All right, we came towards the end of the course, and now is the time to discuss, well, how can
we earn money with the skills that we learned?
Is it something that we can monetize or is it just additional knowledge that we gained?
Well, let me tell you, you can monetize bug bounty and you can monetize it really well, depending
on how good you get.
But before we talk about where and how to do it, let's figure out what the next steps are before we
get to earning money with the skills that we learned.
Well, picture it like this.
This arrow is your path.
At the beginning of this arrow is you a bug bounty hunter that just finished this course and at the
end is you earning money from bug bounty.
The only thing that's in between is practice.
There is a lot of practice waiting for you to really master this skill.
The only way to get comfortable with bug bounty is to perform all the attacks recovered numerous times
on different applications.
You might also discover some new vulnerabilities in the meantime that are also useful to know.
You can learn more about bug bounty through various different websites, courses, books and bug bounty
programs.
Once you do that, you're ready to hand down your first bug.
OK, let's say you are ready and you practiced and feel comfortable doing bug hunting.
Well, what now?
Where can I submit my bugs and earn real money?
OK.
Have you noticed how I mentioned something called Bug Bounty Program?
Well, there is your answer.
There are numerous online platforms that host different bug bounty programs that pay real money.
How exactly does it work?
Well, it's based on different companies applying on the platform for bug bounty programs regarding
their website, their application or software.
On the other side, there are hackers that also applied for that same bug bounty program, and their
goal is to find the bug on that company's product.
First thing they do is accept terms and conditions and rules for that bug bounty program.
After that, if they fulfilled the requirements, they're allowed to explore for vulnerabilities on
that Web site.
For example, if they find a vulnerability, they are then rewarded with a payment, which can be different
depending on the vulnerability severity.
Once the counter gets paid, the company then patches the vulnerability and it is no longer vulnerable
to that attack.
It's simple as that.
But listen, there are some important stuff here to mention.
Remember when I said that hacker accepts terms and conditions and rules before he enters bug bounty
program?
Well, these terms and conditions are not something you want to skip, like you keep them on every other
website here.
They are really important.
For example, in the bug bounty program rules, it could say that certain types of attacks are not allowed
or that certain domains are not for targeting.
It could, for example, have a rule that those attacks are not allowed, which is a common bug bounty
program rule.
If you don't bother reading those rules and you do what you're not supposed to do, like running a business
attack, for example, well, then you can get in trouble for doing something that you're not allowed
to do.
Nonetheless, I'm sure all of you will follow the rules and there will be no problems with that.
Now that we covered how earning money with bug bounty works, let's mention a few platforms that are
hosting bug bounty programs.
We have hacker one back crowd integrity, Sinak, and there are others, of course, but these are one
of the most famous ones.
Let's go on one of these to see how the Web page looks like.
OK, I've chosen to show you the crowd.
It's one of the biggest platforms for bug bounty programs, and you can find it at the link of big crowd
dot com, or you can simply just type a crowd in your search bar.
Once you do that, let's navigate to their Web page and see what they have to offer and how all of this
stuff works.
So the first page that it opens will be this one where you will have this how it works.
But you can click on that and you can read more about bug bounty programs and all of that.
Of course, we are not going to go through all of this.
You have an explanation how it all works, but that is something I leave up to you to read.
Another useful thing that you have and that you will notice in the upper right corner is this researcher
portal and customer Porter.
What is that?
Well, you can create account for two different situations.
Either you're a security researcher or a bug bounty hunter or you're a customer or a company that wants
their product to be tested for bugs.
That's how you would register accordingly as a bug bounty hunter who would go to researcher.
And we can also click right here on researchers to read more about that.
If we scroll a little bit down, let's see if there is anything interesting here to say.
So we have a few different programs, bug bounty penetration testing, vulnerability disclosure, attack,
surface management, you can also learn even more and upgrade your skills with different programs.
But that is also something that I will leave up to you.
Now, let's get to the important stuff, and that is these programs.
If you click on programs, it will open this page with all the different bug bounty programs that this
platform offers.
And you will notice there are some really big companies out here.
We have Kashyap.
We have up work.
We have let's go all the way down into Georgia and you get some of the information about certain bug
bounty programs right here, for example, how much they pay, it says downhere managed by Foulkrod.
So let's take a closer look at one of these programs.
Let's go with APOC now.
Opfer is the big platform.
It's a freelance platform.
And let's see, what do they have to offer us and how exactly does their bug bounty program look like?
Remember, there are few important stuff that we must take a look at before actually applying for any
bug bounty program, and that is their terms and conditions and roots.
So up here, we will get that they're paying up to five thousand dollars for an ability and it can also
go up to ten thousand dollars of maximum reward.
Now, you will see later that the actual amount that you get paid is based on the severity of the vulnerability
that you found.
Let's go all the way down.
We have special bonuses and rewards you would actually want to read through all of this if you were
to apply for this program.
On the right side, we have how much vulnerabilities are reported.
So four hundred and seventy.
And the average payout was six hundred and forty eight dollars.
Now, if we go even more down, here is the important stuff.
Scope and rewards.
Here you will have the description of what exactly are you going to, let's say, perform a penetration
test on or try to discover bugs, they will tell you which application it is, which domain it is,
what you're allowed to do.
And up here, we also get how much they're willing to pay per vulnerability.
And you will notice these signs right here, green for orange, three red P2 and.
Or is this orange?
I'm not sure this could be yellow P three, orange two and red P one.
Now, we'll discuss that in just a second, but let's scroll a little bit more down and here is also
important stuff out of scope targets.
These are the targets that you are not allowed to perform penetration tests on or discover box.
If you do so, you can get in trouble and you can get removed from the program and not rewarded at all,
and that is the easy way out.
You can also get sued, but hopefully you will read through all of this information before applying
for any bug bounty program.
Down here, we have ratings and rewards and we also have requirements.
This is also important to read before applying.
They want the user to participate in the apropo bounty.
Please configure your scanner to include bug crowd in the user agents.
Trink failure to do so may result in your IP being temporarily blocked from participation in the program.
Access your account, you can self register for an account in the API using your background ninja dot
com, email address, testing, using any other account is out of scope.
So this is also some important stuff.
Down here, we have target information, access and credentials exclusions and to really understand
these vulnerabilities.
You can scroll all the way down and down here.
You will have program rules.
This program does not offer financial or point based or four for five informational findings, which
is probably information gathering vulnerability or information disclosure.
And here you will have the list of different vulnerabilities and also how they are rated by severity.
So here you can take a look at what different vulnerabilities belong to P one technical security or
the highest severity.
So we have a injection Xixi remote command, execution command, ejection, disclosure of secrets and
many more.
You can read through all of these different vulnerabilities to understand what level each vulnerability
is.
OK, awesome.
And that is pretty much all you need to know to start with background.
Nonetheless, we are at the end of the course, there is a lot of practice still awaiting you to really
master this field, which I'm sure you will.
Everything else is on you.
If you have any additional questions, feel free to ask and we will be more than happy to answer.
Thank you for watching and happy hacking.