Bug Bounty Hunter Roadmap

Phase 1

Fundamentals

Fondasi wajib sebelum mulai hunting. Pahami ini dulu sebelum lanjut.

01

Pengenalan Cyber Security

CIA Triad, tipe ancaman, ethical hacking, dan kenapa cyber security penting

02

Apa Itu Bug Bounty?

Program bug bounty, cara kerja, reward, perbedaan dengan pentest, dan peluang karir

03

Kamus Istilah Bug Bounty

40+ istilah lengkap dari A-Z yang wajib diketahui setiap bug hunter

04

HTTP/HTTPS Protocol

Request/response, headers, cookies, sessions, status codes

05

HTML, CSS & JavaScript Basics

DOM manipulation, form handling, client-side logic

06

Networking Basics

DNS, TCP/IP, ports, subnets, proxies

07

Linux Command Line

File system, permissions, bash scripting, SSH

08

Bagaimana sebuah web bekerja?

Frontend vs backend, APIs, databases, authentication flow

09

Basic Tools Bug Hunter

Burp Suite, ffuf, subfinder, nuclei, sqlmap, dan tools wajib lainnya

10

Panduan Lengkap Burp Suite

Setup, Proxy, Repeater, Intruder, Decoder — kuasai tools paling wajib ini

Phase 2

Reconnaissance

Kumpulkan sebanyak mungkin informasi sebelum menyentuh target.

01

Subdomain Enumeration

Subfinder, Amass, crt.sh, brute-forcing subdomains

02

Port Scanning

Nmap, Masscan, identifying running services

03

Directory & File Discovery

Dirsearch, Gobuster, ffuf, wordlist selection

04

Technology Fingerprinting

Wappalyzer, WhatWeb, identifying CMS and frameworks

05

Google Dorking & OSINT

Advanced search operators, Shodan, Censys, archived pages

06

JavaScript Analysis

Finding endpoints, API keys, and secrets in JS files

Phase 3

Common Vulnerabilities

Vulnerability paling umum dan paling sering ditemukan di bug bounty.

01

HTML Injection

Tag injection, phishing form, attribute injection, perbedaan dengan XSS

02

Open Redirect

Redirect bypass, OAuth chaining, protocol-relative URL tricks

03

Cross-Site Scripting (XSS)

Reflected, Stored, DOM-based XSS, filter bypass, CSP bypass

04

SQL Injection

Union-based, blind, time-based, error-based, second-order SQLi

05

Server-Side Request Forgery (SSRF)

Internal service access, cloud metadata, protocol smuggling

06

Insecure Direct Object Reference (IDOR)

Broken access control, horizontal/vertical privilege escalation

07

Authentication Bypass

Broken auth, JWT attacks, OAuth misconfigurations, 2FA bypass

08

Cross-Site Request Forgery (CSRF)

Token bypass, SameSite cookies, clickjacking chains

09

File Upload Vulnerabilities

Extension bypass, content-type tricks, webshell upload

Phase 4

Advanced Techniques

Teknik lanjutan untuk menemukan bug yang lebih kompleks dan bernilai tinggi.

01

Race Conditions

TOCTOU bugs, limit bypass, double-spending in web apps

02

Deserialization Attacks

Java, PHP, Python deserialization, gadget chains

03

Template Injection (SSTI)

Jinja2, Twig, Freemarker, server-side template exploitation

04

GraphQL Attacks

Introspection, batching, injection, authorization bypass

05

API Security Testing

REST/GraphQL fuzzing, broken object-level authorization (BOLA)

06

Business Logic Flaws

Price manipulation, coupon abuse, workflow bypass

07

Subdomain Takeover

Dangling DNS records, cloud service takeover

Phase 5

Reporting & Bounty Platforms

Bug yang bagus tapi dilaporkan dengan buruk tidak akan menghasilkan apa-apa.

01

Writing Good Reports

Clear title, reproduction steps, impact assessment, PoC

02

Bug Bounty Platforms

HackerOne, Bugcrowd, Intigriti, YesWeHack, program selection

03

Severity & CVSS Scoring

Understanding critical/high/medium/low, CVSS calculator

04

Responsible Disclosure

Ethics, rules of engagement, legal considerations

05

Building Your Portfolio

Blog writeups, CVEs, public disclosures, building reputation