Picking a Bug Bounty Program

What Bug Bounty Bootcamp Says About Picking a Program

After reading the first chapter of Bug Bounty Bootcamp my biggest take away was the recommendations for finding a program to focus my efforts on. Vickie Li breaks the decision down into a few concrete axes:

• Asset type — social apps (high competition, e.g. Facebook/Twitter), general web apps (low barrier to entry, wide range), mobile (needs a rooted device + emulators on top of web skills), APIs (data leaks, injection), source code/executables (needs programming + reverse engineering), hardware/IoT (least competitive, but needs specialized gear).
• Platform vs. direct program — platforms (HackerOne, Bugcrowd) centralize submissions and handle reputation/payment. Direct programs (Google, Facebook, Apple, Medium) skip the platform, and you often get to talk to the company's security engineers directly — a better learning experience, per Li.
• Scope size — bigger asset scope means more targets, including obscure/overlooked ones other hackers skip. Less competition as a result.
• VDPs (Vulnerability Disclosure Programs) — no payout, reputation-only. Less competitive, good for building a track record when you're not there for the money yet.
• Response time — fast responders matter most early on, since you'll misjudge severity or botch a report a few times and want quick feedback to correct course.

Li's bottom line for beginners: prioritize learning speed over payout — VDPs and fast responders beat high-dollar competitive programs when you're starting out.

Decisions Decisions

Since I already decided on the last post Barking up the Right Tree I would focus on Web Application Vulnerabilities so my asset type has been decided.

Following Vickie's advice of going for VDPs which have less competition. The inclusion of AI into the equation also drives this decision as well. No one is going to waste tokens on a program that isn't going to pay out, which means VDPs stay clear of that competition too.

Finally the decision of going with a Platform or going direct. Here the choice is easy for me. Going direct to the big companies will lead to stiffer competition. Going direct also limits you to one Industry unless you want to manage multiple relationships. Right now the focus is on building the skills, once they are solid then I can consider building those relationships.

Summary of the decisions - Focusing on Web Applications - VDP Programs Only to reduce competition - Programs with fast response time to help speed up the feedback loop - Go with an established Bug Bounty Program

Choosing Between Bugcrowd and HackerOne

The 2 main players in the bug Bounty platform space are Bugcrowd and HackerOne. Given the choice from the last section as well Vickie's recommendations to look for large scopes.

The criteria for choosing a platform comes down to how easy it is for me to review programs based on my metrics.

Bugcrowd

Bugcrowd's Engagement Dashboard is well laid out and has a tab to navigate to the Vulnerability Disclosure programs.

Scope is based on a rating scale from 1-4, based on this rubric. * > 5 Targets (+1 point) * >= 10 Targets (+1 point) * > 2 Wildcard domain Targets (+ 1 point) * >= 4 different categories of target (e.g., Web, API, Mobile, Crypto) (1 point)

You can filter your results for the highest rated scopes as shown in the image below

Once you filter for scope you have to choose a program to see the scope. This can make comparing programs tedious. A program with 11 Targets, 2 Wild Card Domains and 4 Categories will have the same rating as one with 1000 Targets and 10 Wildcards with 4 Categories.

Response time is also shown on the programs page. Here is an example of the response time for a Financial program. This also makes program comparison difficult.

HackerOne

HackerOne's Opportunities dashboard has a drop filter for the different programs. Vulnerability Disclosure Programs are called Response programs.

Filtering down to Response Programs you get a tiled display of programs with a Summary of the Scope as well as the response efficiency. This makes comparing programs a lot easier.

The 219 returned programs can be further filtered by Program Features which includes Highest Response Efficiency

Once all my filters are applied there are 104 programs to choose from. Unfortunately I can't sort by scope size to bring the biggest scopes to the top, but I can scroll through the page and note the ones with high scopes.

What About Your AI Assistant?

Yes I could easily have given EVA a prompt like "Pull the top 10 VDP programs from HackerOne with the largest scope and best response efficiency. Only return programs the have Web Application Targets " and I would have those results, but I would not have a sense of how each platform presents the programs. Having EVA do the work doesn't give me that understanding.

And The Winner Is

HackerOne has a slight advantage over Bugcrowd with the layout that lets me scan all the programs and look for the ones with the largest scopes and best response times. That is not to say Bugcrowd doesn't have advantages I did not explore that would be useful later on in my journey. For the time being HackerOne will be my platform of choice.

Picking A Program

The next logical step here is to pick a program to actually start hacking on. The programs with the best metrics for my use case are in the table below

The choice here is pretty clear for me. Fiserv has a huge scope as well as an excellent Response Efficiency.

Until Next Time

I have a few things in the queue for the next few weeks as I settle into my new house. Look for a post or two about some AI hacking as well as a look into the first chapter of Real-World Bug Hunting