Bug Bounties and Getting Started
I am not the type of person to sit idle. So while I looking for work in Cyber Security I set my sights on spending my spare time enjoying the process of learning Bug Bounty Hunting and Web Application Penetration Testing.
But where to start?😳
I passed the EC-Council Certified Ethical Hacker but that was a whole lotta knowledge with little to no experience to show for. In a hot minute 🔥, I was scouring and refining my search on Google and YouTube.
I made up my mind…. I am tired of theory.
I want hands-on, practical, penetration testing experience.
Then on YouTube, I found the best place to start from one of my favorite Cyber Security mentors Stok. His video titled, “This is why you should get a PentesterLab Pro Subscription.”
The opening question in this video 100% resonated with me when he said, “How do you get started in Bug Bounties in 2021?” and his answer was simple. “Have you completed all the badges over at Pentesterlab.com? (Or at least the free ones?)”
This is exactly what I was looking for 🙌.
Now after 21 days, I can confidently say, ‘Whoa!!! 🤯 I am getting a ton of new context out of these exercises.”
I tried PentesterLab with lackluster before… but now ⚡ because my friend Stok recommended it, I am doing it again with grit and refreshed vigor!!
PentesterLab is providing the mentorship and ‘starter’ training I have been looking for. [When my skills get even better I want to do the Offensive Security Advanced Web Attacks and Exploitation (WEB-300)]
For now PentesterLab is giving me more than enough value. They provide instruction about what I am going to be doing and show what to expect. They demonstrate how to do the exercise and then I have to fill in the gaps to complete the exercise to advance through the course.
This has definitely been a trial-by-fire experience to learn the OWASP Top 10 vulnerabilities and practice these micro exploits hosted on virtual machines from their platform.
But if you have ever started a new job and need to get ramped up quickly, you should be used to being thrown into the deep end 🌊 and expected to swim. (Such is life) Think about the time you had your first child and the hospital told you to “GO HOME.” They basically kicked you out of the hospital 🏥 and expected you to know how to be a parent automatically!!
The last twenty-one days 📅 have flown by and I find myself looking forward to each day I get to spend on growing my skills. Part of me is excited about what am I going to learn next and the other part of me feels is surprised that I am learning so much so fast.
A few of the memorable exercises I can remember:
> Unix privilege escalation from three different locked down profiles
> Creating a Python3 program that will Brute Force a password for an Admin account on a website
> Injection attacks specific to PHP, NodeJS, mySQL, and PostgreSQL
> Multiple ways of bypassing Authentication
All the while I used to be timid about using OWASP Zed Attack Proxy but now the software is growing on me. I am interacting with the developer tools in my browser, sniffing traffic, intercepting requests, stealing browser cookies, and changing values in HTTP traffic on the fly.
For anyone interested in 💻 Application Security and 🐞 Bug Bounties I recommend following Cyber Security mentors wherever you can find them online and getting as much hands-on experience as possible. I hope that you grow your faith and confidence in your abilities. “Use the Force, Luke.” Trust in your skills; believe in the possibilities.
You can find Stok on Twitter at https://twitter.com/stokfredrik.
