Bug Bounty is a reward program in which researchers (hackers) look for gaps in a company’s digital security. When a customer decides to use the services of burglars, a special document is developed – the Bug Bounty program. Sometimes it is sewn into other security documents. It describes the conditions, taking into account which you can go in search of bugs.<\/p>\n\n\n\n
If the hacker first finds the problem and sends a clear and well-formed report, he is rewarded. Rewards are not always money, so read the policies (programs) carefully if you plan to make money in this way. In Bug Bounty, hackers go for more than material rewards. Some seek experience, earn reputations, and tackle exciting challenges with the services and products that interest them the most.<\/p>\n\n\n\n
Sometimes companies publish gratitude to specific researchers (hackers) in their programs, which can also be a reward format or a nice addition to money. As an example: Discord<\/a> and Netflix<\/a> .<\/p>\n\n\n\n In turn, for companies, Bug Bounty is a chance to avoid multi-million dollar costs and reputational damage in the event of a real hack.<\/p>\n\n\n\n Important! <\/em>Don’t confuse Bug Bounty with Penetration Testing<\/a>. In the second case, a contract is concluded with a knowingly qualified employee who has clear deadlines. Payment is made for time, not for finding vulnerabilities.<\/p>\n\n\n\n Programs can be public or private. The former are available to everyone, although sometimes you can stumble upon the requirements for experience and previous results. The company itself selects suitable specialists for private programs. If you were invited to a private program, the number of competitors is significantly less, and therefore the chances of earning are higher.<\/p>\n\n\n\n Customers usually start with private programs. When they are already able to process a large number of reports, some go to the public format. In turn, hackers who had no experience with Bug Bounty start with public programs to build a portfolio and build a good reputation.<\/p>\n\n\n\n Programs are hosted on customers’ own websites and in special platforms (more about them below). Many companies create such programs, so if you want to investigate a specific organization, you should look for information about Bug Bounty in its security documentation.<\/p>\n\n\n\n To make it easier for companies to find researchers, and for researchers to find Bug Bounty programs of interest, there are many special platforms. There communication takes place, there hackers send reports, and companies pay through these reward systems.<\/p>\n\n\n\n 1. HackerOne<\/a> is a startup that was one of the first to promote the topic of crowdsourced security. It is now one of the most popular platforms for Bug Bounty programs. To take part in the search for bugs, you just need to register. There is free training<\/a> for beginners .<\/a><\/p>\n\n\n\n You need good metrics to be invited to attractive private programs. In HackerOne, such an indicator is reputation, which is awarded in the format of points, depending on the amount of the reward and the severity of the vulnerability. At the same time, your reputation can be diminished if you send bad reports or spam.<\/p>\n\n\n\n In the “Hacktivity”<\/a> section ,<\/a> you can examine the latest vulnerabilities found. The company profiles also have a “Thanks” section – something like a board of honor.<\/p>\n\n\n\n You can learn more about all the nuances of work from the documentation<\/a> . The HackerOne platform itself can also be checked for vulnerabilities: it has a profile<\/a> on the site.<\/p>\n\n\n\n 2. Bugcrowd<\/a> is a fairly popular platform that is used by a number of well-known companies. They have a taxonomy of<\/a> vulnerability severity, by which hackers are judged and rewarded. Companies do not need to separately specify in policies which vulnerabilities belong to which severity level.<\/p>\n\n\n\n Educational programs<\/a> here are more likely for those who already have a base in cybersecurity. They introduce hackers to the peculiarities of working with Bug Bounty. Lessons consist of videos, presentations and laboratories for remote sensing.<\/p>\n\n\n\n In the organization profiles there is a section with announcements (“announcements”), where updates on various issues are published. Those hackers who have submitted at least one relevant report on this program are published in the “Hall of fame” section.<\/p>\n\n\n\n They give points for good reports. There are also badges for achievements, just like in the game.<\/p>\n\n\n\n Badges are earned by tier, with the accumulation of the number of reports sent and vulnerabilities found.<\/p>\n\n\n\n Detailed information on using the Bugcrowd platform can be found here<\/a> .<\/p>\n\n\n\n 3. Synack<\/a> is a platform that automates the search for exploited vulnerabilities for subsequent investigation by freelance hackers. Unlike previous platforms, hackers are carefully screened here. Only 10% of candidates end up in the Red Team. Read more about the selection process<\/a> . And they also have a cutie – a small guide<\/a> for close people of ethical hackers.<\/a><\/a><\/p>\n\n\n\n 4. Intigriti<\/a> is a European platform. Before registering an account, it is better to carefully read its terms<\/a> . As for training, the creators of the platform offer to watch a course of<\/a> animated videos about various vulnerabilities, as well as a guide to writing reports and a selection of hacking tools. The researchers with the best results are published in the leaderboard.<\/a><\/a><\/p>\n\n\n\n There are many adequate platforms with different conditions. Other options are not difficult on the Reddit community<\/a> and on GitHub<\/a> , but the most famous companies publish their programs on HackerOne<\/a> and Bugcrowd<\/a> . <\/p>\n\n\n\n In their Bug Bounty programs, most companies indicate:<\/p>\n\n\n\n Apple<\/a><\/p>\n\n\n\n The problem should be found on the latest released software versions. If Apple was not aware of the issue found, then an additional 50% of the specified reward can be earned. The categories have been identified where you can look for vulnerabilities, but it is noted that if a bug is found elsewhere and it significantly threatens users, the hacker will also be paid. Remuneration: from $ 5000 to 1 million<\/p>\n\n\n\n Telegram<\/a><\/p>\n\n\n\n Telegram used to run contests for hacking, but the service also has a Bug Bounty program. If you find vulnerabilities in an application or protocol that entail changes in the code, the service will pay from $ 500 to $ 100,000 and even more.<\/p>\n\n\n\n Tinder<\/a><\/p>\n\n\n\n They have a private program, but you can research and send reports that will be approved or not. It is forbidden to use automated scanning tools and test DoS attacks.<\/p>\n\n\n\n Airbnb<\/a><\/p>\n\n\n\n Indicates the specifics of testing different products. Payment up to $ 15,000. You cannot send questions about found vulnerabilities to the support service. This interrupts work.<\/p>\n\n\n\n ClickUp<\/a><\/p>\n\n\n\n Only interested in finding vulnerabilities on app.clickup.com. There user data. Relevant and irrelevant vulnerabilities are marked on the list. The reward can only be obtained if you are not from countries that are subject to US sanctions. For the money $ 25-250.<\/p>\n\n\n\n If you want to improve the skills of such earnings, you can enroll in the Bug Bounty training course of Valeurbit Infosec. In addition to other aspects of cybersecurity, the course program includes a detailed study of the Bug Bounty programs. Among the teachers – an experienced practitioner in the hunt for vulnerabilities.<\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" A freelance white hacker can make $ 200 in 5 minutes, but don’t rush to break everything right away. We will show you how to do it legally with Bug Bounty programs. Ethical hacking is the bottom line in cybersecurity . Today we will tell you how white hackers can make money hunting for vulnerabilities of world-famous companies. Bug Bounty is…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"yoast_head":"\nBug Bounty Programs<\/strong><\/pre>\n\n\n\n
Platforms For Interaction Between Hackers And Companies<\/strong><\/pre>\n\n\n\n
![\"bug-bounty\"](\"https:\/\/valeurbit.com\/blog\/wp-content\/uploads\/2021\/05\/bugbounty-1-1024x144.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/valeurbit.com\/blog\/wp-content\/uploads\/2021\/05\/bugbounty1-1-1024x229.png\")
<\/figure>\n\n\n\n![\"bug-bounty-bugcrowd\"](\"https:\/\/valeurbit.com\/blog\/wp-content\/uploads\/2021\/05\/bug-bounty-bugcrowd-1024x918.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/valeurbit.com\/blog\/wp-content\/uploads\/2021\/05\/bugcrowd-bug-bounty.png\")
<\/figure>\n\n\n\nWhat Are The Conditions<\/strong>?<\/pre>\n\n\n\n
Examples Of Bug Bounty Conditions From Well-Known Companies<\/strong><\/pre>\n\n\n\n
What To Expect From Bug Bounty<\/strong><\/pre>\n\n\n\n