Now and then we can hear that some company has been hacked. People think it’s black magic or something. No, it’s not. It usually means some evil dude found a way to break the system’s security mechanisms to get into the system. It might be either innocent such as a company’s website defacement to show off or a serious security breach such as stealing confidential information – documents or customers’ data. In both cases, the company suffers losses.
There is also a group of people who does it out of curiosity. They don’t want money, don’t want to be famous, they just want to challenge themselves. Sometimes they even report the vulnerabilities they found to the company in good faith. Unfortunately, this very often ends up in court. Despite their intentions, this is treated as breaking the law and they have problems.
So what if you want to be one of them but not break the law at the same time? Is it possible? The answer is YES!!! And even more – you can not only challenge yourself but also be rewarded for your time and effort at the same time. Bug Bounty Programs come into play.
The “Bug Bounty Program” is a program runs by the company, which allows people from the outside (wannabe hackers, security specialists, researchers, and you) to search for vulnerabilities inside the company’s assets. If you find a valid vulnerability – you will be (mostly) awarded for it somehow.
There are two types of bug bounty programs – the one the company runs on its own and the “Bug Bounty Platform” which is a kind of bridge between the bug hunter and the company which runs the program. The bug bounty platform hosts many bug bounty programs from different companies.
The programs on the bug bounty platform may be public or private ones. The public ones are available to everybody whilst the private ones are available only for the chosen researchers who already have some reputation on the platform. In this case, they get special invitations to participate in a private program. The main rule of bug bounty programs is when that you have to be first to find the bug. Only then you will be rewarded. Otherwise, your finding will be treated as a duplicate. It gives you knowledge and experience but no reward.. and it is sometimes frustrating. That’s why if you hack on the private program, you have less competition and a higher chance of getting the valid bug.
There is also a category like VDP which stands for Vulnerability Disclosure Program. Simplified things this is a kind of Bug Bounty Program without bounty :). I mean a company that runs this kind of program will accept the bugs and you might expect in return:
- nothing
- “thank you” e-mail or letter of appreciation
- entry in the Hall of Fame – your name will be listed among other hackers on the special “Thank You” page
- reward such as swag (the mug, some gadget, gift card, t-shirt)
It all depends on the company. I personally think VDPs are good for beginners to sharpen their skills, as they are less crowded because everybody goes for money :].
The VDPs I’ve got good experience with are:
- BBC
https://www.bbc.com/backstage/security-disclosure-policy/ – really cool t-shirts - Government Of The Netherlands
https://www.government.nl/topics/cybercrime/fighting-cybercrime-in-the-netherlands/responsible-disclosure - Erasmus University Rotterdam
https://www.eur.nl/en/campus/locations/campus-woudestein/security-safety/information-security/responsible-disclosure - RedBull
https://app.intigriti.com/programs/redbull/redbull/detail – found on Intigriti platform
The bug bounty platforms I am active at are:
- Hackerone – https://hackerone.com/users/sign_up
- Intigriti – https://login.intigriti.com/account/register
- Bugcrowd – https://bugcrowd.com/user/sign_up
There are more bug bounty platforms, however, I don’t have any experience with them. Try them and challenge yourself.
| Bug Bounty Platform | Website URL | |
| 1 | HackerOne | https://www.hackerone.com |
| 2 | Bugcrowd | https://www.bugcrowd.com |
| 3 | Synack | https://www.synack.com |
| 4 | Detectify | https://cs.detectify.com |
| 5 | Cobalt | https://cobalt.io |
| 6 | Open Bug Bounty | https://www.openbugbounty.org |
| 7 | Zero Copter | https://www.zerocopter.com |
| 8 | Yes We Hack | https://www.yeswehack.com |
| 9 | Hacken Proof | https://hackenproof.com |
| 10 | Vulnerability Lab | https://www.vulnerability-lab.com |
| 11 | Fire Bounty | https://firebounty.com |
| 12 | Bug Bounty | https://bugbounty.jp |
| 13 | Anti Hack | https://antihack.me |
| 14 | Intigrity | https://intigrity.com |
| 15 | Safe Hats | https://safehats.com |
| 16 | Red Storm | https://www.redstorm.io |
| 17 | Cyber Army | https://www.cyberarmy.id |
| 18 | Yogosha | https://yogosha.com |
See you next bug 🙂