> For the complete documentation index, see [llms.txt](https://shohamshilo.gitbook.io/shohamshilo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shohamshilo.gitbook.io/shohamshilo/vulnerability-research/bug-bounty.md).

# Bug Bounty Notes

Notes and lessons from working public bug-bounty programs. I keep specifics sanitized — programs and unfixed issues stay anonymous — and focus on method and takeaways.

## My approach

1. **Read the policy first.** Scope, out-of-scope, allowed techniques, and disclosure terms. This is non-negotiable and shapes everything.
2. **Recon wide.** Map the attack surface with [SubBuster](/shohamshilo/projects-and-tools/subbuster.md) and [recon-os](/shohamshilo/projects-and-tools/recon-os.md) before touching anything.
3. **Pick the soft targets.** Forgotten subdomains, legacy apps, and inconsistent auth are where the bugs usually are.
4. **Test manually.** Understand each app rather than spraying payloads. Manual testing finds the logic flaws scanners miss.
5. **Write it up properly.** A clear, reproducible report is what gets a bug triaged and paid — same discipline as [engagement reporting](broken://pages/KuiIPEGXcD7Ft9gYrplc).

## Lessons learned

* **Recon depth beats exploitation cleverness.** Most of my best leads came from finding something other people overlooked, not from an exotic exploit.
* **Severity honesty matters.** Inflating a finding wastes triagers' time and burns trust. Rate it like it is.
* **Reproducibility is everything.** If a triager can't reproduce it from your report, it doesn't get fixed.

## Template I use for submissions

```
Title:        <clear, specific>
Target:       <in-scope asset>
Severity:     <CVSS + rationale>
Summary:      <one paragraph: what & why it matters>
Steps:        <numbered, reproducible, with evidence>
Impact:       <what an attacker gains>
Remediation:  <concrete fix>
```

> As I get write-ups cleared for publication (disclosed or sanitized), I'll link them here.

***

➡️ Back to [Vulnerability Research](/shohamshilo/vulnerability-research/research.md) · See also [Write-ups](/shohamshilo/write-ups/writeups.md)