bug-bounty

[fast fable]

its not a problem, we're all here to learn

[fast violet]

ty

[uneven gale]

Gave +1 Rep to @fast fable (current: #14 - 628)

[gaunt olive]

Anyone tried bugcrowd? What your thoughts abt it?

[lapis tiger]

Hey,
I tested a vulnerable endpoint that modifies personal information. I intercepted the request using Burp Suite and found it included a CSRF token. I deleted the token and sent the request again — and surprisingly, it still returned 200 OK and the changes were applied.

This confirms there's a CSRF vulnerability, since the server doesn't properly validate the CSRF token.

However, when I tried to create a CSRF PoC in HTML, it failed because the request is blocked due to an Origin or Referer check. The browser prevents the cross-site request for security reasons, even though Burp Suite allows it.

So even if I can't make a working PoC in the browser, the bug is real and can be clearly demonstrated with Burp.

Is there a solution?

[lilac spindle]

Is it making a pre flight request or have you checked the cookie’s SameSite flag?

[lapis tiger]

HttpOnly; Secure; SameSite=Lax

it gives me {
"request_id": "d1a75924-4a46-4ef7-bae3-75f84caa49b4",
"code": "",
"message": "supplied credentials do not pass authentication"
}

[granite obsidian]

The error "supplied credentials do not pass authentication" confirms that the site does have CSRF protections, but they are implemented incorrectly (they depend on the browser rather than the backend). Your finding is still valid, but you need to:

• Investigate what mechanism is blocking the request (cookies, headers, etc.).

[fast fable]

wtf

@lavish hollow

[fast fable]

yeah, because it needs the csrf token....

[lavish hollow]

@granite obsidian Please don’t post AI slop here

[lapis tiger]

Hello,
Several times I managed to bypass the CSRF token protection, either by deleting it or by replacing it with another token from a different account, and the information was successfully changed.
But I'm encountering a problem in the PoC because of CORS.
I would like to know:
Is it necessary to have access-control-allow-credentials: true in the response?

[granite obsidian]

Some people's trash is others' treasure. They are part article, part search, and yet another AI article. I apologize in advance.

[lilac spindle]

Yes, because thats the mechanism that allows the cookies to be sent on cross-origin requests

[lapis tiger]

What happens if we have
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true?

[lilac spindle]

This is something you can easily search in Google.

[lapis tiger]

I searched and I found that I can't use POC

[lavish hollow]

We have rules here regarding AI usage, you can find them detailed in the community guidelines #rules

Generally if someone is asking here they want to speak to a human, anyone can freely use AI 😄

[tropic kayak]

How can i start as bug hunter?

Any sources?

[lilac spindle]

Check the pinned messages on this channel

[tropic kayak]

Ok.

[lapis tiger]

Hi , When I try to perform the PoC for CSRF token , I get an error message: Failed to load resource: the server responded with a status of 401 ()

[plain imp]

wtf that profile picture...

[obtuse fern]

Can you change your profile image please ?

[hybrid orchid]

You're tolerating Nazis now..?

[jolly ledge]

:hammer: subhan03056#0 has been banned.

[obtuse fern]

No

[swift needle]

what kind of course I have to do for bug bounties as for now i make my goal to learn ceh and pnpt maybe oscp also but want to know these course are enough to get into bug bounty or i need to do some other courses related to it ? also is it true that most of the people use their pre made script to find the bug ?

[obtuse fern]

You need practice for bug bounty . In terms of courses Web App Pentesting path on THM and Burp's Web Security Academy are a good starting point

[swift needle]

is it true people have the script to run each time if any kind of event come to find an bug they run the script and finds so for newer guys it become an headache to find any bug

[lilac spindle]

I would say there are a number of people who do automated scans of possible vulnerabilities

But I say bug bounty is more of a headache for new people because public BBPs and VDPs already have a lack of reportable vulnerabilities.

[swift needle]

Like paid software?

[swift needle]

But from that can't it help you to hack the website?

[lilac spindle]

Well there are paid softwares (e.g., Burp Suite Professional) and free ones like nikto, nuclei, etc.

[lilac spindle]

I don’t understand what you mean

[swift needle]

Like getting complete access

[swift needle]

Not in bug bounty,
I just have a question
In real time or in scenario what things i need to start this pentesting like just copy the url and put that in terminal then run the dirb command for pentesting?

[paper sable]

As a novice myself, I would highly recommend you go through the learning path, or at the least as many free easy rooms as you can, watch videos on ethical pentesting, etc.
Based off the question you're asking you don't want to go poking around yet, even if for unethical purposes you will just end up in trouble if you don't know what you're doing, if you make it that far.
No hate at all in my reply, if taken that way it is not my intent.

[lilac spindle]

Yes, what this person said ^

[swift needle]

Nah am just new making my decision in this career, although I done a basic free intro of course here and I completed that but stucked on some questions like this one in my brain

[paper sable]

I have only completed like 32 rooms or so, and I have learned enough to know you have not made it through many rooms because of your question, nobody can do it for you and there is no shortcuts.
If you do want to get there, you can as can anyone, but it will take time.
I'm my first week in, loving it, even the boring foundational concepts about networking, and if you don't share those same emotions, it will be a rough road, passion takes you far in fields like this.

I am bouncing to a different channel though, so I do wish you all the best and a wonderful journey forward.

[swift needle]

Still you don't get its fine the one which I did was not even the room or machine xd

Nice all the best

[shrewd whale]

can someone give me some techniques and methodologies to bypass the waf

[obtuse fern]

Why ?

[shrewd whale]

Bug bounty

[obtuse fern]

Why would you want to bypass WAF ? Which program , what's the scope ?

[shrewd whale]

Indeed in bugcrowd and the scope
*.indeed.com
So I was trying eg.indeed.com/?jobs=<script>alert(1)</script>

Didn't word by waf

The waf is cloudflare

[blazing nacelle]

Did u manage to bypass

[shrewd whale]

No
If I can bypass it
Why I will ask here

The waf has a strong security
Cloudflare

[blazing nacelle]

just asking coz its a day you posted ur question

[shrewd whale]

I just want some Methodologies and techniques to bypass it
I am new to bug bounty hunter

[blazing nacelle]

try all encordings and mostly try inside burp not on browser it may have strict wafs
2 try img src
3 try less known payloads like svg

[blazing nacelle]

is it a vdp or bbp

[shrewd whale]

Bbp

[shrewd whale]

Thx

[uneven gale]

Gave +1 Rep to @blazing nacelle (current: #3020 - 1)

[blazing nacelle]

start by vdp they are less strict since many proffesionals go for money
look for a target with many domains to increase your chance of getting untested urls

[shrewd whale]

Thx bro

[blazing nacelle]

mp you are free to inbox if you need help

[shrewd whale]

Ok

[obtuse fern]

This is such a basic payload , you need to inspect the context in which it appears when rendered on the page

[shrewd whale]

Guys I was scanning web app
And make two accounts
Because to scan
IDOR
Or session Hijacking

I took the parameter from the url value from account x
And put it in account y
Didn't work
But I tried to take the header cookie value and I put it from account x
And put it in account y
And it's worked

And I tried to put a random value in the url parameter

And it's worked

So
Is this a valid session Hijacking bug?

[lilac spindle]

It’s not session hijacking because you just pasted the session from Account X to Account Y. Session Hijacking is when you’re able to retrieve sessions from another user either through passive (e.g. via XSS) or active (e.g. phishing) interaction.

It can be IDOR if you’re able to access the information from Account Y using Account X’s cookies

[shrewd whale]

Yes I accessed the information
I saw the information

I saw the account Y information

[nova vault]

how to learn bug bounty as i am beginner

[arctic acorn]

Because you essentially logged in to Account Y when you modified the cookie lol

Like Mknukn said, if you can access information from Account Y while logged in to Account X, then it can be considered

Otherwise just copy pasting the session cookie is something that can only be exploitable in direct user-to-user phishing, like when User X tricks User Y into fetching their session cookie for them often by running a small JS code snippet which they don't understand

That's also why Discord has this warning in their console, if you didn't know earlier

[clever tulip]

I found a low risk bug and i made a video on it to send to get my bounty only to realise it wasn’t on the scope 😭 (Im double checking from now on)

[fast fable]

This is like you've given your password to the other user

[long oyster]

Hey everyone! I’m currently learning web hacking through TryHackMe and have worked on topics like JWT authentication, IDOR vulnerabilities, and even bypass techniques like parameter pollution. I’m practicing with labs and getting really comfortable using Burp Suite.
I’d love to know — what skills should I focus on next before I start hunting for real vulnerabilities in live programs? How do you know when you’re ready to start bug bounty hunting seriously and start making money? Any tips on the mindset or resources that helped you get your first bounty would be awesome.

[final crown]

try other payloads

not just script alert

and try url encoding as well when you are in the browser

try an img src onerror payload perhaps

its gonna be mostly trial and error to see what works or moreso rather experimentation, but if it works on burp then thats a good sign

[obtuse fern]

Bug bounty is usually a side gig not a real job , I would recommend you to focus on mindset and methodology more than on tools . To learn more about mindset and where to look for vulns. in web apps check some webinar from Jason Haddix , he is really good in explaining it 🙂

[blazing nacelle]

it wont work since its been reflected inside <label>tag he needs to escape that if am seeing corretly

[drifting hemlock]

Wow am a noobie too
Glad to see am not the only one just starting

[paper sable]

@drifting hemlock it's fun

[ornate plume]

Hello guys i have a question. I was recently doing a bug bounty and came across a mechanism where application uses refresh token to get the access token. And once we have refresh token of any user we can just use that to delete their account with no authentication.
Is that a valid bug.?

[lilac spindle]

It can be a valid bug as it would become an account takeover IF you have the refresh token.

[ornate plume]

Yea.. i submitted but they closed it saying
"Hello,
The purpose of refresh tokens is to generate new access tokens, which is the behavior you're describing. This does not constitute a vulnerability or pose a risk.

Thank you,"

They didn't even think of validating if person using the refresh token is the correct one or not

[lilac spindle]

They are correct though. That’s why I said “if you have the refresh token”. If you want your vulnerability to have impact, you need to chain it with a vulnerability that allows you to retrieve refresh tokens of other users (e.g. XSS).

[ornate plume]

There could be many ways to get that.. but it didn't change the fact that they don't have authentication

[lilac spindle]

Yes but you did not show that hence why your bug was closed.

Its like saying the JavaScript library version is outdated and vulnerable to a certain CVE. Without impact, it will become informational.

[shrewd whale]

Guys
Should I learn metasploit for bug bounty
Or this will be a great feature for me

[obtuse fern]

It would definitely be a +

[shrewd whale]

Ok

Thx

[half hare]

Hello, that's not the server for it.

[mighty forge]

I'm new to hacking/IT and looking for some clarification.

I have a working XSS payload between two laptops on the same LAN.
Laptop A clicks the malicious link which sends the request to Laptop B via my home router.
I don't understand how to set up a public facing server to use as the fetch endpoint and pull data from.
My questions are:

1)Is a public server necessary to demonstrate an impactful POC?
2)Where did you learn to set up public facing servers? Scouring Google, etc has left me more confused than when I started

[vocal adder]

It's probably best you get some steer rather than the full answer.
NAT does not allow inbound connections without a port forward, so either learn how NAT & port forwarding works or get a cloud device i.e., linode or ec2 and listen there.

Both may end up being good learning experiences.

As for "Is a public server necessary?" No, not for a PoC

[echo hornet]

After spending how much time doing labs and learning should I consider getting into bug bounty?

[stuck trail]

its definitely not by time spent its by how much skillset you earned and mindset you built , m just sayin what the others told me so what m gonna do , i m going to start learning brick by brick and focusing on one goal ; earn my first paycheck on bug bounty hunting !lets do it together for more motvation if u want

[obtuse fern]

Practice oh machines like owasp and juice shop , Burp's mystery boxes , ... You can start immediately

[blazing nacelle]

hey fam am looking for someone to collaborate with someone who is always online as i do,someone who always want to dig deeper and learn everyday and good communicator of a lil thing they find it doesnt matter if you are new to bug bounty just want someone to talk to and motivate each other everyday to reach our goals

[stuck trail]

yo m here bro , m new too but i started working everyday , and m super motivated and want to reach crazy goals . But also super disciplined ! lets link up . just keep our identities secret i prefer ! DM me !

[blazing nacelle]

cool

[flint sable]

Hey everyone!
I’m looking for people who already have some experience in cybersecurity, hacking, or programming. Let’s learn together, share knowledge, and improve as a team. We can help each other out and maybe even collaborate on some cool projects. If you’re interested, just let me know! 😊

[wet lava]

Hi, i think i might be one o them

[flint sable]

how long did you lear cybersecruity,programming or ethical hacking

*learn

[pliant lake]

Hey I’m still a beginner in cybersecurity, n I don’t have much experience yet — but I’m really interested and actively learning rn, I’d love to join in, learn with others, and maybe contribute however I can. Let me know if that's okay!

[flint sable]

ok

[fallen palm]

How to learn bug bounty only for Android phone if I want to find bugs in android phone then what to learn and who will gonna talk about this like a YouTube channel or any article

[obtuse fern]

Check this article for beginning
https://tryhackme.com/room/androidhacking101

[wet lava]

I was coding since i was 15.

[flint sable]

I was coding since i was 14

[crystal bough]

That's good

i just started

[pseudo garnet]

#quiet-conversation

#rules https://tryhackme.com/room/androidhacking101

[delicate ridge]

Hey 🙂 I check all the boxes. Looking forward to it. Thanks

[uneven gale]

Gave +1 Rep to @blazing nacelle (current: #2015 - 2)

[shrewd sentinel]

Upon clicking on the chain of custody explanation (marked in green) the explanation box pops up out of the screen and is not readable.

[obtuse fern]

You can report it in #1333993673381253162 🙂

[shrewd sentinel]

Done.✅

[crimson mural]

send me some of that mulah

[shrewd sentinel]

No mulah sir 😅

[languid pendant]

👋 I'm new here, nd to cybersecurity.
Any advice on pentesting would be appreciated

[delicate apex]

Hello guys

Anyone active?

[lost spire]

yes

[delicate apex]

Hello how are you doing today

Can I ask you some questions?

[lost spire]

good , yes

[delicate apex]

Can I found bug bounty on my iPhone?

With my iPhone?

Hello

I’m iPhone users just asking about website I can use

[delicate apex]

???

[lost spire]

yes

you can .

[lost spire]

are you there ?

[delicate apex]

Yes

I think you are ignoring my message

[lost spire]

no buddy , there is a network issue!

[delicate apex]

Okay dear

Which website can I use ??

[lost spire]

bugcrowd

[delicate apex]

Thank you

🌹

[final crown]

What in the name of god

[hearty marsh]

best way to spam practice penetration testing? is it having a vm and having an attack vm with metasploit and keep testing different stuff or is there a better method

[lilac spindle]

Do capture the flags

There is a lot of those in TryHackMe

[mystic jetty]

Hi I want a small assistance

I'm getting a XML error in gcp token expiry and would want to bypass that

https://storage.googleapis.com/uni-dev-u1-emnewcontent/content_data/Animation/2025/8/4/175431470444123239_dir_V001/1/1754314704301/zsa.mp4?X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Credential=uni-dev-u1-emnewcontent%40uni-dev-u1.iam.gserviceaccount.com%2F20250806%2Fauto%2Fstorage%2Fgoog4_request&X-Goog-Date=20250806T050215Z&X-Goog-Expires=60&X-Goog-SignedHeaders=host&X-Goog-Signature=b80108ac3c2a051250c651268e02278ffc82a93a0d853055a7f171506da85e147637046d1ea13ca3ed961a2816100342ad8a1e3f30c769ecc608844b8bd5309b7f4e7d4798c6a841a76e67a651cbd11bd4ab31bdfad428ce89547b640d9822a0868c93631d29dbd9ac1ecc043743296154539eb4115702483e059a34c75738848a42a5eae9544b6701467ee24925cd3d00af9ce6dac072d7ef646395a8a14dd587836bfa11022860e6b992586bbfd40b270ff346e8e8d70dfe3668eeca89f88a847348ad7e9b621af67e6df3bfba31db94ad43814e2b929ce23f06e4d4b751543019e17b9170fa344b7a7d886e1602620d2f75e2f622b3156d7ac58d9667e19b

With this URL

So what will be the most suited

Exlpoiting blind XXE to retrieve data via error messages

Or Outh 2.0 exploitation ??

Like what is happening when I have signed in a website and I goto content section and I try to run the content, In network tab I see this query hitting and getting expired after hitting as it gives 400 status code. And if I run its api in postman it gives 401 unauthorised

[lilac spindle]

If it’s 401, it’s probably missing the authentication factor like a cookie or JWT.

If it’s 400, there’s probably a client side error like a malformed payload, insufficient info provided, etc.

[abstract cape]

sudo nmap -sS -sV tokens.grammarly.com
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-08 14:42 EDT
Nmap scan report for tokens.grammarly.com (18.211.23.229)
Host is up (0.0085s latency).
Other addresses for tokens.grammarly.com (not scanned): 54.157.2.167 13.216.189.25 64:ff9b::12d3:17e5 64:ff9b::369d:2a7 64:ff9b::dd8:bd19
rDNS record for 18.211.23.229: ec2-18-211-23-229.compute-1.amazonaws.com
Not shown: 999 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
443/tcp open ssl/http AWS Elastic Load Balancing

hey guys Iam doing a bug bounty conducted by gramarly in hacker and stucked here can anyone help

what should do next

[hybrid orchid]

Just to be clear:
You have port scanned an ELB (are other services even in scope...?) and are now stuck.

You don't have any further ideas after one of the simplest enumeration steps?
I would suggest avoiding bug bounty for the time being...

[abstract cape]

well I also scanned for other domains in scope like auth.grammarly.com, *. grammarly.io with tools like nuclei,subdomain and for server header response purpose curl but in *. grammarly.io no sub domain of it are not useful because they are not responding and reachable even i checked by visiting those website they are not responding . so those domains are not useful .

[abstract cape]

why ? I know like first we have to scan website and xss for knowing whether it had xss vuln and search exploits based on the version or port . i want to know to get hands on experience and knowledge

burpsuit was not installable in my system

[hybrid orchid]

I mean, as long as you read the scope, understand the scope, and follow the scope, you should be okay practicing on bug bounty targets. Not sure I'd recommend that for starting out though... way too easy to end up in legal difficulties.

You're also unlikely to find anything in a big programme if you're just using off the shelf vuln scanners (e.g., the built in nuclei templates).

[fast fable]

yeah, all the best - iirc grammamly has had its $100,000 bounty for years now

[abstract cape]

I had gone through with the scope and iam not participated in grammarlyies bug bounty prog but iam doing in hacker1 web where grammarly posted some domains and apps in hacker1 . so I concentrated in domain that are in scope in hacker1 where Iam trying to get atleast between $100 to 500$ .

As iam doing for the 1st tm

[flint sable]

Where to start bugbounty?

[obtuse fern]

This is a good staring point 🙂
https://tryhackme.com/path/outline/webapppentesting

[iron burrow]

how do you guys look for bug bounties? i’ve just started learning IDORs and wanted to test out on a real vulnerable site but i’ve got no idea where to look 😔

[lilac spindle]

Usually you’d look for IDOR on actions that retrieve objects like a post, personal info, etc.

Then you try and see if the parameter is vulnerable. You would usually make 2 accounts and perform A/B testing

[iron burrow]

What I'm having difficulty in is finding acutal targets that are vulnerable

[final crown]

welcome to the world of bug bounty

if you wanna practice idors i recommend checking out the juice shop room in tryhackme or going on portswigger labs

[iron burrow]

I’m doing a bugbounty on a storesite. I made 2 accounts (victim/attacker), and I found I can change the victims store name through the attackers account, but it required knowing the victims CSRF token. Can this be reported as a valid bug? is there a way to find out someone elses CSRF token?

[still jasper]

Unless you found a vulnerability that exposes the CSRF token it will most likely come out as N/A due to social engineering

[iron burrow]

oh 😦

[delicate ridge]

Hello senior bug bounters 👋 I have recently started to do bug bounties and learnt cyber security. I've submitted couple of report on different platforms (hackerone included) but they got rejected.
I want to know if these types of reports is normal to be rejected by the client - all of them passed the triage.
To name a few:

• storage abuse and impersonation (anyone can upload on someone else account with no validation or authentification)
• Google indexation of personal file and illegal content by the company, not the user/content owner
• Missing CSRF + CSP + X-XSS on account login page
  All were marked as 【informative】with the no explanation and option to comment.
  Thank you!

[split elbow]

Is there a learning path on thm on how to start into bug bounty? or is there any resource or article I can follow?

[woeful frigate]

penetration testing

[woeful frigate]

what does the bug bounty program rules say

[obtuse fern]

Yeah this one 🙂
https://tryhackme.com/path/outline/webapppentesting

[split elbow]

Thank you I'll start with this one.

[cold narwhal]

Hi. I'm a newbie to bug bounty. I wish I wanted to start it before my graduation (1yr left) and I made it my personal goal. Can anyone help me out. And I want some collaboration so that we can both grow together.
Though I do have some exp from CTF and rooms, i still don't know how to get started
Do I need to invest some money into it for high quality knowledge or is it better to learn more about a tool itself
Can anyone help me

[fast valley]

honestly i'm not even at the level to start real ctf but it will surely be fun to learn with someone else so if you are still open later when i would became a bit better why not

[cold narwhal]

Sure
Invitations r always welcome 😁

[fast valley]

wanna add up ?

[iron burrow]

I'm in the same exact situation as you lol, I've done a handfull of courses and spent alot of time in juiceshop, now I'm trying to move on to real targets and strugling

[untold stone]

Hi guys did anyone after getting the certicate from thm tried to hunt for bugs in websites like
Hackerone.com

Or bugcrowd.com

[obtuse fern]

You don't need a certification to start with bug hunting 🙂

[tight dock]

Hey dante. I'm still learning the fundamentals myself but I'd definitely like to collab if you're open to it.

[novel sage]

Can anyone suggest me. Which platform is best for bug bounty hunting for beginners

[obtuse fern]

Platform doesn't matter but the most popular ones are h1 and bugcrowd

[novel sage]

Tnx for your suggestion sir

[slim lodge]

Can anyone suggest what modules or learning paths I should complete on tryhackme before trying bug bounty or even courses on websec-academy

[obtuse fern]

This one 🙂
https://tryhackme.com/path/outline/webapppentesting

[daring wing]

Where can I find a lab to practice File Upload vulns with Weevely?

[lilac spindle]

There are tons, especially in TryHackMe

[high vessel]

If you have to rate the difficulty level of real bug hunting, compared to labs....what percentage is the difficulty level of labs of the real world vulnerability?

[lilac spindle]

It depends! Not every vulnerability is hard compared to labs. More often than not, some issues are easily reproducible.

I think most of the main issue stems from some form of security system in place (e.g., CSP, WAF, etc.) that bug hunters take the time to bypass versus actually exploiting a vulnerability.

There are other cases where the vulnerability is very hard to exploit since it requires multiple chains of other simple vulnerabilities.

[dim kraken]

Hello guys I’m new to bug bounty. Having a good experience in thm labs and would like to explore bug bounty can someone suggest on how to start the process

[tulip cosmos]

hey is anyone familiar with the network infrastructure side of bug bounty? instead of purely finding web app is the network bug bounties essentially just a pen test? Doesnt say much in the scope other than to provide the bug crowd handle in the requests.

[shut trellis]

yoooo can anyone teach me how to do bug bounty dm me please

[obtuse fern]

Everything that you need to start is provided in this path 🙂
https://tryhackme.com/path/outline/webapppentesting

[shut trellis]

thanks man

[uneven gale]

Gave +1 Rep to @obtuse fern (current: #1 - 5857)

[noble creek]

eat some soup

hey he needed help

[waxen mesa]

Hi

[shut trellis]

hey

hey anyone up

[undone yarrow]

yup

[fiery star]

Sup guys

[cerulean ingot]

Im tryna really master webapp recon but I feel like I need to remove all the "magic" that comes from these automated scanners.. but is that even possible?
like, to get results like <subfinder + all the api keys> can I rely on my own tooling + free queryable data sets?
Or is it like, you need the osint api guys because they already crawled the entire internet like shodan?

tl;dr - is it possible to get results like subfinder + all api keys without relying on APIs? or would that involve downloading huge databses like ssl cert transparency logs...
and how much automation is just outright bad? What part of recon do you always do by hand? This is all from bug bouinty / webapp testing pov

[lilac spindle]

I think the big part about recon you’re talking about is identifying assets that are alive. It is possible to do it with limited and open source toolset but I guess users that have API keys do get more results but they can still be the same information found so its not necessarily a win already. Most of the recon that is by hand is usually on the asset’s context like understanding its business logic flow, things like that

[stray orchid]

Sir I have a question regarding wordpress based attack can I put my querry here?

[lilac spindle]

You can

[stray orchid]

I encounter a wordpress site which prevent me with wordfence defence step to take for further enumeration , if you want than I will sent screenshot

[lilac spindle]

We won’t teach you on how to bypass security solutions designed to protect assets. One of the main part of bug bounty is trying to bypass these defenses and I doubt anyone would willingly share how they are able to bypass a security solution.

[vale shale]

Hello everyone,
I’m a beginner and I want to learn Penetration Testing from scratch. can someone tell me a detailed roadmap in this field?

[severe pond]

I'm a beginner too. I've been programming since 2 3 years. I've heard the hardest stuff in eth hacking is binary file something. Reverse engineering IG.

[obtuse fern]

This one 🙂
https://tryhackme.com/resources/blog/free_path

[stray spire]

Hello everyone, I hope you guys is doing well. So I'm here to share a little bit about my frustration, actually I'm unemployed and had the brilliant idea to focus full time in bug bounty hunting and I'm doing that about 3 months and a never found any vulnerability, what's the secret hahah? I already spent so much time watching videos and courses but when we go to the real world is 100 times more confuse and specially in youtube no one show what to do after the RECON. Someone have some tip hahha?

[mossy sluice]

My guess would be that it is a competitive domain so every time a bug or vulnerability gets revealed there becomes less overall. But my guess would be your mental toolkit and tools/frameworks are not sufficient. Best analogy I could think of is to not keep sharpening your blade but forge a better blade, and sharpen it.

[stray spire]

Thank you 🙏🏼

[uneven gale]

Gave +1 Rep to @mossy sluice (current: #3105 - 1)

[lilac spindle]

Isn’t what you’re supposed to learn is what to do after the recon?

Bug bounties are largely web app based so TryHackMe’s web application pentesting path and you can also add in the PortSwigger Academy labs and paths to your learning.

[subtle nimbus]

hi hope you all doing well ! i am trying to be a bug bounty hunter i've a little background of hacking but didn't practice for 2 years. and and am back to nothing the problem isnt the learning but its the time now am doing a 10 hrs job and i wanna keep hack but my body and brain doesn't allow me to put more input (feels like dont know if thats the case or not)

if anyone with same problem can give a advice or a tip would be appreciated other can feel free to give a advice i really need that .

[flint nexus]

I’ve had the same problem , i decided to optimize my day. I sleep 6-6,5 h working for 8h and for next 3/4 hours I spending time with my family and playing/walking with my dog . I have left 2/3 hours to learn

[subtle nimbus]

i was thinking about the same thing of sacrifice the sleep but how you get the energy after such a busy day like i know its depends on determination and motivation but it last hardly 10 to 15 days then back to previous routine and worst of all the job i do has nothing to do with tech.

[flint nexus]

Well , you have a choice. You can try to make it or you can give up because u need to sleep for 10h…

I’m also not working in tech for now but I know that I want to. So even when I’m back at house after whole day of sorting packages I know that I need to sacrifice some things to get that job .

[dense shale]

Hello.

[low palm]

Hi
New to bug bounty hunting,any friend??

[dense shale]

Hi.

I did bug bounty sometime apparently.

I just don't remember how to bug hunt

[shell breach]

Hi
I'm new to this bug bounty so can anyone help me and I know basics of hacking

[obtuse fern]

Here's the path you should follow

https://tryhackme.com/path/outline/webapppentesting

[obtuse fern]

If you want to offer a job posting please consult with an admin

[mystic kettle]

I am just starting out in bug bounty and really interesting in learning how to approach it effectively. Please tell me which methodology or workflow do should I follow when working on programs ?

I'd really appreciate any guidance or pointers can share to help me get started in right direction.

Thanks a lot!

[obtuse fern]

One of H1's top hackers zseano has he's methodology on he's blog , you can check that resource out

https://www.bugbountyhunter.com/zseano/

[obsidian raven]

…a solid book that touches on this is Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities. The opening chapters don’t jump straight into exploits—they ease you in, first with the bounty platforms themselves, how they work, how they connect hunters with organizations. Then it shifts toward something people often overlook… how to actually write a bug report. Not just finding the issue, but framing it clearly, so that someone on the other side can see what you saw. It’s a reminder that hacking isn’t just about breaking things—it’s also about communicating them well enough that they can be fixed.

[toxic nacelle]

Guys im an software engineer major + studying for pentesing and was wondering if bug bounty actually profitable or worth the effort?

[lilac spindle]

No, it’s not worth the effort imo. It’s saturated and before you actually get into private programs (where the real money lies), you have to gain “points” from public programs to be eligible.

Take it with a grain of salt but I remember majority of reported bugs end up being P4 or P5 which means you don’t get paid for these types of vulns.

To be profitable in bug hunting, there are different niches people go into. Vulnerability research on browsers particularly the Chromium can be worthwhile if you already have the necessary skillset.

[fossil sentinel]

Hi everyone,

I’m excited to share that I’ve recently started my journey in the field of bug bounty hunting. To build a strong foundation, I’ve been actively learning and practicing on platforms like TryHackMe. I’m eager to grow my skills further, and I would greatly appreciate any guidance, resources, or advice from all of you as I progress in my cybersecurity career.

Thank you in advance for your support!

[rocky oracle]

if i found 2 bugs but the second bug needs the first bug to be present to work, do i submit one or two reports?
the way it works is that the first bug is an idor lets me put a non user object into a user place, then the second bug is that at a second stage it tells me if this is a private resource or not. and knowing that a specific user public and private objects starts with the same prefix, a malicious user can enumarate and find a target's private objects by putting all the possible ids in the second stage and it would say if its a private object or the object doesn't exist, but this all depends on being able to put a non user object in the first stage

[gleaming surge]

I think if u can apply the first bug that is an idor so u do the report and explain that it can be exploitables by doing the second bug bcs when u write the report u should obviously tell the company that how it an be exploitables by explaining all the things they will get a better understanting of the bug so they can fix it and it will worth for you and u wil get what u deserve but u can check better the program policy it could gives the answer maybe u will see that in ur case u dont do 2 report bcs i think ive already read someething like that its that bro gl and if im wrong just guys tell me 😂

[rocky oracle]

makes sense, tysm

[gleaming surge]

Ur welcome bro

[tight oar]

yo guys! I noticed a small glitch on the platform while completing rooms. I might look into it further later on. Can someone give me an example of LOW severity bug found in THM? As per the THM BugBounty terms.

I simply don't wanna test it further if it's gonna be a no-use bug.

[tame siren]

The Bug Bounty Program

Article Link

https://help.tryhackme.com/en/articles/6495946-the-bug-bounty-program

Sep 9, 2025, 8:21 AM

[tight oar]

Oh I did read that...but I was thinking what that non-reward-able vuln type looks like.

[rocky oracle]

do dupes get found fast? so if my report has been a day then its probably not a dupe? or it doesnt matter?

[lilac spindle]

Its more likely the triager hasn’t gotten to it yet.

[finite thistle]

Can someone explain to me what a bug bounty is?

[obtuse fern]

https://en.wikipedia.org/wiki/Bug_bounty_program

[fathom dock]

I mange my works bb program. If someone do not report a high/crit I do not rush to look at it or triage. It can just sit there

[dapper basin]

Been diving into some security tools lately and my team has been testing out this open-source project called CAI (cybersecurity AI).
Me and the team been using it for about a couple of months now and tbh it's been surprisingly effective, as far as we can go (need commercial license to fully squeeze it). but the core is open source, which is great for testing, specially the Bug Bounty Agent.
Genuily curious if anybody has tried it?

https://github.com/aliasrobotics/cai

[jade dust]

Hi! I would like to start Bug Bounty. Can you point to me some beginner friendly programs? Or how would you approach starting in this path?

[lilac spindle]

I don’t think there are any “beginner friendly” programs. My advice is to pick a target, read their rules of engagement and start there.

[jade dust]

That I thought

[fathom dock]

Pick a big one and you have a ton of things to test on

Dell, Sony (includes ALL Sony owned applications). On the big Sony on H1 there is Swag and no $ but they have private programs where you get $.

But start there, I am quite sure you find something at Sony

[visual mantle]

I started testing my school’s website (with permission) by first checking the root domain. I discovered seven subdomains, but only the main one is active — the others are either unreachable or not working.

I then used a JavaScript-related tool to search for any exposed secrets in the code, but everything I found returned “301 Temporarily Moved” responses.

Finally, I ran Eyewitness on the main website, which showed that it appears normal.

What should I do next?

[half hare]

We can't help you with that sorry.

[torpid dune]

Guys , if you have only one advice for someone who does not have a good methodology what it will be ?

[obtuse fern]

Watch Jason Haddix's and zseano's methodology videos on yt

[craggy mica]

I'm a new leaner plz guide bug bounty training

[south frigate]

Same here!!

[obtuse fern]

Start here

https://tryhackme.com/path/outline/web

@south frigate

[toxic nacelle]

guyes can i start bugbounty only from tryhackme ? and is it worth it from the money POV or should i focus more on looking for a paid intern during college?? plz smn help

[glacial timber]

Yoo

[narrow crane]

I am complete beginner pls help me to succeed in hacking bacis

[jade dust]

I've heard and read that doing the CTFs form Hacker101 can make you eligible for private BBPs at HackerOne. Has anyone had luck with that?

My guess is that one should have at least some real reports before getting invited to private programs.

But I also read that the private programs may be easier and have more low hanging vulns

[still jasper]

They’re just given out randomly when you complete their challenges. I wouldn’t say it’s easier but less competitive compared to the big ones

[muted pasture]

just had an minor issue where i had to refresh the page for the answer to be correct. it kept telling me the answer was wrong until i refreshed the page and got it to work.idk if this is common or not

[obtuse fern]

You can start learning on THM , don't look at bug bounty at as a stable source of income 🙂

[neat creek]

.

[steep yew]

best websites to do bug bounty on?

[arctic crater]

I got a bug in facebook . I reported it to meta. The replied me that a security engineer had seen my report and performed initial evaluation. It has been 10 days since I haven't heard back from them

[potent pine]

Did u get any money

@arctic crater was the glitch pached?

[potent pine]

I heard kfc actually pays ngl

Same with insta

[vague turret]

anyone ever wrote and submitted CVEs? got a couple of projects almost ready to go

[fierce junco]

to people working in VR how often do you find zero days?

[torn pond]

Can anyone give me tips for bug bounty hunting , I use the tools like subfinder , nuclei , sqlifinder, httpx . Is there any other tools that I should use , any other things that I should learn etc ?

[lilac spindle]

You need to hone your methodology to find bugs.

[stray spire]

Hello everyone, I’m here to make a purpose, I’m having a lot of free time right now so I’m looking for someone who could help me being a bug bounty mentor and I will share all te bounties, that’s good for you if you can't work full time looking for bounties.

[hybrid orchid]

Just to clarify, you're asking about Burp Suite cracks?

[fathom dock]

Look up nahamsec on YT.

[obtuse fern]

Piracy is not allowed here

[uneven gale]

🔊 Unmuted der_ka1s3r

[fathom dock]

Everyone knows you can not hack without burp pro 😄

[final crown]

the only difference between burp community and pro is a horrible AI and a very sloppy vulnerability detection tool

other than that all the other features are meaningless since community provides you with the best functionality you could get

[fathom dock]

Cadio!

[final crown]

also that but

it looks ugly :<

[fathom dock]

It is

I just use burp for triaging bug bounty reports.

[hybrid orchid]

Are you being serious..?

[fathom dock]

You do understand the usage of the smiley there?

I am not sure

[hybrid orchid]

Usually indicates the person who uses it is smiling.
Subtle sarcasm on the internet is conventionally indicated with "/s", or a joke (if not obvious) with /j.

That said, I asked for clarification rather than jumping to a conclusion because it could have gone either way lmao
Wouldn't surprise me at all in this server to see someone genuinely hold that opinion 🤷‍♂️

[fathom dock]

Repeater and intruder is something I use burp for but not alot besides that.

There is not a lot of reasons to buy Pro.

If you live of bounties, work pays etc

[hybrid orchid]

It's a "nice to have" rather than an essential. Unfettered intruder makes fuzzing quicker, and the expanded extension library can be useful. There's no functionality that you can't emulate with other tools or scripting (counting turbo intruder in that list) though.

Wouldn't recommend paying yourself unless it's making you enough money to justify it though, aye.

Oh, that and permanent projects. Those are kinda essential for a pentester

[wispy flax]

hi guys
anyone know about how to do penetration testing for web application

[lime lava]

I recommend the web hacking module on TryHackMe

[latent badger]

can any share what roadmap to follow for bug bounty im new the platform looking to impement and learn from it

[wheat ridge]

i did Roblox for Bug Bounty on Hackerone

I found like some kind of Vuln like IDOR if you take out ROBOSECURITY then add like random roblox ids then fake IDS like 99999943834939439843

still works.

[north turret]

.

[obtuse fern]

https://tryhackme.com/path/outline/webapppentesting

[obtuse fern]

https://tryhackme.com/path/outline/webapppentesting

[latent badger]

thanks buddy

[uneven gale]

Gave +1 Rep to @obtuse fern (current: #1 - 5969)

[latent badger]

can i also know where to practice thses

[obtuse fern]

Check out Hacker101 CTFs after you finish this path

[latent badger]

okay thank you

[uneven gale]

Gave +1 Rep to @obtuse fern (current: #1 - 5970)

[lofty garden]

Lol nice

Coinbase still has their bug bounty up on hackerone, I was attempting to look into the addresses in their CIDR scope

[proper fog]

Hello

[fiery star]

Hey

[hallow lichen]

Scammer

[prisma palm]

Who

?

[ionic flume]

Hi guys, I'm glad to be in this community. I'm new to bug bounty and I'd like to ask you for some advice from your practice so I can gain some experience from here.

[obtuse fern]

Check out Hacker101

[ionic flume]

thanks for the tip 🙂

[uneven gale]

Gave +1 Rep to @obtuse fern (current: #1 - 5973)

[fallen palm]

Hi everyone, where to start if you want to learn bug bounty? 🙂

[obtuse fern]

Here 🙂
https://tryhackme.com/path/outline/web

[fallen palm]

@obtuse fern thanksss

[proper fog]

Hello guys I am new here

[static radish]

hi

[proper fog]

Hi

[strange root]

Hi

[misty ridge]

Slm sepehr man iraniam

[static radish]

slm che jaleb

[lavish hollow]

Keep it English please @static radish @misty ridge

[misty ridge]

Ok

[wispy flax]

guys how u will be finding the buys in web application
if there any best bug bounty course avalaible

[obtuse fern]

https://tryhackme.com/path/outline/web

[noble mason]

looking friend to learn and collab for bug bounties

[lyric linden]

Can I join you?

[tight dock]

I'd be happy to join as well.

[carmine sundial]

@noble mason Even me, shall we team up and learn?

[noble mason]

Sure

[noble mason]

Letsgo

[worldly wagon]

I wanna we with u guys too

Help know how it works plzies

[worldly wagon]

Yo alone

I saw u in the nezoku's group

[lyric linden]

Which nezoku group?

[lyric linden]

Have you created any group/server for the same?

[noble mason]

Nope

[lyric linden]

Would you create? If any then pls do

[noble mason]

Sure

[lyric linden]

Also please DM me the link once you create the group

[noble mason]

Ok

[near minnow]

[tight dock]

Please send me an invite as well

[noble mason]

Sure

[lyric linden]

You didn't send it to me yet

[latent badger]

im interested

[fallen palm]

Hello i might have found a vulnerability on the website

[tame siren]

@fallen palm

The Bug Bounty Program

Article Link

https://help.tryhackme.com/en/articles/6495946-the-bug-bounty-program

Oct 11, 2025, 7:36 AM

[tight dock]

For anyone who is just starting out in bug bounties and wants to build your skills in a group, let me know and I will send you an invite. I'm just starting out as well and ready to grow my skills.

[humble badger]

Sure

[heady raptor]

Guys , anyone have free course for bug bounty

[tough mauve]

I need sir. Check dm.

[left shale]

me

[tight dock]

Sure thing

[quaint charm]

Here

[finite warren]

Hi clutch77 that sounds like a great idea. Count me in! 🔥

[lyric heath]

I’m interested

[tight dock]

Sure thing

[lapis parcel]

Can somebody help this beginner

[fallen palm]

Interested

[turbid scaffold]

can i join sir?

[tight dock]

👍

[tight dock]

For sure!

[fiery hinge]

hey im doing a bug bounty right now and not sure if this is worthy of a report its missing csp files could someone give me a second opinion hey guys jsut wondering if a site was missing these csp headers is it somethig i should report to them HIGH
Missing object-src (no default-src)
object-src
HIGH
Missing script-src (no default src)
script
MEDIUM
Missing base-uri
base-uri
MEDIUM
Missing reporting endpoint
report-uri
LOW
Missing form-action
form-action
LOW
Missing 'report-sample'
script-src
LOW
Missing 'report-sample'
style-src

[jolly ledge]

:hammer: kirb_0918#0 has been banned.

[lilac spindle]

At best, this is a Low but this will likely be categorized as Informational.

“But why? Not having a CSP is bad and can open you up to more client-side attacks!”

That’s true as well! However, bug bounty programs don’t care about the “can” but rather care about the immediate exploitability. Missing CSP is only valid when there’s also an client-side vulnerability such as XSS in place.

Then it becomes something like “XSS was easy to do because you were missing CSP”. Instead of “You’re missing CSP, you might be vulnerable to client-side vulnerabilities”.

[fallen palm]

Sire, did u make the server my good sir

[fallen palm]

Good point

[tight dock]

Yes I did

[bright island]

@tight dock what is it about?? teaching Ethical hacking or just bugbounty skills?

[tight dock]

Specifically Bug bounty skills but I believe that it can serve as a foundation to move into ethical hacking.

[hybrid orchid]

You always need impact to raise a CVSS score above 0, not just Bug Bounty.

i.e., missing CSP by itself should only ever be informational, even in a pentest. Obviously changes if you demonstrate impact, although, tbf, that's fairly easy -- simple clickjacking PoC if X-Frame-Options is also missing and you've got C:L/I:L. Still scraping the bottom of the barrel though.

[hybrid orchid]

On which note, where the heck are you pulling your ratings from?
If the answer to that involves any part of your anatomy, and / or thin air, I would suggest brushing up on CVSS.
It's really not designed for bespoke issues (frankly it's a pain in the backend for anything that isn't a CVE), but it's the industry standard and it's the best I'm aware of for now.

[hybrid orchid]

Just to be clear... you've written a Python script which scans web servers for .env files, and you are now selling said script for $40 dollars and shilling in beginner cybersec Discords?

I'd ask if you were an idiot expecting people to pay for that crap, but honestly given your target audience I'd say that falls into scam territory. Disgusting behaviour.

[rich herald]

Hey clutch77 sounds great count me in buddy 👍

[fallen palm]

That’s not really scammy tbh

Would Richard stallman approve? No. Just cause it’s only a few hundred lines, dosent mean it’s worthless. If people are willing to pay 40 bucks bc they don’t know how to do it, I don’t see a problem. Regardless they have the source code atp and can reverse engineer.

Tbh though idek who would pay for that script lol as there’s probably a version on GitHub lol. You’re better off going to darkforums and trying to sell it for crypto.

[hybrid orchid]

It's doing an extremely simple job, for which there are hundreds of existing free tools. You're right -- that doesn't make it a scam by itself. It makes it a rip-off.

Marketing that rip-off explicitly to beginners who don't know any better? And on top of that, using the description to build it up as an automatic crit finder? That's what makes it a scam.

[hybrid orchid]

And yes, there's literally a nuclei template that does the same job. Let alone the fact that it's just a path busting problem -- i.e., incredibly easy to do with gobuster / wfuzz / fuff / etc, and a word list off seclists smh

[fallen palm]

People pay for the experience, if it helps as much as they suspect that’s only a side effect

Same way how prostitution operates and that’s one of the oldest professions

[hybrid orchid]

... Are you listening to yourself?
They're paying for a tool.

You have essentially just suggested that someone who walks into a hardware shop and buys a £1 hammer for £40 will walk out happy because they had the experience of buying a hammer. Regardless of whether the hammer was actually worth £40, or whether it breaks after the first swing.

Again, to reiterate: I don't have a problem with people writing snake oil tools and trying to sell them. Free market, etc. They're either shady af, or fucking idiots, but they're free to do it.

I do have a problem with them marketing those tools explicitly to complete beginners as the be-all-end-all solution to a problem they have massively hyped up.
That's called taking advantage of the vulnerable.

To use the hammer analogy, it's roughly the equivalent of a sales person in the hardware shop realising that their customer is blind and selling them a rock for £40 when they've asked for a £1 hammer.

[fallen palm]

It’s not the same. It’s like maybe selling them a subpar hammer for 40$. But when they bought it, they were excited to use it. That’s what they paid for that feeling. If it lives to their standards of a hammer whatever that may be is only a side effect

[fallen palm]

Yes they will leave happy. Because they felt in that moment that was the right move. And they paid for that. That feeling the hammer gave them. If it didn’t give them a satisfied feeling at time of purchase they wouldn’t have paid. It’s unfair to the merchant to have to refund

[hybrid orchid]

No, they paid for a damn hammer.
Anyone who's ever been scammed believes they're doing the right thing. They wouldn't fall for it if they didn't wholeheartedly believe it was a good choice to make.
That is literally how scams work.

Feeling happy at the time doesn't make up for the fact you've just been scammed lmao

Again, to use a more blatant example: you call up some poor pensioner and claim you've got some amazing investment opportunity. You convince them to send you £20,000, which you then run off with.
I guarantee you that they will feel good about their decision until they realise they've been scammed.

Does that temporary feel good feeling make up for the fact that they've just lost their money?

At this point you're just claiming that scamming people is fine as long as it makes them feel good about themselves for a while.
Is that really the argument you want to make here? Do you really want to tar yourself with that brush?

[fallen palm]

Whatever dude it’s just money Jesus

[hybrid orchid]

What's your mum's phone number? I've got some gold bars to sell her smh

[dark zenith]

He might actually buy the gold bars from you himself as long as it makes him happy lol

[hybrid orchid]

What gold bars

[fallen palm]

It’s not scamming dude.

Scamming is forcefully taking money from someone: it’s coercion. This is giving people an experience.

If I took a tool like nuclei, made a wrapper and gui, and sold it, is that scamming? Would they have known about it if I didn’t promote my paid tool?

Exactly. It’s stupid people pay for convience you just don’t know how to sell tech

[hybrid orchid]

Dictionary disagrees with your definition. Nothing forceful about it. Any scheme that aims to "defraud or swindle".

Marketing a basic tool explicitly to beginners who don't know any better, with no unique selling points, for an exorbitant fee, falls into the "swindle* camp.

[hybrid orchid]

Depends on the context. If you were marketing your UI on top of Nuclei then no. If you were shipping it to beginners under the pretext of "this $40 tool will find you lots of vulnerabilities and make lots of money", without bothering to tell them that it was just freeware you'd slapped a facelift on? Yes, that would be a scam.

And none of this is selling an experience. In both cases the product is the software. If you want to sell an experience, open a theme park.

[hybrid orchid]

And per your final point, I've said already, but I'll reiterate.

Selling snake oil tools? Fine. No problem with that. Think you're either shady or an idiot, but fine.

Selling them explicitly to people who don't know any better? Taking advantage of their lack of knowledge? Not fine. That's predatory. That's where it crosses the line.

There's a moral difference there. Taking advantage of people to make quick cash based on their weakness is just shitty.

[frail compass]

i still got those magic beans if you want them

[hybrid orchid]

Hang on. "That dude". That handle sounds awfully familiar. Did we not ban you years ago for repeatedly being an absolute asshole?

[fast fable]

Must have been unbanned so they don't complain on reddit and give the company a bad image

[raw forge]

tbh its smart business module some people might wana GUI tools however do u have the permission to do that ? tbh u r in the gray area but i can see many people who would love it

[hybrid orchid]

MIT license on Nuclei so that should actually be fine legally. You'd just have to be very careful about advertising, and include copies of the original license and copyright notice (i.e., not try to claim credit for it).

[deft plank]

i just started learning a few days ago so im BRAND NEW but im interested!

[molten anvil]

So i just got into bug bounty but i dont know where to start is there someone who could help me.

[shadow comet]

Are you familiar with basics ?

[sweet bluff]

same here

[molten anvil]

I learned html, css, python, and javascript and i am learning to use burp suit and linux.

[sweet bluff]

Who Use https://chaos.projectdiscovery.io To Do Bug bounty ?

[fast cloak]

there are a couple of good yt videos that give you a pretty good intro into bug-bounty hunting as well as How-Tos!

[tranquil bluff]

portswigger.net tutorials and learn how to use burp suite. Thats a practical approach. I triaged several hundred bug reports and rarely seen a report that didnt use burpsuit😅

[broken depot]

i am new to bug bounty and i am interested so can you help me how to start it ?

[proven cobalt]

There are a lot of web app resources on THM. There's also the Portswigger Academy and HackerOne's Hacker101. Then you can join HackerOne or Bugcrowd or Intigriti and start doing bounties There's lots of books like Real-World Bug Hunting or Bug Bounty Bootcamp from No Starch Press

[hallow nest]

I´m new to it, but interested to learn.

[delicate knoll]

Hi guys, I have a question. I want to learn on how to become a Bug Bounty Hunter, I'm learning on THM right now but I don't know what path module should I take and what I should skip for now. Do you guys have any ideas that can help me?

[gaunt moss]

I would take them all and then spend 5 years at a job doing cyber security related topics

after that you might be able to get strted

[sudden rapids]

@gaunt moss 5 year then I'm already 55

[gaunt moss]

Hey Ill be 56

[delicate knoll]

I want to learn them all eventually but just for now, I just want to focus on the web pentesting first before reaching out other areas. But in THM, the contents relevant to web is sitting in multiple path so I don't know which I need to take and which I don't....

[gaunt moss]

Take the web pentest path the middle red one

but you need years of practice to do bug bounties.

think about it ... if people spend years writing code and releasing it....

how can someone with only a few months training crack it?

it takes years of practice

[sudden rapids]

It's been almost year learning cyber security even I can't slove a simple beginners challenge room 🤣🤣

[delicate knoll]

So I should take the Web Fundamental and Web Application Testing path?

That's sound tough @@

[sudden rapids]

It's been one year you join tryhackme what you were doing @delicate knoll

[delicate knoll]

yea, that's why I just want to focus on it instead of learn too much stuff then I can't remember anything

[delicate knoll]

I'd joined but something happened so I have to pause my study

[gaunt moss]

you don't remember things by learning them, you remember them by putting them into practice

[sudden rapids]

@delicate knoll oh

[delicate knoll]

I'll remember to do that

Thanks for the advice @gaunt moss

[uneven gale]

Gave +1 Rep to @gaunt moss (current: #78 - 134)

[fallen palm]

Hello everyone, I am new here

[digital tendon]

Hello

Any help me

[pine frigate]

Hello,
I'm looking for a bug bounty hunting group to practice and learn with, kindly dm me if you're interested.

[fallen palm]

@pine frigate

[autumn vessel]

Same here

[strong adder]

Can anyone help me, I have completed the authentication bypass (Jr. Pentester) room in try hack but I completed that in the lab but how to test it in the real website using fuff tool, please anyone help me

[woeful tiger]

dont unless you have permission

[toxic nacelle]

how to know if im ready to start hunting ?

[grizzled abyss]

You just start

Learn from doing

[mellow badger]

I was searching on a certain website for a vulnerability to discover, and I found a search box. I entered an XSS payload, and it reflected in the source code, but the alert did not appear. What does this mean?

[sterile flax]

Anybody interested in having a new friend 😏

[ocean violet]

yea me

[jagged drift]

guys pls between ethical hacking and networking which is better

[gaunt moss]

networking

Networking > Cyber Security

[sterile flax]

Finally !! 🤠 DM me

[sudden rapids]

But you are not verified on thm

[sterile flax]

What ? How do I do that ?

Is that ok now 😀 ?

Hey

[sudden rapids]

No you have to verify with discord token that you get in thm account

[sterile flax]

U r surely talking about that THM tag right ?

I got it just for you 😉

Are you not at Hack Smarter server It is a good one for people like us and the tag I had was from there 😄

[tame siren]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Nov 6, 2025, 11:27 PM

[gaunt moss]

you need to link your www.tryhackme.com account with discord

[gaunt moss]

you can have whatever tag you wish

[sterile flax]

🧐🧐🧐

[gaunt moss]

Go on then, follow the discord verify link

you can do it mate

then you can post the gif

[sudden rapids]

Are you active 24/7

[gaunt moss]

No, I speep 8 hrs a day

[sterile flax]

This is a good place to meet people ambitious about cyber security.
I have started to meet people worldwide 😁

[sick oak]

hi

[lapis parcel]

Hi Hackers

[smoky furnace]

hi hackers
i was studying web bug hunting bug i am not able to find any bugs till now
can anybody help me that what i am missing ?

[crude gale]

Hello anonymous
can you all share what are your streaks on thm and what are you having through apart from vesting time on thm, like reasarch on something, freelancing, bug bounties and whatsoever?

[crude gale]

on which platform you are active for bugs?

[smoky furnace]

In hackerone or bugcrowd

[crude gale]

well

how much time are you giving on enumerating, resarching on bugs?

[smoky furnace]

@crude gale may i msg you personally ?

[crude gale]

yeah for sure!

[latent badger]

is there a way to get to know which rooms are for web or web vulnerabilities

[south fiber]

Hello, I am new yo bug bounty and have a question - few targets has OTP on mobile phone within the country when one registers. How does one get OTP outside the country for registering a new user for testing on a target? Any tools or cheap alternative?

Ex- target has registration page and in US that needs OTP. I am testing from outside US.

TIA

[terse stag]

Hey everyone! Looking for team to learn with. Currently on H1, and would love to bug-hunt together

[obtuse fern]

Go and watch Jason Haddix's methodology talks and read zseano's book ( it's free ) . It will make things more clearer hopefully 🙂

[gaunt moss]

thank you

[uneven gale]

Gave +1 Rep to @obtuse fern (current: #1 - 6000)

[gaunt moss]

HAH! 6K!!!

[knotty urchin]

hey

[jolly ledge]

:hammer: olusayo_ayo#0 has been banned.

[fathom dock]

Now we are friends

hello friend

[verbal briar]

hy

[soft steppe]

Hy

[reef finch]

hy

[winter oak]

Hi

[torpid osprey]

hi

[vale jolt]

Hii

[heady raptor]

Does anyone have a free course of bug bounty.

[strong heron]

Bug bountys are basically where u put all your knowledge into testing a corps security, so like if your looking at trying to do API bug bountying you need to learn all about how API's authenticate and send data. once you have done the above you then move onto hackerone where you can legally test API's for pentesting.
heres a Video explaining how to actually learn the bounty system

[obtuse fern]

TryHackMe

Portswigger web security academy

[peak jasper]

Anybody has bugcrowd here?

[fathom dock]

Yes

most have an account on several platforms

[peak jasper]

Can I join bugcrowd org I'm good with recon + burp

[rare barn]

Done!

[obtuse fern]

Yeah of course . It is free to join

[fathom dock]

Bugcrowd, hackerone, yeswehack, Intigriti

Sign up for all, some larger programs have non paid in one and paid on another one.

[graceful pumice]

I would like to report an issue in the Search Skills room.
The first question:

“You are hired to evaluate the security of a particular company. What is a popular social media website you would use to learn about the technical background of one of their employees?”

does not accept the correct answer.

I entered LinkedIn, which is the expected answer according to the lesson text.
However, the platform returns the following error message:

“Uh-oh! The answer you provided may not be in English. Please review it and try again.”

I tried clearing cache, using different browsers, and reloading the room. The issue persists and prevents progression in the room.

[pure lodge]

hi everyone
i was testing a website and i found a reset password endpoint on which it asks for email and then sends the otp to the respective email and then asks for it
i intercepted the request and edited the email parameter to [e-mail] and forwarded it
the OTP came on the [e-mail] but when i enter that OTP it says => Invalid OTP
what should i do after this ??
anyone have any idea ??
i am ready to collaborate too for this.
please take your valuable time to reply for this.

[rose tide]

Hey, I got a couple of questions to successfull bug bounty hunters. Im just curious.
How long you grinded for your first report that was accepted and it paid money? What was type of bug you found?
If someone is doing tryhackme ctf's and labs for some time - where is the point for a person to say "ok, now I should hop on to hacker1/etc. and try"?

[shrewd whale]

Guys I found an unkeyed param called email
So
Can I use it for web cache deception
And the value of this parameter
Reflected in something like this in the response
Set-Cookie: agfbrgaoqbdu%0829THE{VALUE}JWV3936gaavd73%

These random letters and characters and numbers aren't a real value I just wrote it randomly To get the idea across

[sonic leaf]

finish the whole web-pentest path and that should get you a good understanding, but also use OWASP Juice box to test in a known vuln environment to get the process down, this will help you to have a strong methodology going in, most likely wont find common bugs like in the labs but doing them and understanding what and why is important to being able to build your own ideas off of what you already know and get some overlooked vectors

[halcyon yew]

i want to start bug bounty can any one help me please. How to start

[obtuse fern]

https://tryhackme.com/path/outline/web

[halcyon yew]

thanku so much @obtuse fern

[honest parcel]

Ethical Hacking has aged me the last 5 years lack of sleep, ongoing updates and so on.

[jaunty junco]

😂

[mystic galleon]

hello everyone , I have some problems in Windows fundamentals2 task 4 question 2
this question asked for GoogleUpdateTaskMachineUA but albeit I search a lot in task scheduler I can not find task like that what can I do??

[sullen smelt]

If you are completely unable to understand that, you can read the writeups available on medium.

[hasty dome]

me too, the time given there weren't the answer, had to ask THM bot for that

[obtuse fern]

#room-help but you are probably using the wrong machine . Can you provide some shots please ?

[spark copper]

hY everybody, I finished the SSTI guide, i would like to get your feedback.
link > https://github.com/VOIDPACKET-VP/VOIDPACKET-Web-Galaxies/blob/main/SSTI Solar Flares.md

[icy portal]

Yo

[fading hinge]

Can anyone help me how to start bug bunty?

[alpine kelp]

I also want to start bug bunty..
New to this so, please help

[keen folio]

Can anyone give me the details like how to use CV-2021-41184

J query vulnerable, not critical but in my website I have these vulnerability so anyone who is expert in these

[obtuse fern]

https://tryhackme.com/path/outline/web

@alpine kelp Check this resource

[fading iris]

Can anyone hack my accout

[sick bronze]

might have the exact same issue as the guy above, windows fundamentals 2, task 4, "At what time every day is the GoogleUpdateTaskMachineUA task configured to run?", can't find it on the machine, also tried the answer i found online and in the the discord here and it says it's wrong, maybe i'm crazy
After reading the medium writeup and using chat bots i got the answer 6:15Am but still it’s not working
Kindly fix the issue

[deep shard]

I am also having this same issue

[narrow void]

also just got to this and i am having the exact same problem, came here to report the bug

[silk hollow]

Wow that’s crazy. I also had to look that up online because it was a different time on the machine. It worked for me tho

[inland token]

Heyyy thatss great

[sick bronze]

Try 8:44 AM

[sick bronze]

Try 8:44 AM as an answer

[sick bronze]

Try 8.44AM as an answer and inform if it work for you or not .

[naive flare]

8:44 AM did not work for me

[sick bronze]

try some other values like :- 5:15 AM , 6:15AM , 6:14AM

[narrow void]

Keeps saying my response isn't even in English

[sick bronze]

No need to worry about that.
It’s THM usual pattern to say “ response isn’t even in English “ for incorrect answer.

[queen garden]

Answer is 5:44 AM

[humble parrot]

Worked for me.

[cloud valley]

I need to form a team or join a team

[inland token]

Hey i need a hacking team

[halcyon salmon]

well im down to join one

[sick bronze]

What is your team requirements

[queen garden]

target?

[onyx fjord]

Hello i wanna join a hacking team

[upper sparrow]

is there a free command injection labs here guys

[inland token]

Heyy we can work together

[cosmic mason]

Last week I did test some web server in our country. Most of them are vulnerable and even basic exploitation can be done easily.

[cosmic mason]

I want to join a hacking team also. Can you consider me?

[tawdry cloud]

Any beginner web pen testing course ?

[dark barn]

I'm working through Cyber Security 101 steadily. What would be a good point to start doing some bug bounties or challenges/CTFs? After 101? Earlier?

[near marsh]

iirc athena has some command injection, quite a few do, though not centered entirely around that

[glossy trail]

Im looking to join a team I am new and want to learn

[mellow oyster]

Hi there! I’m a candidate

[obtuse fern]

https://tryhackme.com/path/outline/web

[obtuse fern]

Move on to web app pentesting path afterwards

[crude gale]

heyy, just here to find any collaborative friends who could hang out together for finding bugs on hackerone and bugcrowd either or both..
since i'm new in BBP and VDP so not enough confident on how and what to start to finds.
I have done enough ctf, classess on thm and now i want to practice it.
anyone up? please Dm.

[fair flicker]

I’m opening spots for 3 experienced individuals only. If you think you qualify, DM me

[dull wind]

In your dm

[sick flicker]

can any one telll how to start real world bug hunting..

[fallen palm]

Hi Friends 👋

[past tartan]

hii guys i want to bug bounty as a part time to get some money in the LEGAL way. Can anyone help me?

[torn comet]

Go to chatgpt and write a bug report about buffer overflows

Then head over to hackerone then submit a bug to curl

[marble dock]

How to start bug bounty, anyone can suggest

[past tartan]

@torn comet okay I'll try. Thank you

[uneven gale]

Gave +1 Rep to @torn comet (current: #3443 - 1)

[coral wing]

I need to know about ai hacking and pentesting

[obtuse fern]

Check this
https://tryhackme.com/path/outline/web

[obtuse fern]

Check this
https://tryhackme.com/module/attackingllm

[willow sphinx]

https://tryhackme.com/p/SohaibGuessab

[shrewd whale]

Guys
I used httpx at my urls file
And now at the output
I have
2xx
3xx
4xx
5xx
I mean statues code for all url
What is the best statue code to start hunting on it

[devout quarry]

Sit !!!!

I need to download data from a website for a fee.

[meager pivot]

Hello group,
I’m looking for someone experienced in ethical hacking or cybersecurity who’s willing to teach or mentor me for free. I’m a beginner, motivated, and interested in learning the right and legal way. Any help or guidance is appreciated.

[oak sable]

👍

[violet palm]

I need a roadmap for bug bounty.
i'm new in

[solemn shale]

and this is why all the programs are ending

[solemn shale]

absolutely dont spam bug bounties with chatgpt slop, thats how you get blacklisted

[primal owl]

yeah

[fathom dock]

That is why you have TCM and Nahamsec

They be your mentors with years of YT videos

Learn nmap, metasploit, burp, learn Owasp top 10, find what you think is fun.

Get your first sub domain takeover (those are not that hard to come by) do some XSS reports, move on to LFI or maybe even an SSRF

You have also years and years of Blackhat, Defcon, B-sides and a ton of other conferences and talks to watch

If you think you need a mentor, you are up for a challenge

[near dragon]

Hii

[rare barn]

:hammer: lo_k_ey_05306#0 has been banned.

[rare prawn]

Hi everyone 👋
I’m a beginner in bug bounty hunting and web application security.
I’m looking to learn together with other beginners through discussion, practice, and mutual support.
If anyone is at a similar level and interested in studying and growing together, I’d be happy to connect.
Glad to be part of the community.

[uneven gale]

Gave +1 Rep to @rare prawn (current: #3475 - 1)

[tired parcel]

Ineed help

[fallen palm]

#site-support for site issues, #room-help for a specific room, #general for general questions

[stuck torrent]

I am in

[stuck torrent]

All are just test all manually some time site guve wrong status based in user agent and other reasons and i have personally found sites that return 404 but changing user agent or fuzzing give me 200

[fallen palm]

dziri tani lmaaoo

[fallen palm]

2xx ofc

[crystal carbon]

I kinda want to get into bug bounty,where to start

can anyone like give the resources and stuff which helped them

All I have done so far is web app ctfs and stuff

not explored the network pt side

[livid rivet]

i did the scan my local network and i was find my ip tv and i was scaned it and the results is

Starting Nmap 7.98 ( https://nmap.org ) at 2025-12-21 23:09 +0100
Nmap scan report for 192.168.1.94
Host is up (0.037s latency).
Not shown: 999 closed tcp ports (reset)
PORT STATE SERVICE VERSION
8080/tcp open http-proxy?
|_http-title: Site doesn't have a title (application/atom+xml; charset=utf-8).
MAC Address: E8:F2:E2:B2:DB:8D (LG Innotek)
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.5
Network Distance: 1 hop

TRACEROUTE
HOP RTT ADDRESS
1 36.55 ms 192.168.1.94

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 167.24 seconds ,
i don't kn,ow actually how to continue or how many ways exist for that

[obtuse fern]

Check this
https://tryhackme.com/path/outline/web

[crystal carbon]

Appreciate it

[stuck reef]

Yes

Yes

[dark barn]

What are the best platforms for beginners? HackerOne? Or Intigriti?

[livid rivet]

Anyone here , have successful experience with any kind Of hack in the internet , can U explain ur process bro

[glossy linden]

Is there any help to be found here on this platform?

[dreamy pine]

all

[wooden prism]

hi

[buoyant obsidian]

Hi Hunters

[golden egret]

ur tv uses linux 💀

[golden egret]

if u are beginner start for 1 or 1.5 half year, 10 hours each day

then move to htb

but before starting thm , u should start developing websites

know knowledge of js,php adn python and like databases sql,mongodb

need to learn these skills ,i am not telling u to become pro on these , but if u can then it will be very good ,but u have to need foundational or intermediate level knowledge of these languags

and remember

no hangout with friends , no chill just hacking

develop and build things

[marble tree]

17 year old cybersecurity student early in the field but serious about where I’m going. I’m interested in building AI assisted defensive security tools that automate parts of web application analysis and reporting. Looking to connect with experienced devs willing to mentor or advise, and other young builders who want to learn and build long term. Open to feedback and learning the fundamentals properly. DM if this aligns.

[tulip wolf]

💀

[golden egret]

hello u alive ?

[reef forge]

Hi everyone
I’m looking for a beginner / early learner to start a cybersecurity journey together.

I’ve solved around 6 CTFs, and I know the basics of Linux and networking.
I’m not an expert, but I’m consistent and really motivated to learn.

If you’re also a beginner and want to learn, practice CTFs, share resources, and grow together, feel free to DM me

[proper stream]

Hello everyone
Any labs to solve in bug bounty to increase the bug bounty
I was really confused when I visited the website .. i need to search for the sql or xss ..
I am totally confused. Can you calrity on this

[rich summit]

check DM

[steady steeple]

Generally speaking, when you enter someone's discord, it's always a great idea to read about the rules for that server.

Go check out the #rules , specifically Rule Number 4.

It's pretty clear, No Illegal or Harmful Activity Unethical hacking, discussion of illegal activities, distribution of malware, or posting harmful content is strictly prohibited.

[quaint cairn]

Hi guys,
I'm looking for newbie in ctf to start with me.
I just have done web fundamental module and I hope you are in that level too
About room I alr solve just 5 most of them are 5 mins hacks
Just feel free to DM me.

[golden egret]

https://www.linkedin.com/posts/muhammadrohankhan_cybersecurity-bugbounty-wpscan-activity-7414275397145677824-grVd?utm_source=share&utm_medium=member_android&rcm=ACoAAEUfiBUBUdqlIMEH6b1sS4iKslXxtSMthhU

[golden egret]

this isnt enough

[quaint cairn]

Wdym?

[golden egret]

u have to learn more stuff ,then u will be able to solve ctfs

[quaint cairn]

Can you tell me when I can start?

[golden egret]

portswigger

portswigger academy , there will u learn real web hacking , adn web vuln

but before it

learn html,css, adn js

and then python

build web apps , and also one full stack web project

then move to hacking

[quaint cairn]

Bro that entire university cyber course :))

[golden egret]

i started that stuff when i was on 9th grade

now i am 12th student

🙂 , have to sacrifice alot of things to achieve the dream , but the most valueable part is that , u should be carefull , which thing u sacrifices ,it will cost l

[quaint cairn]

Actually I starting with computer science and want to jump to cyber:))

[golden egret]

u in uni ?

[quaint cairn]

1st only:))

But experience on coding

[golden egret]

1st grade ?

or 1st semester

[quaint cairn]

1st year i mean

[golden egret]

okay so first build web apps

then move to web hacking

if u will move to web hacking directly then u will get alot of stress

[golden egret]

where u from ?

[quaint cairn]

Wanna keep going on dms?

[golden egret]

okay

i was going to play roblox ,but its okay

[mighty panther]

Try Html, css to learn web dev code then java,python to understand methods and functions then networking i.e. tcp/ftp/port scanning etc

[mighty panther]

scripting is also a must learn because ports can be scanned but exploits need scripts 🤷‍♂️

[chrome wind]

hi hackers, tell me if website is running behind cloudflare then how to identify its real ip address. to scan ports

[lean wave]

👍

[golden creek]

I have a problem when working on the course in part 4: Practical: Defend FakeBank. When I click view site I can't find the answer, can you help me with the answer?

[raw valley]

what room are you in on thm?

sorry i'm working in the rooms didn't see the chat

[woeful locust]

dea

[wide lion]

Can check the HTTP headers via DevTools for any mention of DNS pointing to Cloudflare name servers.

Just one way I can think of

[versed trail]

https://www.binance.com/referral/earn-together/refer2earn-usdc/claim?hl=en&ref=GRO_28502_H3BW1&utm_source=default

[shrewd whale]

Thx

[uneven gale]

Gave +1 Rep to @fluid idol (current: #3532 - 1)

[main jungle]

if you can dm your plan, I can try and help you somewhat

[compact hamlet]

Anyone here getting spam messages?
I'm looking for the spam messages
My inbox is feeling too peaceful and I don’t trust it 😭📨

[still marsh]

If I want to start studying about bug Bounty from where should I start and which road map I should follow.

[random canopy]

I wanna start Bug bounty but I don't know where to begin. I'm a really dedicated person so I don't really care about the stress part of it, Dm me please I wanna know where to start and how to get more deep into it.

[dark barn]

Start here @random canopy @still marsh https://www.youtube.com/watch?v=FqnSAa2KmBI&pp=ygUWYnVnIGJvdW50eSBtZXRob2RvbG9neQ%3D%3D, and check out his recommended reading material. Especially Real World Bug Bounty and Bug Bounty Bootcamp. One of the recommended ones, the web app hacker handbook, is in this month's Humble Bundle.

[floral plover]

Hi, please just let me know if i can't ask something like this, but the question is this:
with most RCEs can you run any amount of code that you want? or just like 1 command?

[swift finch]

You can often times just upload code via the RCE then execute that code on the target machine using the same RCE. Is that what you mean?

[floral plover]

oh my gosh i might be actually dumb

i must have overthought that a lot

yeah thank you so much

[swift finch]

np 😊

[past ether]

Heyy guys today i got the Advent of Cyber rewards and i have got 75$ voucher but i am not able to utilize it cause i already have the premium so if anyone wants it .
Dm me .

[still marsh]

ohh thankyou @dark barn

[wooden prism]

yo
guys is singular sdksecret{value} sensitive? if it is how we can see it is still active?

[sick bronze]

Hello

[sick bronze]

You have try hack me swag shop voucher or what ?

[sick bronze]

Yes you can run any amount of command you want .

[past ether]

yeahh it is a swag voucher

[sick bronze]

You aree selling it ?

[past ether]

Dm me bro

[pale matrix]

hey, i have a question, i recently wanted to start with bug bounty and get some real life exp in pentesting, how do i should start with it, is there any websites, groups, etc. to start with?

[swift finch]

if you want to start with bug bounty you can just go check out some bug bounty programs on sites like hackerone, intigrity and bugcrowd. If you're not very experienced with web exploitation then you should probably go check out some of the unpaid programs since I'm guessing there's less competition and more unpatched lower-hanging fruit

[spiral vapor]

READY STOCK MeowMe Kasut Unisex Lembut Kasut Lelaki Perempuan Kasual Sandal pantai Anti-Slip Casual Sandals Kasut Wanita Perempuan Sandal Lelaki Unisex Shoes Flip Flops SM407,413,411 https://vt.tiktok.com/ZSHoTFhrFUSWb-6xitj/

READY STOCK MeowMe Kasut Unisex Lembut Kasut Lelaki Perempuan Kasual Sandal pantai Anti-Slip Casual Sandals Kasut Wanita Perempuan Sandal Lelaki Unisex Shoes Flip Flops SM407,413,411 https://vt.tiktok.com/ZSHoTFhrFUSWb-6xitj/

[west forum]

Yup @paper frigate

[fallen palm]

mee

[brave juniper]

Hi everyone

[raw monolith]

Hi

[fossil sparrow]

hello\

[chrome mauve]

Anyone can help me to learn bug bounty i am a beginner so anyone please help me to learn and what to learn

[tawdry sail]

Id recommended completing the pre security room and potentially a few others prior to starting on bug bounty!

If you don’t have any idea of how systems work you definitely will struggle trying to take advantage of vulnerabilities 👍

[chrome mauve]

thanks

[tawdry sail]

Anytime I’m in the same boat myself recently finished pre security and I’m currently working on cybersecurity 101 👌

[chrome mauve]

but it's paid

[tawdry sail]

Some of the courses are some are free, failing that YouTube has lots of great information, and there’s probably other sources that members here could point you too!

[chrome mauve]

i kindly request you to provide me a source please?

[tawdry sail]

You could try Network Chuck, The Cyber Mentor, hackersploit , Null byte & Hak5 👌

Hope these help 🙂

[chrome mauve]

https://klipy.com/gifs/thank-luffy

[woeful vine]

Hello

[chrome mauve]

yo

[dense sky]

Hello guys

I’m new

[uneven minnow]

Well, finished my first bug hunt. Took hours for a couple of basic attacks lol. Spent too much time picking a target, trying to get Burp Suite to cooperate, and looking through http history to think of ideas. Granted, I only studied for a week. I decided weekdays I’ll study. Saturdays I get hands on real world experience. Sundays I rest.

[solar dagger]

If anyone has intermediate to advanced experience and knowledge regarding KiteRunner and API penetration testing, I would appreciate it if they could share their thoughts.

Specifically regarding false positives: although addresses detected by KiteRunner show 400-401-403-500 etc. in the KiteRunner output, they give different results (usually 404) when viewed in the browser and terminal using the curl command, even though the KiteRunner user agent settings are identical. Is there an error in my execution command, or is this normal for this tool?

You can quote this message and reply privately.

Thank you.

[chrome mauve]

hello i am newbie and looking forward to join the CTF or Bug bounty team as a beginner to learn from senior and to make friend in same profession , anyone please DM me if you are in any team willing to take me in 🙂

[chrome mauve]

Hello everyone i am a learner of cybersecurity and looking forward to bounty hunting any learner like me want to form a team with me as a learner or a anyone has curiosity and showing interest than i want to make team with them. Dm me if you are interested to form a team with me in which we can talk about further in Dm.This team is about the people who is learning from basics feel free to Dm Me see you in Dm 🙂

[snow tree]

Is there any Room that teaches us how to build a Pen trst report?

[slender snow]

you have something called documentation on HTB if you want to take a look into it but i dont know about THM nor am i using HTB yet cuz it is advanced for me

[stray lily]

.

@half hare

[half hare]

?

[lapis forge]

Hiee everyone

[potent ridge]

Hello I’m interested. Bug

I want to learn. Who will learn with me and strengthen my friendships?

[sudden shuttle]

.

[signal swan]

less go im up

[signal swan]

ok

[frank plover]

https://youtu.be/PG5sv20Jiic

interested (though a little scared) to see if this leads to a shift into how bug bounties work in the future to deincentivize bad faith false reporting or straight up making up fake bugs just for the chance of a payout incase they accidentally identify a bug they were only partially certain about;

[carmine aurora]

hi

[carmine aurora]

hi

[chrome mauve]

Dm me

[leaden tundra]

Can someone tell me why is it that WormGPT is highly not preferred for bug bounty and while black hats use it most of the time a single attack from that thing can shutdown companies so how do companies stop such attacks

[brazen kayak]

Can someone recommend me a good roadmap for bug bounty and pentesting?

[stuck oar]

Red team

[native stratus]

i ran fuzz on a website and my ip address got banned am i fucked *it says my ip is banned when i try to get to https://website.com/wp-admin/

[cloud heath]

Remember that scanning a domain without permission is not legal

[shadow locust]

If your target is in the permitted scope, review the program's rules around request rates and adjust your testing. If you are fuzzing a domain without explicit permission I would suggest you stop

[native stratus]

its my first practical experience with it how come no one explains the rules of engagement thing the scope thing the intigriti.me thing etc etc tutos are just pple showing you three commands on three tools with 2 scripts and tada its how i made 70000 hacking redbull in 12 minutes like fuck

its interesting cuz when i try to access website/admin they say we banned ure ip showing the real ip/mac address i was using vpn and then my own ip to test it out and they say we banned but i can still navigate the rest of the website through the account i created on it etc

funny

[native stratus]

Anaconda Inc considers ethical hacking activities conducted consistent with the Researcher Guidelines,
the Program description and restrictions (the Terms) to constitute “authorized” conduct under criminal law.
Anaconda Inc will not pursue civil action or initiate a complaint for accidental, good faith violations,
nor will they file a complaint for circumventing technological measures used by us to protect the scope as part of your ethical hacking activities.

If legal action is initiated by a third party against you and you have complied with the Terms,
Anaconda Inc will take steps to make it known that your actions were conducted in compliance and with our approval.*

thing is im giving it a try after a bit of labbing for fun and there is a lot of legal friction between aha what can i break here and a lawyer calling you to put you in debt on 2 generations

i thing this paragraph says chill mate we wont pursue you for wild scanning

[shadow locust]

If you’re not clear on scope and ROE yet, stick to labs for now. Real targets are only fair game for you when the rules explicitly allow what you’re doing and if you feel the need to hide behind a VPN, that’s usually a sign to pause and make sure you actually have permission first

Also that paragraph does not say they won't pursue you for excessive fuzzing, they state they won't pursue action as long as your testing stays within their terms and scope. It is absolutely not a blanket "anything goes", I would suggest you stick to labs for now

[native stratus]

i will ty

[uneven gale]

Gave +1 Rep to @shadow locust (current: #1775 - 3)

[native stratus]

i got bored of the red team tryhackmepath i wanted some real action in uganda

will lab more then

[shadow locust]

HackTheBox

[native stratus]

i got pretty far in it and i feel there is still a gap between i answered a lot of questions and launched a lot of vms on the website and the practical thing

[shadow locust]

Or more practical sites instead of learning platforms

[native stratus]

gonna go there tao thank you

[native stratus]

as in

[shadow locust]

https://overthewire.org/wargames/

[native stratus]

🫶

tao pai pai comin'in clutch

[fallen palm]

Hi im looking for a buddy to do bug bounty with. I've just started for like 1 month,DM if interested,skill level doesn't matter at all as long as you know OWASP Top 10.

[humble oak]

can i join

[oblique pelican]

can i join

[long oyster]

Hey! Did someone here just started easy ctfs and just learned from there? I’d like to know because I think i’m learning faster by trial and error than just reading and learning

[hasty adder]

Hello

[hasty adder]

can i join?

[violet moat]

I cant get the machine, acmeitsupportv10-badr (savagenj) to load on the Intro to Cross-site Scripting room

[indigo fulcrum]

can i join?

[lost reef]

Yes just keep mastering the general skills

[floral forum]

I'd also love to develop my bug bounty hunting skills. All trial and error for know, until something clicks

[hollow vine]

[sturdy rampart]

One message removed from a suspended account.

[stuck oar]

Impossible

[sturdy rampart]

One message removed from a suspended account.

[stuck oar]

Proof of not happened

Or*

[sturdy rampart]

One message removed from a suspended account.

[fallen palm]

dm

[fallen palm]

dm

[fallen palm]

dm

[fierce brook]

Hlo

[idle plinth]

Can I join

[upper blaze]

ss

[frank rock]

Can anyone take me in their team so i can contribute and learn bug bounty!! (and tech me too)

[oak falcon]

Hi, Can I join

[ionic meteor]

hi

[long dagger]

https://medium.com/@jkaur122/how-tryhackme-helped-me-find-my-first-vulnerability-34cfa6f01673

[vocal oracle]

Hi. Looking for someone to collaborate with during bug bounty. Im just starting out so I do not require strong skills

[pale sparrow]

I started real bug hunting and found it REALLY diffrent from what I saw in labs/rooms/ctfs, so far I been understanding the real websites more and got 2 informatives on hackerone 😭
I wanna know if there is a way to like practice real bug bounty in a guided way like a walkthrough or something like that but in the real messy websites

[verbal briar]

hey guys

[slate kindle]

yes

[verbal briar]

m new in cyber security i learned about networking i did cisco corse 200 300 now what new

to start cyber

and bug bounty

i kinda feel overwhelmed bey the amount of information and i feel comfused

[unborn ice]

Yeah, they're completely different because labs are set up vulnerable.

[pale sparrow]

Well duhh

Ik that but is there is a way to practice on real websites in like a walk through way

That's what I'm asking

[torpid dust]

PortSwigger Academy has a lot of courses both explanational and with sites you can try exploiting vulnerabilities on. You could also spin up a DVWA VM and see what kinds of vulnerabilities you can find on your own.

Either way, anything you practice is obviously going to be intentionally pre-setup with vulnerabilities.

[pale sparrow]

Thanks man

[torpid dust]

ofc

[proven cobalt]

Have you done Hacker101? It's HackerOne's learning area

[pale sparrow]

Ohhhh

Wait I remember doing it like 6 months ago but before going deep into web vulns, I forget it exists but I totally should do it now

Thank you !!!

[proven cobalt]

https://www.hacker101.com/

[pale sparrow]

Isn't there the labs

[proven cobalt]

There's the CTF with different levels and the video lessons

[pale sparrow]

Will check it, again thanks

Really appreciate it

[severe dust]

Hi !
Can I please join you ? I'm searching for a collaborator too

[vocal oracle]

yeah, sure

[olive tiger]

teehee

[supple sail]

Hi if someone can help me to find real bug Bounty or guide let's talk.

[fallen palm]

THM might have some content on this. check their paid pathways. also, Hack The Box Academy has a bug bounty path. In addition check out Port Swigger Academy. Nahamsec and rhinorator are also good resources. Nahamsec has a bb discord. And check out the Critical Thinking bug bounty podcast. Best of luck.

[oblique pelican]

hey can i join

[karmic terrace]

https://youtu.be/EW2hOIiei-k?si=6T4zFHpBS4mqO1ka

[sage sluice]

hi am looking for mentor though am interested in penetration testing

[hidden imp]

Excited to be part of a Bug Bounty community focused on finding and reporting vulnerabilities to make the internet safer. Looking forward to learning, collaborating, and contributing

[solid ravine]

can i join too?

[drowsy escarp]

guys im getting a paid internship but im doubtful if i should go for it or ficus on bug bounty and improving my skills...?

[hard glacier]

Nope not a really good option tbh

[unborn ice]

How many bugs have you found?

[kind mountain]

hehe how do you know in the first place 🙂

[patent glacier]

Hi, if I found a js.map exposed on a domain, is enough to report that or I need to find a bug in this file?

[unborn ice]

Do you know what you can do with it!

?*

[patent glacier]

To be honest, i dont know to much

[raw grove]

Hey everyone, I want to ask a question. How can I know that I'm at level to be a bug bounter?

[north flower]

Guys Unrestricted file upload that leads to Stored XSS, its high severity?

[icy verge]

Hi guys new to bug bounty can someone help me out with learning path or anything, i am experienced in blue team though

[pale sparrow]

If it affects other people not only you then yes

[kind mountain]

SUP! everyone

[civic kernel]

Hello Team, I want to start bug bounty. I am looking for a team to collaborate with me. If any team is in need of another member, please don't hesitate to add me. Thanks

[hazy lake]

Hey everyone! I want to start in bug bounty. I am currently looking for a team or mentors that would be open to collaborating. I am looking forward to connecting! Thank you!

[supple sail]

@hazy lake same here let's connect n learn together?

@civic kernel yeah I m a newbie would like to be a part of your team .

[honest fulcrum]

i to also want to explore and join @civic kernel @hazy lake @supple sail

[hazy lake]

I’d be down!

[smoky juniper]

Hello everyone

[supple sail]

@hazy lake let's make a group then??

[civic kernel]

@hazy lake @supple sail @honest fulcrum let's do it then.

[hazy lake]

I’d be down

[hexed citrus]

I'm up for it too, but I'm still a rookie at this whole thing, but very much interested

[oblique pelican]

let me join

[hearty magnet]

@civic kernel Please slow down. Further spam will result in a short timeout.

[civic kernel]

Add me if you want to join the group

[mild needle]

👍

💯

[idle kernel]

Hey, new here and very fresh to this

[dire owl]

Can I be a part of it tooo?

[pale oar]

Bhai join your bug bounty

[wheat latch]

Hi guys, i am new here, i need help with a blind SQl ctf challenge, is it fine if i post it?

[dark delta]

Hi guys I am new here, I need help

[pale oar]

Bhai join your bug bounty , I need help

[smoky juniper]

When you guys are running automation, do you find it better to feed the agent the root domain (xxxxx.com) for broad infrastructure discovery, or do you get better hits by pointing it at specific program paths (like ://xxxxx.com) for deeper, targeted analysis?
Curious to hear how you balance broad recon vs. deep scanning in your workflows!

[modest vector]

Hello, please refrain from posting the same message in multiple channels. This is considered spamming and against the rules.

[lapis forge]

?

You are from India🇮🇳

[smoky forge]

Looking for experienced pentesters

[surreal plover]

Running automation trigger rate limit blocking. But if the website didnt apply any rate limit, i just start at the point where i suspect that this web has vulnerability potential.

[rustic thunder]

Hello guys ,
What are you doing and hacking , i would like to be part of it ..

[bleak sierra]

let solve it together give send me a dm

[snow arch]

KATRAZZ IS RECRUITING 🛡️
We are looking for sharp minds in:

Python Automation

OSINT & Recon

Web Security

Requirements: Must be passionate, self-taught, and ready to solve CTF challenges.
DM to apply for the trial challenge

[viral kraken]

hello, i have to admit first that i don't know much about pentesting or hacking as whole. I'm looking for someone who is kind hearted enough to help me recover my lost email. It doesn't have any information that could help google recover it so i can only rely on anyone willing to here. please

[fervent sequoia]

I am new anyone Gide me

[tawdry flare]

If you need a pentester skilled and sharp one I am He, you can enter my DM

[tawdry flare]

You're new?? Congrats that you took the first step in the cyber journey 😉.
What help do you need I and the community will be happy to help

[fervent sequoia]

If anyone working in new project please add me

[idle plinth]

Hey

[modest lichen]

Sup

[idle plinth]

Looking for a team u dont have to be professional but not beginner

[modest lichen]

Oh lol

Good luck

[idle plinth]

Thanks I'm tired from working alone lol

[rain parcel]

hello

[stone copper]

looking to start building a small solid team of people who actually get the basics and wanna level up together
im currently in college for cyber security been grinding for about 2 years now mainly focused on red team offensive security stuff looking for people who are serious about learning testing tools and understanding how systems really work doesnt matter if you not crazy advanced yet as long as you got the mindset stay consistent and actually wanna improve and move smart inbox me!

[fallen palm]

hyy bro i like to work and grow together

[idle plinth]

Looking for new member for our team we are 3 now looking for 2 more feel free to dm me

[soft raptor]

same !

[supple sail]

@stone copper hy i m in

[wicked swallow]

i'm also interested

[wicked swallow]

i'm interested

[unreal plover]

Hi, I just joined here because I am specifically looking to collaborate with a top-tier hacker who has a proven and sophisticated profile on HackerOne.

I want to clearly state that I am intentionally not mentioning the name of the company involved at this stage for confidentiality reasons. However, the vulnerability affects a company that is in the top 0.1% category, and the issue has been assessed as a critical 10.0 severity vulnerability.

Once we make contact and I am able to verify your work history and credibility on HackerOne, I will share the full technical details privately. This matter is urgent and time-sensitive, so we would need to move quickly.

Please note that it is very important that you have a strong and verifiable HackerOne profile before reaching out, as this is a serious security issue that requires experienced collaboration.

[valid ruin]

Yoo

[hollow lake]

Anyone wants to play chess

[short wyvern]

SSH is open and I got into the admin password is brute forcing the right move? It's saying 180 tries per minute so I think it's rate limited so anyone to suggest what to do or should I leave SSH and focus on the other open ports

[south sail]

Is SSH in the scope?

[digital knoll]

Hiiiiii

[near shell]

I'm having a problem in my study lab; the screen keeps going black and I can't solve the exercises. Does anyone know what it is?

[tall sun]

hi, have anyone of you guys made revneu from bug bounty ??

[fading sky]

Is this study lab running on THM?

[red shadow]

Come on

[young socket]

not much but it is worth trying.

[elfin lagoon]

same here, tons of dupes, but i did land a $500 payout for an “informational” bug lol. found an exposed API key in a .js leaking marketing data. triager downplayed it and closed it, but the program owner jumped in, reopened it and paid out. It seems like 50% of this is just picking the right program

[weary wind]

Hello everyone,

My name is Yash. I’m 15 years old from India 🇮🇳 and currently studying in Class 9 (CBSE). I’m really interested in becoming a cybersecurity expert in the future.

I have some basic knowledge like phishing concepts and a little bit of Termux, since I don’t have a laptop or PC right now.

Can someone please guide me on how to properly start my journey in cybersecurity? A beginner-friendly roadmap would really help me a lot 🙏

Thank you!

[sand vessel]

What's good ? I started with free thm rooms bro there's a lot

[modest vector]

#start-here ⬅️

[fallen palm]

anyone wants make connection for bug bounty and pen testing dm me

[manic basin]

i m from India too

[weary wind]

Nice one

@manic basin can I DM you

[manic basin]

yep

[somber lantern]

I am interested

[onyx valve]

Hi, I am from India.

[fallen palm]

dm

[zealous needle]

same here

[spiral steppe]

Hi everyone! 👋
I'm Jamel, a beginner in cybersecurity.
I built an All-in-One Security Scanner in Python
that does:

• Port Scanning (34 ports)
• Banner Grabbing + CVE Detection
• SSL/TLS Checker
• HTTP Security Headers
• Subdomain Scanner
• Network Scanner

I already found missing security headers
on nmap.org and reported them responsibly!

GitHub: github.com/marwahamdi301-png/security-scanner

Open to feedback! 🔐💪

[gilded rock]

Which rooms do you recommend for bug bounty?

[jovial radish]

I want to learn Bug Bounty can anyone help me for this, like from where I can learn and practice ?

[gilded rock]

xd

[gleaming ermine]

What bug bounty programs do you guys recommend that is honest with their payouts?

[supple sail]

I m interested too. .

[fervent harbor]

https://opzero.ru/en/prices/

I support international cyberwarfare

[fervent harbor]

Learn the basics of reverse engineering, understand how a system handles memory, learn evasion and bypass techniques for modern security mechanisms, choose a piece of relevant enterprise software, use your acquired knowledge to search for a vulnerability, determine whether this vulnerability is exploitable, write a PoC exploit if necessary, classify the vulnerability, and write a report. Notify the company behind the software, tell them you want money for it or someone might publish the exploit (just kidding).

[fresh oar]

for Bug Bounty Complete RoadMap from THM is as follows:

1. Pre Security
2. Security 101 (optional but good)
3. web fundamentals
4. web application pentesting
5. Jr Penetration Tester

these are enough but continuous practice is required after these also
More Optional Paths are:

1. Web Application Red Teaming (optional, For more and to learn every type of web attacks)

I am also a beginner but I suggest it because I searched on it very much

[flint tiger]

yeah its pretty goood . i m doing this tooo

[unique hearth]

I'm doing it too, thank you

[uneven gale]

Gave +1 Rep to @fresh oar (current: #3723 - 1)

[fallen palm]

anyone want's to connect for bug bounty ?

[runic mortar]

what is in robots.txt of an domain and what can i find in it

[young socket]

A robots.txt file is a text file placed in a website's root directory that instructs search engine crawlers (bots) which pages or files they can or cannot request

[edgy quiver]

hit me up in the DMs

[runic mortar]

can anyone give me bug bounty free course

[hearty magnet]

@sharp creek Please slow down. Further spam will result in a short timeout.

@sharp creek Please slow down. Further spam will result in a short timeout.

[gilded rock]

you guys had problems with hackerone?¿

one company done a silent fix to one of my reports

which pages do you recommend besides HackerOne or better ones

[thin python]

Hy everyone,

[fading sky]

If you search youtube, Nahamsec does have a lot of videos there. Also, in their discord, they also run some free training if I remember it correctly.

[rigid dirge]

How to start

[fervent harbor]

• Write a simple C program that accepts input and prints it back out using insecure functions
• Compile it with PIE/ASLR and Canary
• Learn how the stack and heap work, and how tools like objdump and gdb works
• Analyse the program and observe the memory while it’s running
• Find an information leak
• Learn how gadget chains work
• Write an exploit for the vulnerabilities
• be happy
• Add a network interface to your C program and host it on a server
• Write a remote exploit
• be happy again
• You now have a greater technical understanding than 90% of all self-proclaimed hackers