The similarities between Bug Bounty and Video Game

By

The similarities between Bug Bounty and Video Game


In video games, you usually see the consequences of your actions after 30 seconds. In bug bounty, it takes several days or weeks. That's why it is harder to stay motivated in bug bounty.

In video games, the player with more actions-per-minute is more likely to win. It is the same in bug bounty, the bug hunter who performs more actions in a long period of time, is more likely to be successful than the one with lesser actions. The effectiveness of the actions matter too, but it will increase as the bug hunter gains more experience, so it happens naturally.

Some examples of actions-per-minute in bug bounty.
- Browses the target website and get familiar with its features.
- Looks at the details and discover "advanced", hard to see features. (if you post a comment in French, the website offers to translate it to English, this is a hard to see feature)
- Reads documentations, each article can be count as an action.
- Brainstorms attack scenarios.
- Verifies assumptions that you have while doing any of the above.
- Submits a report
- Replies to a report
- Looks up an English word/phrases to make your report clearer.
- Everything that may help you in the future is an action.

Accumulates enough of these actions will help you find bugs faster. You should judge your day by how many actions you can do, rather than how many bugs you can find. This is a more motivating way to do bug bounty.

Comments

  1. Jean BolívarApril 2, 2024 at 8:35 AM

    Hello! It's me! I am the same guy that has been commenting your recent blog posts. A week ago I found my first bug, an Open Redirect, though the security team said that I was a known issue so no rewards for me, wich kinda sucks but hey, it's still my first bug after I started bug hunting three months ago. What I am gonna do now is keep trying to hack everyday for at least 30 minutes and read Hackerone reports and writeups, and hopefully money will come eventually as I get better and better!

    ReplyDelete
    Replies
    1. trieulieuf9April 4, 2024 at 12:42 PM

      I recognize you :). That's really nice to hear. That's a good and solid plan!

      Delete

Post a Comment

Comments are very welcome. I read all comments!

Popular posts from this blog

Beginner Tutorial - How to learn the Technical Skill and Hacker Mindset That Are Required to Find Your First Bug Bounty.

By
In 2023, there are so many bug bounty resources for beginners, much more than before. I believe this is a bad thing for beginners, because now, they have to deal with so much unnecessary distractions just from choosing and sticking to a learning path alone. The over-abundance of free resources also fuels procrastination, we usually see people jumping from one learning path to another, without actually touch a real target. In this article, I will show you how much learning is enough. So you can get out of your learning rabbit holes and start hunting on a real target. By the way, this article aims to help you find bugs in IDOR, Information Disclosure, Business Logics, Broken Access Control. It may not help you to find injections bugs or misconfiguration bugs. Because I don't know how hunt them myself. # Technical Skill If you can solve Practitioner labs in PortSwigger with relatively ease, you have enough technical skill to hunt bugs: - https://portswigger.net/web-security/logic-flaw
Read more

The power of focus

By
A quote in the movie John Wick 1: John Wick is the main of focus, commitment and sheer will Out of all the good traits, the movie writer chooses only 3 traits to describe how bad ass John Wick is. That shows how powerful focus is. I believe he also gets his excellence skills thank to these 3 traits. Focus, commitment and sheer will are pretty similar to each others, they show that the man can stick to something for a long period of time, without switching goal, despite inconvenient challenges. If we apply this to bug bounty, it means, we make a goal, and stick to it, despite all self-doubts. For example, Losef is a beginner, who tries to find his first bug, he sets a goal to hunt on a program for 7 days. In day 1, he feels overwhelmed by how much details his target has. In day 2, he tests features one by one, but finds nothing, he feels down. In day 3, he feels that you have hit a steel wall, which he cannot even imagine how to get pass it. In day 4, he notices the program stats, which
Read more

How to succeed in bug bounty as a non-talented bug hunter

By
Image
When I started bug bounty hunting about 4 years ago. I looked up information about top bug bounty hunter and wondered how are they hunting bugs and grow their H1 reputation so fast. 1 year later, when I found my 1st, 10th, 20th bugs. I still had this question. Because although I had found some bugs, it took me a few days to find one. Recently, as I get more mature in bug bounty. I start to develop a deep understanding for a program. I see many attack surfaces that other people don't realize. When this program releases a new feature, I check if this feature can be abused to attack the attack surfaces A, B, C or D. Oftentimes, at least 1+ bugs are found. When I keep hunting on this program and discover a new attack surface, I check if any existing features can be abused to attack this attack surface. Oftentimes, at least 1+ bugs are found. When there is no new released feature and attack surfaces. I sometimes  wander the program, looking at already tested features and to my surprise.
Read more