The community
Inside people ask, share what they found and solve together what would block anyone on their own. It's free to join: no account, no plan, no email required.
Free and open. You don't need a BBLABS account to join.
Everything you need to build a professional bug bounty setup: from choosing your operating system to automating reconnaissance.
BBLabs
Security Researcher
Stop reading about bugs and start hunting them
No card · free Academy · cancel anytime
The first step is picking an operating system that lets you work comfortably with security tools. The most popular options are:
The best-known pentesting distribution. It ships with hundreds of preinstalled security tools. It's ideal if you want to get started fast without configuring too much.
# Update Kali after installing it
sudo apt update && sudo apt upgrade -y
Similar to Kali but lighter and more privacy-focused. It includes development tools on top of the security ones. A good alternative if your machine has limited resources.
If you prefer total control over your setup, you can start from a clean Ubuntu and install only what you need. This option is ideal for cloud environments (VPS).
If you use Windows or macOS as your main system, you can run any of the above in a VM with VirtualBox or VMware. The upside is isolation; the downside is performance.
This is the fundamental tool for bug bounty. It works as an intercepting proxy and lets you analyze, modify and replay HTTP requests.
# The Community edition is free
# Download it from portswigger.net
# The Pro version (~$449/year) is worth every cent if you do this seriously
Must-have Burp extensions:
# Subfinder - Subdomain enumeration
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
# httpx - Live host probing
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
# Nuclei - Template-based vulnerability scanner
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
# ffuf - Fast web fuzzer
go install github.com/ffuf/ffuf/v2@latest
# Amass - Advanced subdomain enumeration
go install -v github.com/owasp-amass/amass/v4/...@master
# gau - Fetch known URLs of an application
go install github.com/lc/gau/v2/cmd/gau@latest
# waybackurls - Historical URLs from the Wayback Machine
go install github.com/tomnomnom/waybackurls@latest
# gf - Filter patterns in URLs (XSS, SSRF, SQLi, etc.)
go install github.com/tomnomnom/gf@latest
# qsreplace - Replace query string values
go install github.com/tomnomnom/qsreplace@latest
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
Install these extensions in Firefox or Chrome:
Keeping organized notes is crucial. Build a structure like this:
📁 Bug Bounty
📁 Programs
📁 Program_X
📄 Scope and rules
📄 Recon (subdomains, endpoints)
📄 Vulnerabilities found
📄 Reports submitted
📁 Techniques
📄 IDOR
📄 XSS
📄 SSRF
📁 Tools
📄 Cheatsheets
📄 Custom scripts
For each program, create a directory with this structure:
mkdir -p ~/bounty/program_x/{recon,vulns,screenshots,notes}
# recon/ → Subdomain, port and URL results
# vulns/ → Vulnerability evidence
# screenshots/ → Screenshots
# notes/ → General notes
Create an initial recon script that you run for every new target:
#!/bin/bash
# recon.sh - Basic automated reconnaissance
DOMAIN=$1
OUTPUT=~/bounty/$DOMAIN/recon
mkdir -p $OUTPUT
echo "[*] Enumerating subdomains..."
subfinder -d $DOMAIN -silent | sort -u > $OUTPUT/subdomains.txt
echo "[*] Probing live hosts..."
cat $OUTPUT/subdomains.txt | httpx -silent > $OUTPUT/alive.txt
echo "[*] Fetching known URLs..."
cat $OUTPUT/alive.txt | gau --threads 5 > $OUTPUT/urls.txt
echo "[*] Scanning with Nuclei..."
nuclei -l $OUTPUT/alive.txt -severity medium,high,critical -o $OUTPUT/nuclei.txt
echo "[+] Reconnaissance complete for $DOMAIN"
echo "[+] Subdomains: $(wc -l < $OUTPUT/subdomains.txt)"
echo "[+] Live hosts: $(wc -l < $OUTPUT/alive.txt)"
echo "[+] URLs collected: $(wc -l < $OUTPUT/urls.txt)"
chmod +x recon.sh
./recon.sh target.com
Configure your browser to route traffic through Burp Suite:
127.0.0.1:8080You don't need every tool from day one. Start with Burp Suite, subfinder and httpx. Add tools as you need them. The most important thing is developing a consistent methodology and keeping your notes organized. The perfect setup is the one that lets you be efficient and not waste time hunting for previous results.
hunters training
labs from real hacks
completions
paid out for these bugs
Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime
Burp Suite tutorial from scratch: what it is, installing and configuring the proxy (127.0.0.1:8080 + CA certificate), Proxy/Intercept, Repeater, Intruder, Decoder, useful extensions, Community vs Pro and a real hunting workflow.
Step-by-step sqlmap tutorial: detect and exploit SQL injections with -u, list databases with --dbs, dump tables with -D/-T/--dump, automate with --batch, tune --level/--risk, evade WAFs with tamper scripts and reach --os-shell. Always within an authorized scope.
ffuf tutorial: fuzzing directories, subdomains/vhosts and GET/POST parameters, how to filter noise with -fc/-fs and calibrate with -mc/-ac, SecLists wordlists and when to use gobuster or dirsearch as alternatives.