600.com/meetings/.
Major Conferences
It is difficult to list all the conferences globally, but the following are the most relevant, considering where security vulnerabilities are disclosed first and the impact on the community.
- DEFCON: Without a doubt, DEFCON (https://www.defcon.org/) is the most important hacker conference in the world. Held for more than 25 years in Las Vegas, USA, it is a great place for the community to show off its latest research.
- BlackHat: BlackHat (https://www.blackhat.com/) is more corporate than DEFCON, and usually, it is organized one or two days before DEFCON in Las Vegas. It also has editions in England, Japan, and Dubai, where security professionals from major vendors and security companies offer keynotes and workshops. Most of the face-to-face training discussed earlier is offered here.
- BugCON: BugCON (http://www.bugcon.org/) is the biggest security conference in Mexico. It maintains a community environment where vulnerabilities, new projects, and techniques are disclosed in an uncensored event.
- Ekoparty: Ekoparty (https://www.ekoparty.org/) is the biggest conference in Latin America and is one of the most technical events globally. It is known for showcasing high-level technical research, leveraging the active and talented Argentinian security community.
- Code Blue: Code Blue (https://codeblue.jp/) is a huge Japanese event with a high technical level. It is a large event featuring talks, workshops, and wargames.
- CCC (Chaos Communication Congress): The Chaos Communication Congress (https://www.ccc.de/) is one of the oldest events in the world, created by the Chaos Computer Club, a hacker group that has been doing research for more than 30 years. It is a major venue for seeing the latest research from all over Europe.
- H2HC: H2HC (https://www.h2hc.com.br/) is a Brazilian event, and the oldest security event in the region. It is an annual meet-up that discusses the most important security research from around the world.
- 8.8: 8.8 (https://www.8dot8.org/) is a conference from Chile that is expanding to other countries to share its experience from the whole region. Organized by Gabriel Bergel, the creator of the biggest bug bounty platform in Spanish, Vuln Scope, 8.8 is a meeting where many regional researchers get together.
Podcasts
Although podcasts are more focused on finding out about recent news, it is interesting to follow them to stay in touch with security trends.
- PaulDotCom: PaulDotCom (https://securityweekly.com/) is a popular podcast that focuses on news, interviews with security experts, and discussions concerning new technologies and security solutions.
Conclusion: The Infinite Learning Space
The internet is an infinite place for learning, but it is important to bear in mind the focus and purpose of the information you look at. By leveraging these varied resources—from structured training and foundational texts to live CTFs, social media updates, and networking conferences—you can ensure your skills remain sharp and relevant in the fast-paced world of bug bounty hunting.