Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities
by Vickie Li · No Starch Press
A 416-page guide in four parts: choosing programmes and writing reports; environment setup, Burp Suite and reconnaissance; 16 web vulnerability classes with detection and escalation steps; and advanced techniques including source code review, Android apps, API testing and fuzzing. This is the most complete single book on the whole bounty workflow: programme selection, recon, vulnerability classes, escalation and reporting. It is newer than Real-World Bug Hunting and more methodical, while that book is organised around case studies, so the two complement each other.
This link may earn us a small commission at no extra cost to you. Affiliate disclosure
More resources on Bug Bounty Hunting
Critical Thinking - Bug Bounty Podcast
A weekly technical podcast by full-time bug bounty hunters. Episodes break down recent write-ups, new exploitation techniques, client-side and AI attack research, and hunting strategy, often with top researchers as guests. Over 190 episodes. This keeps intermediate and advanced hunters up to date. Techniques change faster than books, and this is the densest technical source focused only on bounties. I
The Bug Hunter's Methodology v4.0 - Recon Edition (NahamCon 2020)
Recon is the skill that sets bounty hunting apart from general web security, and this talk is the most-cited free treatment of it. Some named tools have moved on since 2020, but the framework still holds. Jason Haddix's conference talk on wide-scope bug bounty reconnaissance. It covers finding a target's acquisitions and ASNs, enumerating subdomains, scraping and brute-forcing, port scanning and screenshotting, and chaining these into an automated recon workflow that maps the attack surface.
zseano's Methodology
A free 71-page PDF in which a full-time hunter sets out his approach to web bug bounties: the questions he asks while testing, his basic toolkit, the issues he checks first, choosing a programme, taking notes, expanding attack surface and automating repeat checks. It covers what textbooks skip: how an experienced hunter actually works a target step by step, and how to pick programmes. Its focus is mindset and workflow, not a catalogue of bug classes, so it pairs with the Academy.
Real-World Bug Hunting: A Field Guide to Web Hacking
This is the standard 'learn from real paid reports' book. Every bug class is tied to a disclosed bounty and its payout, which teaches what programmes actually reward. It also has dedicated chapters on finding programmes and writing reports. Each chapter explains one web vulnerability class, such as open redirects, CSRF, XXE, SSRF, OAuth flaws, race conditions and subdomain takeovers. It then walks through real paid bounty reports against Twitter, Facebook, Google and Uber.
Hacker101
This is the canonical free on-ramp and the only one built specifically for bounty hunting. It ties learning straight to legal practice: CTF progress earns invitations to real private programmes. HackerOne's free web security class for aspiring bug bounty hunters. Video lessons cover common web vulnerability classes and testing approach, and a real-world-inspired CTF supplies practice targets. Solving CTF flags earns private bounty programme invitations.