Hello, everyone.
So in this video, we are going to see how to start with a bug bounty, so this is the first platform
that is background.
So in this video, I'm going to teach you how you can start your journey on background.
So basically, this is a road map video for hunting bugs onto this platform.
So as you can see, I have open background that come into my Web browser.
You can just type background dot com into your browser.
Also just navigate to the researcher portal because it is such a portal is where we are going to sign
up and start hunting for bugs.
So after clicking on the research portal,
you can see this page.
So just click on create account after creating after clicking on the create account, try to fill all
the necessary details over here.
So let's say a user username.
I type baby hacker in the e-mail address.
Let me take my email address.
Hacker dot udemy A.T.M. dot com in the password.
Let me take a password for this account
in the phone password.
Let me confirm the password
and let me just hit on sign up.
Perfect.
So they have sent a confirmation may let me check if I got a mail.
Yes, I got the mail right now.
Let me just click on confirm my account.
So after clicking Audur, your account was successfully confirmed.
Perfect.
So I'm going to login into my bank account right now.
So let me use my email address and my password to login into this account.
So after giving the right credentials, you just have to hit on login and you'll be logged into your
account.
Just agree and accept whatever the terms are there.
As far as you can see, this is the first thing that you will see, which is the dashboard, your other
points, when you will start handing valid vulnerabilities while it bugs, you will get some points
and your current rank will get updated.
Perfect.
So this is the first thing that you will see when you will sign up and you come into your dashboard.
Let's go to the programs function.
And when I click on programs, you're I can see a long list of programs that are there.
So there are around one hundred and sixty one programs currently which keeps on updating all year.
As you can see on the first one, it is showing waitlisted.
What is waitlisted means I cannot hunt bugs into this account because there are three requirements that
I need to first do.
That is I need to at least submit three reports.
Those are valid then only I be able to hunt bugs into this leading video game company, the three easy
payments.
OK, so these are the programs where you have to be eligible by hunting valid bugs on the background
and they will basically see that your profile is strong enough to hunt and do these types of websites.
OK, so no problem.
If you are not able to handle these two website when you just make a new account, let's see what are
the open programs.
So as you can see, transfer wire is an open program.
You're also you can see takeaway is all open program.
So let me just go to transfer wise.
From the summit report, you can just submit our ability to put to them, let's click on Transfer Ways
and let's see the details about this program.
So as you can see, the name of the program is to transfer waste the reward from hundred dollar minimum
to 4000 dollars per vulnerability, maximum reward have given a six thousand dollars safe harbor means
you just have don't have to disclose the bugs anywhere until they are fixed.
These are the program details.
93 vulnerabilities have been found into this program and rewarded.
They basically validate in four days average payout they have been giving us to fifty five point five
five dollars.
Perfect.
Forty seven unique bugs have been reported to them.
Out of some are duplicates or in total, bugs are 192, yada, yada.
The total latest Hall of Famers.
And these are the people who have recently joined the program and started hunting on transfer rates,
as you can see, all going to the announcement.
And you can see they keep on updating the rewards of bonus period has ended for transfer waste program
and crowd stream.
So Cloudstreet Stream is a feature in which the website owner of Transfer Wise decide if they want to
make their reports public.
So anyone liabilities that has been reported after reporting the fix it and after it has been fixed,
it is their decision that they want to make this report public for other people so they can basically
read it.
How is a very good platform in which we have the option of reading the report, but has just recently
implemented crowd stream.
So let's just try to go there and you can see these reports submission accepted, but we cannot report.
Basically read any type of reports because they are not public.
This is the Hall of Fame.
Perfect.
Let's go down and you can see these are the rules.
Not important for us right now.
Let's go.
Your reward range is important, as you can see, any bug which comes under BE1 severity that is critical
and gets the reward range between three thousand dollars to four thousand dollars.
Similarly, BE2 with a severe bug goes to for 1000 to 1500, moderate and low.
So the vulnerabilities that have been we have studied, studied in previous videos like all the bypass,
no debt limit exercise C SRF.
And if you try to get sensitive data out of those vulnerabilities of any of the user accounts, this
probability may will go to point B two and B three.
Yes.
So this is important to see, which is what is in your scope to test.
So transfer wise dot com that that is the website is in scope for your testing.
Total, 41 unique bugs have been already reported.
As you can see, these are the bugs which have reported and you can seek.
SRF is already reported to unique reports have been reported and nine duplicate reports.
OK.
And the Iosava Android app and other things are into the scope, what is an out of scope is important
for you, because I do not want you guys to waste your time on hunting on websites which are kept out
of scope.
For example, you can see the blue dot com or the blue dot, the belly or any subdomains of these two
websites are out of scope.
So if you try to find anyone Lovelady's on these domains, they will not be acknowledged or rewarded
because those are out of scope.
Let's go yet again to focus areas they want you to bypass at all.
Unauthorized accounts, do authentication bypass.
OK, let's scroll down and let's see what else these are out of school fallibilities, which means low
hanging fruit, basically, which which should not be reported.
These are out of school books and the program rules.
So basically, this is it.
The most important thing to look out here is the reward range.
What is in school and how many vulnerabilities have been reported to that program?
Perfect.
So let's assume now that you have found a valid vulnerability onto this website.
So how to submit a report onto this program?
We have read all the rules and everything, but how to submit a report so you can see there is the option
of submit a report.
You just have to click on that after clicking on submit report.
The first thing that it is asking is somebody's title.
So you have to provide a summary title, which is basically, let's say you have found Exercice on this
website, so you have to type Exercice on
the W w dot.
Transfer wise dot com.
You have to choose the target after choosing the target, technical security, you to choose a bug so
we can choose, let's say, exercice, as we have found, exercise in exercise.
Let's say we have found reflected exercise, so reflected exercise nonsense, obviously not a self exercise.
So I'll go down with what is the you are or the endpoint that you have found.
So let's say transfer wise dot com slash.
I have found exercise on, let's say this end point slash.
Here is the injection point equals to exercise.
So let's say the parameter here is the injection point is vulnerable and I'm able to put the exercise
payload over there.
So you have to give it like this so it becomes easy for the program owners to validate the issue and
triage quickly.
The most important thing here is the description and the description there should be to do four things
which are important for any report that you make.
First is description.
Description signifies what vulnerability you have found out.
The next is steps to reproduce.
So unless you have to type what are the steps to reproduce in that you can type step one, go to this.
You are a step to put this exercise payload year into the injection point step three.
When you will hit enter, you will be able to able to see that exercise execute, which confirms there
is a valid venerability.
So the next thing is proof of concept, so you have to attach a screenshot or a video.
I generally believe attaching a video is more helpful in some cases.
And it is a very good practice that instead of attaching screenshots, you can attach a quick PEOC video.
And the last one is mitigations that how to fix this.
So, guys, we have already seen the mitigations for each type of vulnerability into our videos.
You can just try to give a reference from those videos over here that were the fixes.
And these are two.
Are any additional inputs?
You don't have to give anything over there.
It is optional.
Finally, add attachments.
You can add to your video or screenshot over here.
I recommend attaching videos for each and every one lability that you found.
Now, the last step is just ahead on this report.
So you're not going to submit a blank report right now.
Obviously, this is an invalid report.
But but just to show, you guys have submitted a report.
After that, you have to go into your submission stat and you can see the vulnerability that has been
reported over there.
So the vulnerabilities exist on transfer of Wired.com.
And the category is Vetri, the one level it is new for now.
As soon as this is accepted, it will become, as we can see, it is impending double.
As soon as it is accepted, it will come over here.
Accepted one.
If it is rejected, it will go a year.
Obviously, this is going to get rejected, it is going to go here.
If it is a duplicate of any other venerability, it will go year.
Collaboration means if two people have followed this vulnerability, then it will go into the collaboration's
and the bounty will be split between both both the two researchers.
The last thing is invitations.
Invitation's in.
You get private invite to your account.
If you want valid vulnerabilities onto this program, you get private invite.
So what are private invites?
We're going to discuss it.
Let's first click on the submission that we have made.
As you can see, this is the reference.
No reference number helps you guys a lot.
Whenever you have, you are stuck onto any report or the support or the program, one that is not replying
or they are not able to understand the scenario that you have reported.
Or basically if there is any misunderstanding, you can just take this reference number and you can
report to the support of Backroad.
They are pretty awesome and they reply in a very quick time frame and they will help you resolve your
query.
Cool.
So as you can see, the target location is this.
But I repeat, read the report.
OK, so I have made a blind report obviously on 22 April so you can see everything from your submissions
tab.
So for now, what I'm going to do is I'll go to Beaminster and you can see my upcoming payments are
nothing I can set up your people.
This is a leader board and the leader board.
You can see top security researchers.
Let's go to crowd streams.
Crowd Stream is a new feature which has been implemented by background very.
You can try to report read the report.
Let's go to the invite step wherein you will get some private invites, what I was talking about.
So basically private invites are invites for some special programs which are not public.
So a limited security researchers will be holding on that program, which means the scope is more for
you to hunt as there are less people hunting on that program.
Perfect.
You can fill up your details over here.
If you have done any certification credentials, your personal details, if you want to update in the
account, you can just update your password details.
What kind of T-shirt size do you have?
Let's say I put our elsewise.
You can put your address, whatever you want to do.
This is deactivate account in the payment details, any of the payments you have.
If you have, you can connect your people over here.
There are two options for payment on backroad.
First is the people and second one is the buyer need.
I prefer PayPal.
OK, so perfect here you can see whenever you try to log in, it will create a session.
You can see what their last option is, identity verification.
You can verify your identity because some programs need compulsory identity verification.
So you can do that if you want to hunt for some programs last of the support, you can just try to contact
the support if you are facing any issues onto the platform.
So you can just drop an email at a researcher and read background dot com wherein you will be supported
very quickly.
OK, so I hope you understood a lot of things over here, the last option is the dart board, which
makes your eyes a little cool so you can hunt vulnerability's at night time.
Also, this white plate will not reflect for you guys.
So, yeah, I'll just again go to the program features.
You can see there are a lot of programs which you can hunt for and you can start hunting and all the
open programs.
So let me just try to search for TripAdvisor as we already found an exercise into our videos.
And yes, this is a program on background.
I already reported this vulnerability on TripAdvisor and have been awarded with a bounty for this vulnerability.
So no need to submit that vulnerability as it will go in duplicate.
OK, so this is how basically you do bug bounty hunting on backroad dot com.
So this video was the roadmap for doing bug bounty hunting on background, wherein I tried to explain
each and every functionality of backroad, how to navigate and how to submit valid reports.
So I hope this video helps you guys in hunting onto this platform.
Thank you.