My Skill Lab
CybersecurityIntermediate

Bug Bounty Hunting

Find, prove and report web vulnerabilities for rewards.

Taught by Kiran Basnet · Security Engineer

What you'll learn

  • Explain how bug bounty platforms, programs, and payouts work
  • Read a program scope and stay strictly within its legal boundaries
  • Perform reconnaissance to map a target's assets and attack surface
  • Find and confirm common bug classes such as IDOR, XSS, and SSRF
  • Prove impact safely without harming production systems or user data
  • Write reports that triagers accept, reproduce, and reward

About this course

Bug bounty hunting lets you legally test real companies' web applications and earn rewards for the security flaws you find and report. This course is for aspiring web security testers who already know the basics of how the web works and want a practical path into hunting. You will learn how bounty platforms and programs work, how to read a scope and stay legal, how to do reconnaissance, and how to find and confirm the bug classes that pay most often, including IDOR, cross-site scripting, and server-side request forgery. Just as importantly, you will learn to write clear, reproducible reports that triagers accept and reward. You practise every technique against deliberately vulnerable applications you run yourself, so you build real skill without ever touching a system out of scope.

Course content

7 lessons
  1. 1How Bug Bounties WorkPlatforms, programs, scope, and the rules that keep hunting legal and rewarding.Preview
  2. 2Setting Up to Hunt Safely and LegallyBuild a testing toolkit and a practice lab so you learn without ever going out of scope.
  3. 3Reconnaissance: Finding the Attack SurfaceMap a target's subdomains, endpoints, and technologies to find where bugs are likely to hide.
  4. 4IDOR and Broken Access ControlFind bugs where users can access data or actions that should not be theirs.
  5. 5Cross-Site Scripting (XSS)Understand reflected, stored, and DOM-based XSS and how to prove them without harm.
  6. 6SSRF and Other High-Impact BugsLearn server-side request forgery and where the biggest bounties tend to hide.
  7. 7Writing Reports That Get PaidTurn a confirmed bug into a clear, reproducible report a triager accepts and rewards.