patchgoblin

• Post By patchgoblin
• 2 weeks ago

🔰 1. Set Up Your HackerOne Profile Properly

A good profile adds credibility and trust.

• Username: Use something professional or hacker-relevant.

• Bio: Mention your skillset, tools you use, and your interest in security.

• PGP Key: Optional but adds professionalism.

• Link accounts: GitHub, LinkedIn, or personal site (if available).

• Add HackerOne Signal: Participating in CTFs and TryHackMe/HTB can help.

---

🧭 2. Understand HackerOne Scope and Rules

• Programs: Start with public programs, not private ones (you’ll get invites later).

• Scope: Only test assets listed as "In Scope." Avoid "Out of Scope" to prevent getting banned.

• Rules of Engagement: Read every program's policy—some don’t allow certain tests (e.g., DoS, social engineering).

• Check for Duplicates: Before reporting, search the program's disclosed reports to avoid known bugs.

---

🔍 3. Choose the Right Target

Good beginner-friendly programs:

• HackerOne Directory → Filter by “Newly Public” or “Low Report Count.”

• Look for bug bounty + vulnerability disclosure programs with good response times and clear rules.

• Target smaller companies or universities with basic setups and limited internal testing.

---

🛠 4. Reconnaissance (Recon) – Where You Hunt

Start with:

• Subdomain enumeration:

  • Tools: amass, subfinder, assetfinder

• Directory brute-forcing:

  • Tools: ffuf, dirsearch

• Port scanning:

  • Tools: nmap, rustscan

• Passive Info Gathering:

  • Tools: crt.sh, Shodan, Wayback Machine, GitHub search

---

🧪 5. Test for Common Vulnerabilities (Start Simple)

Stick to low-hanging fruits first:

• IDOR (Insecure Direct Object Reference): Change user_id=123 to user_id=124

• Open Redirects

• Rate Limiting / No Auth Checks

• Broken Access Control

• CSRF on sensitive actions

• Basic XSS (Reflected, Stored, DOM)

Use:

• Burp Suite Community or Pro

• OWASP ZAP

• Postman for API testing

---

📝 6. Report Like a Pro

Your report should be clear, reproducible, and polite:

Template:

• Title: Clear and specific (e.g., “IDOR in /api/deleteOrder allows deleting other users’ orders”)

• Summary: What the issue is and why it matters

• Steps to Reproduce:

  1. Login as user A

  2. Note the request sent to /deleteOrder?id=1001

  3. Change id=1001 to id=1002 (belongs to user B)

  4. Order is deleted.

• Impact: Explain the real-world consequence (e.g., account takeover, data leak)

• Screenshots / Videos: Visual proof helps a lot (use ShareX, OBS)

• Severity: Suggest severity using HackerOne CVSS system

---

❌ Rookie Mistakes to Avoid

• ❗ Reporting issues outside scope

• ❗ Submitting low-quality reports like "X-Powered-By header exposed"

• ❗ Not checking for duplicates

• ❗ Fuzzing without understanding what the app does

• ❗ Brute-forcing login forms or breaking rate limits on live production systems

• ❗ Forgetting to include all required reproduction steps

• ❗ Getting discouraged after 1–2 rejections

---

🧠 Bonus Tips

• 🧪 Practice on intentionally vulnerable apps (like DVWA, Juice Shop, PortSwigger Labs)

• 🧘 Be patient—your first valid report might take days or weeks

• 🗣 Join communities (Reddit: r/bugbounty, Discord servers, HackerOne Discord)

• 📖 Read disclosed reports on HackerOne to learn patterns

• 🧤 Think like a real user, then like a malicious user

---

🚀 Your First Report Flow (Checklist)

✅ Choose a public program
✅ Read the policy + scope
✅ Recon the target
✅ Find a small bug (IDOR, CSRF, etc.)
✅ Test thoroughly + check for duplicates
✅ Report it clearly with PoC
✅ Be respectful and responsive in communication