How to Crush Bug Bounties in the first 12 Months

[@YuriFsilva20]

after 1 mouth studying I decided to really look for the bugs and in 1 one mouth I found 3 types of bugs in one website, and today I found another in other site, if you study everyday and really look for the bugs you'll find it

[@senlin9414]

You found the bug after only studying in cybersecurity for a month?

[@YuriFsilva20]

@senlin9414 Yeah, it's really easy to find, actually. Start with simple bugs that they forget to look for because they think it's not so important

[@senlin9414]

@@YuriFsilva20 thank you！

[@GMk__]

@@YuriFsilva20 bro i just started too. can i reach u from somewhere? maybe we can collaborate and share our knowledge to each other

[@aspirant-uy8lv]

​@@YuriFsilva20hey actually i am a total newbie to this. I wanna become a bug bounty hunter. I am at square 0. Can you pls give me a roadmap to follow or rather what you did??

[@ransomhades]

Man this dude is speaking the truth that everyone needs.

[@sul3y]

Damn right, he literally know every aspect of this topic.

[@WildberryAB]

I had no idea what a bug bounty was. I was in the bathtub when this video came on and I didn't want to get out so I just listened. What ensued is hands down the best and most useful psychological and motivational advice I have ever heard in my life. So while I may never be a bug bountier, I want to thank you so much for your words. You are brilliant. I have been procrastinating forever and will not start anything, but now I know how to begin for real.

[@hakluke]

Wow that is so great. I really appreciate you leaving this comment. It's made my day! If you like that, I've posted some other non-bug-bounty stuff on my KZbin channel that you'll probably like also!

[@trieulieuf9]

Dude, lol.

[@azersd6778]

@@whatevermusiciwant I don't think he did xd. anyway I'll leave this here so hopefully in one year someone will comment and check on my state like u did to @WildBeerry xd I'm starting my journey in bug bounty now 2022/05/06 with no 0 experience I'm a computer science student, All I know is just some coding and Linux. Wish me luck passengers ;)

[@amit-mishra]

@@azersd6778 Ok I like this idea I would also do a date punching let's see what happens one year later. Date 7/08/2022

[@maheshchaudhari5869]

@@azersd6778 2 months left make it happen

[@hakluke]

Hey!

[@hackersden6817]

Osm man i love it ❤

[@wrx-qs8be]

Thank you so much for this :) ! And thanks to the community

[@shrirangkahale]

Hey!!

[@amitabhmondal1298]

Such an amazing video, the depth that you go into for these topics really adds a human touch to this content. Thank you :)

[@BabarKhan-nv9es]

Thanks mate for the time and experience sharing

[@majamoore6209]

Your whole point on the fear of starting was so well articulated. I have been suffering from this, but have not been able to identify and articulated it. Thanks for the pep talk!

[@DashDapper]

5 minutes in and this is exactly what I needed to hear.

[@jenniferwood4916]

I'm just gonna save the pep talk at the beginning for all the times I get down on myself lol

[@oghenejivwe3605]

Thanks for this talk..I learnt alot. I started bug bounties in Jan, doing it part time though.. haven't gotten any bounty yet! But contents like this keeps me going

[@rwa9573]

Now do you get any bounty or not?

[@metua]

What about now?

[@oghenejivwe3605]

@@metua lool.. been off for a while bcus of cryptocurrencies.. if I get back to bounties now, the motivation would be fun not money

[@shockblockjohnson4599]

One thing that doesnt get discussed is the legal risks involved in doing bug bounty. How do you protect yourself legally?

[@orionblu3]

@@shockblockjohnson4599 stay in scope

[@i_am_ahacker]

The talk i desperately needed thanks Luke and everyone..

[@lukejstephens]

Awesome :) No worries!

[@ethisfreedom]

@@lukejstephens imposter

[@domss1174]

I wish luck to all the future bug bounty hunters. it is a tough road. I've spent 1 year trying my best to get bounties but only got dupes, Idk if I'll get at it again, it takes a LOT of time xD

[@perrymaclamjr2711]

Would you do it the same way you have been, or would you do something different?

[@hakluke]

If you decide to get back into it - I think I know what would help, DM me somewhere :)

[@TJay145]

1 year later, I'm in a similar situation. I want to start again but it seems so daunting

[@deshyvin]

Dupes mean you did find a vuln though. Keep your head up. The first year or two are all about training and exp. That same vuln might not have been found yet on a newer app. As well as if it's a simple exploit you can cross it off your list of capabilities and start to progress on more complex pursuits

[@vincenthan8156]

This is the best talk I have found on KZbin! Thanks.

[@hakluke]

Thank YOU!

[@vijaynariyal9818]

i think , my starting goes wrong before viewing this. such a inspiration video for me to build my bug bounty career.

[@Timm2003]

Thanks, it helped me a lot! Its more motivational than any of these business guys who tell to start with anything and get rich fast.

[@binswifa3373]

I was shocked when he say " log out from KZbin and turn off your phone" i was like telling me " drop out from university " All in all good stuff bro, as always

[@hakluke]

Thanks Bin!

[@KeithLburns]

Well if say drop out of university

[@hydroflows]

I've been comfortably and consistently doing bug bounty related work for two straight weeks now for 10+ hours a day. I'm starting my third week with a realistic glimpse into the world I'm diving into :) I'm in love with this work. It's incredibly fun and it compliments my insatiable need to figure something out. Not to mention, security research is exactly why I got into computing in the first place and that was in 2015. I've worked for so long to learn the basics and now I'm finally here soaking everything up like a kid at Disney World. Like I said, I'm in love, and I can't get enough of it. I'm excited for the year ahead.

[@hakluke]

I know the feeling you're describing :) It's great! Ride the wave!

[@nickthiru]

You are actually describing me and my situation! haha. It's a great feeling, yes! Congrats! When you mention the basics that you were learning from 2015, could you share what you were learning? Thanks!

[@domaincontroller]

08:56 the bug bounty hunter methodology v4 09:50 web application hacker's handbook 10:37 pentesterlab 38:12 kubernetes, message broker, reddis, mq rabbit, axiom (pry0cc)

[@GameSmilexD]

ty sir

[@faizalqorni7969]

do you have the video for the application analysis by jason hadix

[@ThingEngineer]

One possible way to avoid burnout, diversify. I find that freelancing developing web applications is a great distraction and it gives you the chance to apply your unique skill set as well as learn more about your targets. Then you can turn right around an offer cyber security services to your new web application client.

[@mianashhad9802]

Great idea! That's what I have got in mind as well. I want to make some income alongside completing my degree.

[@immortalgaming3228]

I came to learn how to get started with bug bounty but in addition to it I ended learning how to live a life.

[@shantanudash7]

Really good talk. Was really motivated and provided a lot of guidance.

[@user-su7fr5jv5t]

Very good and informative talk. Thank you for taking the time to make it.

[@hakluke]

Anytime :)

[@AndrejMoharWeb]

Beautiful talk! Extremely informative ideas, the automation part really got me thinking...

[@hakluke]

Thanks Andrej :)

[@himanshuchavda9852]

great

[@himanshuchavda9852]

great

[@himanshuchavda9852]

great

[@himanshuchavda9852]

great

[@TomHimanen]

Thanks for reminding me of Netflix. I was gonna start bug hunting but then I remembered that I just need to bingewatch the last season of The Queen of South. 😎

[@GrinderLewis]

Damn, he is spitting the fact🔥 Thanks, g!

[@Bugcrowd]

🙌

[@razorednight]

He said "Turn off KZbin," so I turned it off... and now I don't know what he said next!! 🙃

[@TheJacampb]

"Forget everything you know about slip covers!" so I did!

[@maven6093]

Ran to comments to say this but u beat me there :(

[@udayshelke21]

🤣🤣

[@MokshitKalRa]

How did you wrote the comment !! 🙃

[@ToThoseWhoVanished]

Then you turned yt on n wrote this comment.

[@humanflybzzz4568]

Hey there, thanks for sharing guys..... Could you give us newbs some advice about how not to drift out of scope during a bounty hunt? I realy think that would be valuable to a lot of folks.

[@hakluke]

If you're using burp suite, you can set the scope there. That's a good start.

[@aporcescu]

Great speach, everything was explained nice an clear. However, may be I missed it, how do you actually monetize your findings ? Was explained where to start, to be consistent.. but didn't quite understand, what do you do with your findings ? For example, you are scanning an application for vulnerabilities. You found one. What do you do with it ? Do you sell it (where !?), do you publish it somewhere and wish somebody just pays you, you alert the application company and pray for a paycheck ?(what if they were not ok with you sniffing around :) ) A little bit more explanation on this topic would be wonderful

[@deshyvin]

Feel like utube is not letting me answer you

[@batuhanbatuhan6445]

I have been listening to the guy for 42 minutes he said from zero to expert at the beginning yet he didn't explain what does a bug bounty hunter actually do to get paid. He talked super confident about the income I don't get it. Isn't each bug custom? How can you automate it? If it is as easy as what an automated piece of software get it why don't do companies do it? I thought you would do recon and try break something in a way the developers couldn't think of and then break it in a way that would concern the company enough to pay you for keeping quiet until they fix it. How can you automate that? I was expecting to hear about different kinds of attacks and attack surfaces etc. He hasn't touched the core of it yet. Give us the honey bro. Dealing with where to keep the logs of the recon is vanilla.

[@cywer5920]

The honey is that you have to search it for yourself. Being a bug hunter is all about research and researching should be one of the things on top of the list. He mentioned PentestersLabs and other resources and people to learn from but the bread and butter all begins with you doing your research on what works for you.

[@Inexizp]

he basically gave you the mindset.. and some tips. like learning to automate some bugs into your recon phase on the target. the honey is everywhere you just have to get it hackers on twitter LinkedIn and info-sec community they keep on sharing great tips you'll have to connect the dots of course But how can you do that when you burn out or run away from the things you don't know and yet procrastinate repeatedly. blogs write-ups bug reports are everywhere BUT the Support and the feeling of being able to learn from them and build your own way through it is what makes great from average

[@aleph_prime]

Those "phases" are totally a matter of perspective. The guy didn't predict anything at all. Also, being Bugcrowd employees it's hard to really take all this information and run with it. I mean he even says he hit his goal after getting employed by Bugcrowd. I'm sure cows think milk is great.

[@gickygackers]

I think this is the attitude of a 6 figure salary

[@محمّد.09]

Automation of happy birthday was funny.

[@true_tamilan]

you truly. motivated and ironically it still lasts after 4 hrs

[@weldmaster80]

Hackers always have the best names

[@AustoAU]

I like that the sign keeps getting flipped haha

[@KeithLburns]

Same

[@tisper1]

That was bloody sensational

[@stevejones371]

Wow - what an honest presentation of your knowledge! Thank you and God bless ALL of your endeavors.

[@Najumulsaqib]

Kudos Hakluke. You nailed it!

[@hakluke]

Thanks Najam!!

[@zer0k4ge]

Slow and steady wins the race.

[@محمّد.09]

I realised it very late.

[@Thiago1337]

That's a duplicate

[@geronimoswolf]

thanks mate, wish you all the best!

[@hakluke]

Same to you :)

[@sinwolf5539]

Great talk Luke !!!

[@hakluke]

Hey! Thanks SinWolF I hope you're well

[@NicholasMarkovich]

Fantastic guide. Could be bolstered with some additional resources to guide newcomers on how to do the things you've recommended.

[@SamarthVerma188]

Thanks hakluke for the video I got a great guidance from you

[@hakluke]

That's awesome! no problem!

[@nickdelgado1]

Great talk...very informative and helpful!

[@tomdwane7821]

Such a beautiful soul. Thank you Luke

[@rushi123ful]

Thank you Very Much for this Video..its really great and informative..keep it coming :)

[@hakluke]

Thanks Rushi!

[@ritiktrivedi3789]

I don't need money from this field I just love to do so I'm learning ❣️

[@Man0fSteell]

thats cute. send me the money then if dont want it :)

[@fearzzzz]

Nice one, good talk.

[@h4ck0rman]

This guy did his target audience research

[@hakluke]

:)

[@anas1r]

Great talk. By the way how many of us noticed @cje at 1:14:41 lol :)

[@Thescienceworld652]

hey , i started this video right now ,. before that i want to tell u i am exploring this field since last 2 years but did not get a single vulnerbility in any target website.

[@ralphruiz7784]

Thank you so much for sharing!!!!

[@abdullahtanveer316]

everything you said about "fear of starting" I'm experiencing almost all these things these days.. I always think is it worth to invest my time in this or I should do something else that can help me earn handsome amount to bare my educational expenses. I'm just stuck at starting point..

[@techsahabi1725]

THANKS #HAKLUKE...Amazing suggestions....I am starting from may 12 ,2022....Let's see what I got...

[@parthdeshpande6767]

Hows it goin dude

[@cassling2891]

Nice weed plant 😙☁️

[@DLEET.Channel]

Great video Man

[@marios4275]

Στην υγεια σας.

[@rooney.46]

Love you man 💕

[@hakluke]

Aw shucks! Love you too!

[@steez4778]

ive seen the pfp in some homebrew community i swear

[@n1yesuh809]

Thank you

[@hakluke]

No worries

[@PIYUSHBEDI-t1s]

Some great hackers to follow 12:25

[@msrobot_]

When you say "zero", you mean "zero zero" or just "zero"?

[@seanmcelroy5825]

This is awesome!

[@hakluke]

Thanks Sean!

[@constatineb7065]

great talk! Thanks!

[@ulfp8025]

Hello, i have Done some both udemy and labs Trying to start bug hunting but as soon as I get on a real target I get overwhelmed and don’t know how to proceed

[@camelotenglishtuition6394]

But what about the fact most programs dont allow automation?

[@hackerexploit8957]

I might not do bug bounties, but this definitely helps with pentesting, if im not interested in bug bounties. But maybe, later on, sounds pretty interesting.

[@newbiadk]

so much information

[@razorednight]

He said "Turn off KZbin," so I turned it off... a

[@thereal6954]

i do the same !🙂

[@lukAndreas]

Hi, there is a bug in the description. It shows Katie's KZbin instead of Luke's. ;)

[@793matt]

Skip the pep talk 8:19.

[@danielrdrigues]

Is a good thing focus in just one category? Example, web servers?

[@SrRunsis]

What video-call software are they using in the talk??? its so smooth

[@SecretLetters]

Hey there's audio in this one! 😆

[@hakluke]

I find that audio does help to understand what's going on ;)

[@obscenity]

yeah the sync is way off tho

[@saddam5259]

keep it and thanks for sharing i am flowing u...

[@thebrotherhood1675]

push up explanation may need some sport science expertise, everything else was mint nice one

[@tess9512]

Love you Bugcrowd ♥️

[@Alex-oh6lj]

Can someone explain how Python Wrappers work? I want to automate this stuff but I have no clue how to do that. Thanks.

[@hakluke]

basically you use python to run a bash command to execute another tool, and parse the output as text

[@sarunkim6096]

Hello sir , Can I use IMac to find bug bounty ?

[@caseyellis5663]

was "how many background combo's are there in hakluke's talk" one of the ctf questions?

[@lvzodiac3161]

Hai brother... I have studied owasp but i don't know how to implement.. And want to start bug hunting...

[@hakluke]

this was 3 months ago - where are you at now?

[@elmi108]

What steps to take to create my own automation ?

[@haksting]

My FOS is that I will do something wrong like DOSing target or mess something.

[@hakluke]

If this is scaring you, maybe just stick to programs with full safe harbour and don't do DoS attacks.

[@BabarKhan-nv9es]

There are lot of people out there that are so full of energy that they say that we mess something but at least we learn something 😀😀😀( by messing mean harming the traget unintentionally)

[@Knightfallprotocol444]

Question for you Mr.HakLuke , when it comes to automation is this something you achieve with python? what do you recommend?

[@hakluke]

Python is great for this :)

[@gickygackers]

Python is amazing. Use it now!

[@elmi108]

@@hakluke what steps do I need to create my own Automation tool if am good with python but new in Bug Bounty industry

[@bobhrobor4654]

1:16:45 starting: education ( *Jason headaches stuff, pentesters lab, web apps handbook, Twitter community* ) 1:22:00 +/- idea 1:24:30 _new points of view_

[@akbare-z815]

Thanks

[@SecurityTalent]

Great bro

[@lazarep1]

Does anyone know where i can find the application hacking version of bug bounty hunter methodology

[@hakluke]

I actually don't think it ever got released! Jason had to pull out of doing that talk.

[@shehanperera1437]

Do I need a kind of computer deggre to work as a bughunter or my skills are enough?

[@hakluke]

You don't need a computer degree to learn about hacking, many great hackers are self-taught.

[@Bharath-wb8uy]

Thank you buddy.

[@CyBertronSecK]

hey can you guide me on automation?

[@GeniusFranklyn]

@hakluke do mean starting from zero zero, like a total dummy beginner in Bug Bounty because i don't know how to start and what to do.

[@anurag.30302]

watch nahamsec's recon videos do portswiggers lab and some ctf you will get your way

[@astrix8812]

Awesome thanks for sharing! Btw, What's the into music name?

[@hakluke]

I totally chose that music! It was some stock one that I bought, I can't remember the name.

[@astrix8812]

​@@hakluke No problem. Great music choice as well! Keep rocking and inspiring :D

[@taiquangong9912]

So before I began bug bounties should I master the techniques first or do that as I bug bounty??m

[@Najumulsaqib]

Music is epic

[@hakluke]

:)

[@Najumulsaqib]

@@hakluke Can I ask which music is it?

[@mindovermatter1116]

Hi does anyone know where the Jason Haddix v4 Application hacking is uploaded?? I already saw the v4 recon....

[@davidpandolfo]

kzbin.info/www/bejne/pmWtmHyrZtKWm6s

[@yusufdomun303]

This guy is amazing !

[@Alfonso013]

im bachelor in Netcetcentric Computing.. but i do not see any of use for bug bounty and i dont how where to start it.. can u help me?

[@ZarakKhanNiazi]

automation means i keep burp pro scan running??

[@szmigiellus]

I got solidly called out in the very first 5 minutes 💀

[@alharosh]

Hello to you, am absolutely zero knowledge do you think i can do it, even if i have no back ground of Software. thanks

[@vasanthk3633]

Yes you can

[@kthiriomar7464]

hey i just scan the qr code of the intro and i enter your website and i can't find the flag 😟, any hint ?????

[@Man0fSteell]

why do u keep changing ur background elements?

[@jaydevsolanki1047]

You forgot to mention the most important tip that "be prepared for the truth that not everyone can learn bug bounty". Thanks 😊