BUG BOUNTY

HUNTING
BB002
How to actually learn

sachin
 BB002-1
Questions.

1. How to start?
2. What to learn first?
3. Where to learn?
4. How to avoid false tips/content?
5. How long does it take?
6. Do i need certificates/degree?

sachin
 BB002-2
1. How to start?

Start now
The only thing you need is internet.

There is no straight path to learn, you can start from anywhere as

shown in this diagram

xss sqli
recon

clickjacking

bash scripting
xxe ssrf
http headers
burpsuite

javascript
dorks exploits

sachin
 BB002-3
2. What to learn first?

As i already told you that you can start learning from anywhere, But
first clear your basics so that you will not face any problem in learning
further.

a. Networking
You must have to know that how the internet works, learn about
http requests, ports, packets, server, ip, ssh, dns, mac, vpn ssl,
tcp/udp etc.

b. Linux
Use linux in cli mode so that you can learn bash commands
ex. cd, mv, cp, rm, cat, nano, xargs, find, git etc.

sachin
 BB002-3
2. What to learn first?

After learning basics, your interest will force you to learn more and
then you can go with learning recon, vulnerabilities like xss, sqli, xxe.

In between you can also learn some crazy hacks like car hacking, wifi
deauth attack, flipper zero, raspberry pi board, etc.

Once you start watching these types of content, your device will
automatically start showing you hacking and technology related videos.

sachin
 BB002-4
3. Where to learn?

Make Google your best friend.

You can find everything on google including, articles, videos, research
tools, wordlists, payloads, etc.

Recommended websites
medium.com → articles
github.com → tools, wordlists, payloads
youtube.com → practical videos, interviews, livecon, poc
twitter.com → cybersecurity experts views,
exploit-db.com → exploits, dorks
rapid7.com → vulnerability info
cve.mitre.org → cve details
nvd.nist.gov → cve details

sachin
 BB002-4
3. Where to learn?

Recommended youtube channels

https://www.youtube.com/@NahamSec
https://www.youtube.com/@SpinTheHack
https://www.youtube.com/@BugBountyReportsExplained
https://www.youtube.com/@InsiderPhD
https://www.youtube.com/@rs0n_live
https://www.youtube.com/@LiveOverflow
https://www.youtube.com/@assetnote2016
https://www.youtube.com/@PwnFunction

https://www.youtube.com/@CodeManYoutube
https://www.youtube.com/@Fireship
https://www.youtube.com/@techchipnet

https://www.youtube.com/@TheXSSrat
https://www.youtube.com/@STOKfredrik
https://www.youtube.com/@codingo
https://www.youtube.com/@TomNomNomDotCom
https://www.youtube.com/@xdavidhu

sachin
 BB002-4
3. Where to learn?

Practice

To find vulnerabilities in real life websites, i will suggest you to solve

portswigger labs

There you can find lots of labs that are designed for beginners to
advance level. There are multiple ways to exploit a vulnerability, these
labs help you to make your mind in such a way that it can think about
all the possibilities of hacking the website.

sachin
 BB002-5
4. How to avoid false tips/content?

Methods

a. Follow trusted peoples content only

b. Don't run any tools or script without understanding
c. Double check each method yourself

There are lots of twitter account that reshares #bugbountytips content

without rechecking them, you must avoid those
If you want to run a code from someone's github repo, be sure to read it
first.

sachin
 BB002-6
5. How long does it take?

12 Months

Yeah, If you really want to learn a skill you must give it 12 months
minimum.

Bug bounty is not the 15 hour game, To success in it you must learn it
everyday, If you keep learning this continuously for the next 6 months,
you will start seeing results.
I found my first paid bug in sixth month of my learning.

sachin
 BB002-7
6. Do i need certificates/degree?

No/yes

It totally depends to you

As you learn more in this field, you will know for yourself whether you
want to pursue a certificate/degree or not.

If you are going with certificate make sure that it has:

a. Updated content and accepts by most of companies
b. Choose beginner friendly certs in starting then go with advance.

sachin
 BB002-EOF

Be uniq
Be creative
Thanks for watching

Contact : https://shinchina.in https://t.me/shinchina

sachin