--- title: Bug Bounty Hunting description: Bug bounty programmes pay researchers for responsibly reported vulnerabilities. You will learn reconnaissance, common web vulnerability classes, reporting, and how to practise legally on labs and platforms. category: programming-tech subcategory: cybersecurity difficulty: beginner, intermediate, advanced url: /subject/bug-bounty-hunting --- # Bug Bounty Hunting Bug bounty programmes pay researchers for responsibly reported vulnerabilities. You will learn reconnaissance, common web vulnerability classes, reporting, and how to practise legally on labs and platforms. ## Available Resources 3 Books • 1 Courses ## Podcasts ### 1. Critical Thinking - Bug Bounty Podcast **Author:** Justin Gardner, Joseph Thacker A weekly technical podcast by full-time bug bounty hunters. Episodes break down recent write-ups, new exploitation techniques, client-side and AI attack research, and hunting strategy, often with top researchers as guests. Over 190 episodes. This keeps intermediate and advanced hunters up to date. Techniques change faster than books, and this is the densest technical source focused only on bounties. I **Difficulty:** Advanced | **Language:** English | **Price:** Free **Link:** https://www.criticalthinkingpodcast.io/ **Tags:** bug-bounty, web-security, exploitation-techniques, client-side-attacks, security-research ## Youtubes ### 1. The Bug Hunter's Methodology v4.0 - Recon Edition (NahamCon 2020) **Author:** Jason Haddix Recon is the skill that sets bounty hunting apart from general web security, and this talk is the most-cited free treatment of it. Some named tools have moved on since 2020, but the framework still holds. Jason Haddix's conference talk on wide-scope bug bounty reconnaissance. It covers finding a target's acquisitions and ASNs, enumerating subdomains, scraping and brute-forcing, port scanning and screenshotting, and chaining these into an automated recon workflow that maps the attack surface. **Difficulty:** Intermediate | **Language:** English | **Price:** Free **Link:** https://www.youtube.com/watch?v=p4JgIu1mceI **Tags:** reconnaissance, subdomain-enumeration, attack-surface-mapping, recon-automation, bug-bounty ## Books ### 1. zseano's Methodology **Author:** Sean Roberts (zseano) A free 71-page PDF in which a full-time hunter sets out his approach to web bug bounties: the questions he asks while testing, his basic toolkit, the issues he checks first, choosing a programme, taking notes, expanding attack surface and automating repeat checks. It covers what textbooks skip: how an experienced hunter actually works a target step by step, and how to pick programmes. Its focus is mindset and workflow, not a catalogue of bug classes, so it pairs with the Academy. **Difficulty:** Intermediate | **Language:** English | **Price:** Free **Link:** https://www.bugbountyhunter.com/methodology/zseanos-methodology.pdf **Tags:** bug-bounty-methodology, web-application-testing, hunting-workflow, attack-surface, bug-bounty ### 2. Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities **Author:** Vickie Li A 416-page guide in four parts: choosing programmes and writing reports; environment setup, Burp Suite and reconnaissance; 16 web vulnerability classes with detection and escalation steps; and advanced techniques including source code review, Android apps, API testing and fuzzing. This is the most complete single book on the whole bounty workflow: programme selection, recon, vulnerability classes, escalation and reporting. It is newer than Real-World Bug Hunting and more methodical, while that book is organised around case studies, so the two complement each other. **Difficulty:** Intermediate | **Language:** English | **Price:** Paid **Link:** https://www.amazon.com/dp/1718501544?tag=edmonddante07-20 **Tags:** web-vulnerabilities, burp-suite, reconnaissance, vulnerability-reporting, api-testing, bug-bounty ### 3. Real-World Bug Hunting: A Field Guide to Web Hacking **Author:** Peter Yaworski This is the standard 'learn from real paid reports' book. Every bug class is tied to a disclosed bounty and its payout, which teaches what programmes actually reward. It also has dedicated chapters on finding programmes and writing reports. Each chapter explains one web vulnerability class, such as open redirects, CSRF, XXE, SSRF, OAuth flaws, race conditions and subdomain takeovers. It then walks through real paid bounty reports against Twitter, Facebook, Google and Uber. **Difficulty:** Beginner | **Language:** English | **Price:** Paid **Link:** https://www.amazon.com/dp/1593278616?tag=edmonddante07-20 **Tags:** web-vulnerabilities, disclosed-reports, ssrf, xxe, csrf, bug-bounty ## Courses ### 1. Hacker101 This is the canonical free on-ramp and the only one built specifically for bounty hunting. It ties learning straight to legal practice: CTF progress earns invitations to real private programmes. HackerOne's free web security class for aspiring bug bounty hunters. Video lessons cover common web vulnerability classes and testing approach, and a real-world-inspired CTF supplies practice targets. Solving CTF flags earns private bounty programme invitations. **Difficulty:** Beginner | **Language:** English | **Price:** Free **Link:** https://www.hacker101.com/ **Tags:** web-security, ctf, hackerone, web-vulnerabilities, bug-bounty --- *This content is part of Dantes.io - Your Treasure Map to Knowledge* *Curated by humans at Dantes.io. Personal study use welcome; republishing this curation requires permission (team@dantes.io).* View this page online: https://dantes.io/subject/bug-bounty-hunting