Bug Bounty for Newbies: Why Companies Pay to Hack Their Products and How to Participate

[Man]

Bug Bounty is a program in which companies pay people to find vulnerabilities and bugs in their software, services, websites or infrastructure.

Bug bounty participants are called "white hat hackers" or "bug hunters." In exchange for reporting vulnerabilities, they receive a reward, the amount of which depends on the severity of the bug found and its potential impact.

Bug hunters gain fame and respect in the industry for their contribution to improving data and system security. In addition, bug bounties are an opportunity to receive an interesting job offer.

We tell you how the Bug Bounty practice developed, where to look for such projects and what skills a white hat hacker needs.

History of Bug Bounty Development​

The first known example of a security bug bounty is the Bramah Lock. In the late 18th century, Bramah and Co., founded by Joseph Bramah, developed a lock that was considered difficult to pick due to its unique design, which used a cylindrical mechanism.

Joseph Bramah was confident in the reliability of the invention, so in 1790 he put the lock on display in his shop in London and offered a reward of 200 guineas to anyone who could open it. This was a significant amount at the time.

Bramah and Co. Lock Source

Many locksmiths tried to break it without success, and it was not until 1851 that American master locksmith Alfred Charles Hobbs was able to crack the Bramah lock during the Great Exhibition in London. Interest in this challenge had a significant impact on the lock and security industry, spurring the development of new technologies and security methods.

In the IT field, the first modern Bug Bounty program was launched 140 years later, in 1995. Netscape offered cash rewards to developers who would find and report security bugs in the Netscape Navigator 2.0 browser.

This approach has been adopted over the years by major companies, including Mozilla, Google, Microsoft, Facebook, Yahoo and others.

Here are some examples:

• In 2004, Mozilla launched the program and offered a reward of $500 for critical vulnerabilities affecting the browser's security. In 2010, the company increased the reward to $3,000 per critical vulnerability. The program is still active.
• In 2013, a white hat hacker received $33,000 for discovering a critical vulnerability in Facebook's server infrastructure. The reward was one of the largest in the history of Facebook's Bug Bounty program.
• In 2015, Kemil Khismatullin discovered a vulnerability in YouTube that allowed any video on the platform to be deleted. Google recognized this as a significant contribution to the security of their services and paid the specialist $5,000.

How does Bug Bounty work?​

Bug bounty programs often complement regular penetration testing and help organizations validate the security of their systems throughout the development lifecycle.

Of course, corporations have their own security team, but large companies are constantly developing and launching many products. With so many tasks, the capabilities of a full-time cybersecurity team are no longer enough - this is where Bug Bounty comes to the rescue.

Organizations use two main models for their bug bounty programs: internal and platform.

Internal programs​

These are programs that the companies themselves place on their websites.

In this case, the work is structured as follows:

1. The company announces the launch of a Bug Bounty with a description of all the details: areas to be tested, types of vulnerabilities they are interested in, and rewards for each bug found.
2. Security researchers sign up and begin testing software or a website for vulnerabilities, following the program's rules.
3. When a hacker discovers a bug, they fill out a disclosure report that details what the bug is, how it affects the application, and what severity level it has. The hacker includes key steps and details that will help developers reproduce and verify the bug.
4. The company is reviewing the report, assessing the severity of the vulnerability, and working to fix the error.
5. The company's developers then conduct retesting to confirm that the problem has been fixed.
6. The researcher then receives a reward. The amount may vary depending on the severity of the vulnerability and the company's policy.

Large corporations usually launch their own Bug Bounty programs. For example, Google has paid out a total of $10 million in bug bounty in 2023.

Google's Bug Bounty program. Source

In 2016, the US Department of Defense decided to use ethical hackers in its “Hack the Pentagon” program. The program attracted hundreds of researchers from around the world. They found about 7,000 vulnerabilities, and the government issued 15 rewards. Since then, the program has been launched several times to find and fix numerous system vulnerabilities, improving the overall security of the government.

Platform programs​

Platform programs are managed by third-party bug bounty platforms that act as intermediaries between bug hunters and organizations. The platforms provide the necessary infrastructure, policies, and processes to run the program.

These options help companies streamline the process of submitting, reviewing, and distributing rewards. This option is more suitable for smaller companies that do not have the resources and popularity among researchers to conduct the program on their own.

The Bug Bounty program works through the platform according to the following algorithm:

1. Company and program registration:
   • The company registers on a Bug Bounty platform (e.g. Bugcrowd, HackerOne, Synack).
   • Defines and describes the parameters of its program, including goals, rules, conditions, and rewards for discovered vulnerabilities.
2. The program is published on the platform and becomes available to registered participants.
3. Security researchers register in the program and undergo verification.
4. They test the company's system for vulnerabilities, following the program's rules.
5. Researchers submit a report through the platform describing the vulnerability and suggesting methods for reproducing and fixing it.
6. The platform automatically notifies the company about a new report.
7. The company's security team reviews the received report and confirms the existence of the vulnerability. If necessary, the researcher and the security team can interact through the platform to clarify the details.
8. The company is fixing the vulnerability and retesting the system.
9. Once the vulnerability has been fixed and its criticality is confirmed, the company sets the reward amount in accordance with the program rules.
10. The platform rewards the researcher.
11. The platform provides the company with statistics and analytics on detected vulnerabilities, program effectiveness and costs spent.
12. Based on the information received, the company can adjust the terms and conditions of the program, improve its security systems and continue to interact with the platform to further search for vulnerabilities.

Atlassian's Bug Bounty Program on Bugcrowd. Source

Bug Bounty Platforms​

There are many platforms for running Bug Bounty programs in the white hat hacking world today, and their number is constantly growing as the demand for such services increases. Companies choose a platform based on their needs, budget, and the specifics of their work.

The most popular of them are:

HackerOne
The most famous platform where various companies host their programs, including large players such as IBM, LinkedIn, Uber, etc.

HackerOne provides easy-to-use tools for reporting and managing discovered vulnerabilities, including integrations with various systems to facilitate the testing and reporting of bugs.

In addition to monetary incentives, the platform also creates a leaderboard for the hacker community , which helps them gain recognition among their peers.

Bugcrowd
Connects companies and their apps with tens of thousands of security researchers to identify critical vulnerabilities. Notable developers include Atlassian, Tesla, and Motorola.

Supports both private and public Bug Bounty programs, allowing hackers to choose the most interesting and suitable tasks for themselves.

Bugcrowd offers resources for learning and development, including webinars, guides, and the opportunity to interact with other security professionals through Bugcrowd University and forums.

Intigriti
A European platform with a focus on flexibility and adaptability of Bug Bounty programs. Intigriti offers a wide range of tests, a strong community and a support system. The platform not only connects hackers with companies, but also fosters the creation of a professional community where researchers can share knowledge and experience.

Intigriti's clients include Microsoft, Volkswagen, Adobe, Telenor, and KPMG.

Intigriti's internal team reviews all hacker reports before sending them to clients to ensure the information is described correctly and the researcher can receive constructive feedback.

Synack is
a private, freelance security research group spanning 6 continents and over 80 countries. Synack employs the strongest researchers from around the world who have passed a rigorous selection process .

The Synack team performs penetration testing of web and mobile applications and host infrastructure. The platform's clients include Microsoft, Intel, SAP, Samsung, and others.

YesWeHack
The platform offers bug bounty programs for different types of systems and applications. Participating companies include Airbus, Orange, Oxfam, Société Générale, and others.

YesWeHack uses flexible reward models that can range from fixed amounts to bonuses for particularly serious vulnerabilities. The platform also has a ranking system for bug hunters, which increases the competitiveness of researchers.

HackenProof One of the youngest bug bounty and security testing platforms, which provides white hat hackers with the opportunity to search for vulnerabilities in the systems of companies such as Coca-Cola, IBM and Nokia.

It supports a dynamic testing system and automated analysis tools. Hackers can work not only on web applications, but also on mobile applications and IoT devices.

What skills are needed to become a white hat hacker in Bug Bounty​

Bug hunters are people who know the basics of cybersecurity and are good at finding flaws and vulnerabilities.

Hard skills that will be useful for a bughunter:

• Understanding the ethical and legal aspects of working in cybersecurity to ensure program compliance and maintain trust in the white hat community.
• Proficiency in programming languages such as Python, JavaScript, Bash, or Go for scripting and automating tasks.
• Web development fundamentals, including working with HTML, CSS, and JavaScript to understand how web applications work and find vulnerabilities.
• Database skills and knowledge of SQL to identify vulnerabilities related to the interaction of applications and databases.
• Knowledge of network protocols such as TCP/IP, HTTP/HTTPS, DNS to analyze network activity and identify vulnerabilities.
• Proficiency in popular security testing tools - Burp Suite, OWASP ZAP, Nmap.
• Understanding the basics of working with version control systems Git, GitHub to manage code changes and collaborate with other security researchers.
• Confident command of English.

Soft skills of a white hat hacker

• Ability to analyze data and think logically to interpret test results, find vulnerabilities and develop methods to reproduce them.
• Communication and report writing skills to effectively communicate with developers and document found vulnerabilities.

Useful resources for newbie bughunters​

Literature on cybersecurity:

• The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws - the book describes various new technologies that are used in web applications, and also examines in detail new types of attacks on web applications.
• Real-World Bug Hunting: A Field Guide to Web Hacking is a guide to finding software bugs. The book is intended for both novice cybersecurity professionals who want to make the Internet safer and experienced developers who want to write secure code.
• Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities - the book teaches hacking, checking the source code of applications for security issues, finding vulnerabilities in APIs, and automating the hacking process.
• WEB HACKING 101: Books for White Hat Hackers is a guide to hacking systems from basic to advanced levels.

Video tutorials and training platforms

• Hacker101 — free video courses in English that cover basic and advanced bug hunting techniques. Includes practical tasks.
• The Cyber Mentor is an English-language YouTube channel with many video tutorials on bug hunting and ethical hacking.
• Hack The Box is a platform that provides virtual machines with varying levels of complexity for cybersecurity practice.
• TryHackMe - interactive rooms with different scenarios for learning and practicing hacking and cybersecurity.

Hacker's office on the Hack The Box platform. Source

Bug Bounty Inside - White Hat Hacker Commentary​

I started participating in the Bug Bounty program a long time ago, even before the term itself was established. I "sold" my first vulnerability, that is, I told the system administrators — the largest payment solution at that time, WebMoney — about the vulnerability and received a reward for it; this was more than 15 years ago. I participated in the Bug Bounty from Rambler (at that time it was the undisputed leader in the industry).
One memorable case was when I was looking for vulnerabilities in a search product and managed to completely compromise the system through a search query: you could ask the robot to index system files, then show the result, which contained the credentials. I like non-standard approaches and solutions beyond “take a tool and apply it”, which is probably why I remember it.
But there is a flip side to the coin. Over the past year, I have sent out over a hundred reports to companies of all sizes, from behemoths to small online stores. And, it is hard to believe, I received less than 1% response. Even though we are talking about information that can sometimes save hundreds of millions of dollars for a company.
Anton Shustikov, CEO of the non-profit educational project CakesCats in areas such as Crypto / InfoSec / AI

Source