Bug Hunter:      Bug Bounty
ZYCT 10


BUG HUNTER.      Bug Bounty

    -  Bug Bounty:    , Linux, HTTP     ,    Python   .      :         ,     .

       HunterMart,          ,     .   IDOR, SQL-, XSS, SSRF, mass assignment, , OAuth/JWT     OWASP Top 10:2025,     CVSS 4.0.

 :    ,    .  ,    AppSec.





ZYCT 10

Bug Hunter:      Bug Bounty



BUG HUNTER       Bug Bounty

ZYCT




BUG HUNTER



     Bug Bounty

: ZYCT




  


     -  Bug Bounty.      (, Linux, HTTP,  -)       ,     Python    .

           HunterMart    ,       .              .

 HunterMart,   Python        : https://github.com/ZYCT10/BugHunterBook/




 


:  15  (, , HTTP, Linux/Python, ),    ( 611)  ,  .

:  12,       ( 611),   Python ( 12).

 :  ( 5),   ( 611),  ( 12),    ( 1314),  ( 15)     .

     1 ( )  8 ( ).




   


    :   ,     ,         scope .     -   ().      .




 1.   Bug Bounty



 .    ,   Bug Bounty    -:   ,      ,       ,    .       ,      .

 .    .      .

 .    : (1) ,  Bug Bounty   , red team, VDP  vulnerability research; (2)           ; (3)       ; (4) ,       .




1.1.   Bug Bounty



Bug Bounty (   )      :       ,  ,      .  (bug hunter,  researcher)     ,  ,     ,    (triage)   ,      (bounty).

   . Bug Bounty   ,          .       .    , scope      2;    :     .

     :       ,     ,        ,    .    ,    ,      ,        .

 Bug Bounty     ,      .       ,   :     ,           .




1.2.     



 ,   bug hunter,     .   ,        .

  (Defensive Security, blue team).    :  , ,     .    .



  (Offensive Security, red team).    ,      .      .



  (Application Security, AppSec).      :  ,  , ,     .     Bug Bounty  AppSec  .



Bug hunter.    offensive  AppSec,      . , ,    .

  ,       ,    .                :     ,   .




1.3. Bug Bounty, VDP, , red team, vulnerability research



   .   ,   ,     ,       .








   .

Bug Bounty  .     :   , ,        . Bug Bounty       ,         .      ; Bug Bounty          .

Bug Bounty  red team. Red team    ,        ;       .  Bug Bounty     ,      .

VDP (Vulnerability Disclosure Program).    :   - ,   ,      .   . Bug Bounty   VDP  .  safe harbor ( )   ,        ,    .    ( 2).

Vulnerability research.            , , .     CVE (Common Vulnerabilities and Exposures)      .   ;   .




1.4.      



 ,  ,       ,        .

      .    :   ,           .         ,     .      5          .

 .      .      (duplicate):  ,  -    ,    .        .

  .      ,   ,    .         ,    .         .

   .                ,      :       .    Bug Bounty     ,   -:  ,   AppSec, , , .

  . ,    . ,  ,     .      ,          ,   .

        : ,  ,  , ,     .  13  14     .




1.4.1.     


  ,      ( ):

   (1530 ).  ,  scope  ,    , ,    .



   (  ).   ,  , ,   ( 5).   .

 .  :     id?,     ?.       .

 .       (,  13).     .

.      PoC, ,  ( 1314).

   :     ;     ,     .     ,   .    ,    ,  ,        .




1.5.   



   ,    .  ,      5, 13  14;    .

 .  , , ,  ( 1.6   2).



   scope.  ,  ,   ,  safe harbor.



  . , , API, ,   ( 5).



.   ,    scope ( 5).



 .             .



 .  ,    .



  .        .



   .   ,   ( 13; CVSS   14).



  (PoC).    ( 13).



 . , ,   ( 14).



  .   ,  .



  .    .



 .  ,  ,     .

          :           ,    .








    Bug Bounty




1.6.  :  



     ,  .   (   2  5):

 scope.     (, , API,  ),    .  scope     .



 .               .     ,   .



.  ,    :       .



  .    ,  ,             .

  =     .   ,     .        scope   .




1.6.1.  :  


   Bug Bounty      ,     .    (  ,       ):

     ,     .         ,    .



 .            .      ,   .



      .        ;         .



 .        AppSec, ,          .

 :   Bug Bounty          ,       .                  -  .




1.6.2.    


    :  - (  ,    )      (  ,   ).    :  ,  ,  .     ,    .    , scope  safe harbor     ( 2)        .




1.7.     



      2,    ,     .

      : (1)    ; (2)         ( HunterMart   ); (3)       scope     .      ,      .

        HunterMart,     .     :     ,   ,         .

        .       .     ( scope ),   ,     .




1.8.    



 .  15  (, , HTTP, , ),    (611)  ,    HunterMart,     (1314).



 .  1, 3,      611,  14.   ,   ,    .



  .  5, 611  , 12 (), 1314   .

     1 ( )  8 ( ).       ( 15),      .




1.8a.  ( 13)



 1.   ,   Bug Bounty      .



 1.    Bug Bounty / VDP /  / red team  , ,   .



 2.      (13 )  ,    .



 3.  (  )         1.6 ( scope, , , ). ,    .




1.9. 



Bug Bounty      :            .     offensive  AppSec,    .  (Bug Bounty, VDP, , red team, research)  , ,   .      ,      ,     ;       .               .




1.10.  



 Bug Bounty        ?   red team   ?



  VDP  safe harbor     ?



       ?



       ,    ?



  ,     .



      ,   ,    .




1.11. 



OWASP,    Bug Bounty     https://owasp.org/www-community/Vulnerability_Disclosure_Cheat_Sheet (https://owasp.org/www-community/Vulnerability_Disclosure_Cheat_Sheet) ( 2026-10-19).



disclose.io     safe harbor ()  https://disclose.io/ (https://disclose.io/) ( 2026-10-19).



CVE Program  https://www.cve.org/ (https://www.cve.org/) ( 2026-10-19).



OWASP Top 10:2025 (  )  https://owasp.org/Top10/2025/0x00_2025-Introduction/ (https://owasp.org/Top10/2025/0x00_2025-Introduction/) ( 2026-10-19;   -     preview      owasp.org).




 2.  ,   



 .    Bug Bounty ,        ,  scope  safe harbor,     ,      .    ,    .

 .  1.

 .  : (1)      ,   -scope; (2)  safe harbor   ; (3)  ,      ; (4)   ,       ; (5)       .




2.1.     



        .           ,     .           :   ?,  ?,   ,     ?

   ,      .    -   (  ),     .

       .    ;     .    ,    .




2.2.    



 (program policy, brief)   ,    .      .  :

Scope ().    : , , , API,  .  wildcard scope (*.example.com)   ( ).



Out of scope ( ).   :  ,  ,  .   scope      .



 . : DoS/ , ,     ,  ,   .



  (disclosure).      write-up;         .



Safe harbor.      ( 2.4).



  .   ,   ,   .

 scope            .    :           .




2.2.1. Scope:     


      :  ,     ,    . Wildcard *.example.com             .  :    ,        .




2.2.2.  out-of-scope 


   ,    (      ):   security-   ,     ,    ,    ,  CSRF     ,       .     :     informative  .




2.2.3. Worked-:  scope


  (, )  scope,    :








   :

*.shop.example , , admin.shop.example,    blog.shop.example ( )    api.shop.example?  ,    wildcard;   api.shop.example  ,      scope.



*.partners.shop.example     ,   scope:  ,   .



   scope  ,  -API (    scope)  ,  ,     .



DoS  .           .



Safe harbor    :   partners.*     - .

                    ( 5). ,  ,    .




2.3. VDP  Bug Bounty:  



VDP (Vulnerability Disclosure Program)       ,     ,     . Bug Bounty    .  :  VDP     ,            .         :  scope, safe harbor   .




2.4. Safe harbor   



Safe harbor ( )   ,        ,      .   ,     ,   :

     .   scope     .



     .          (,   ,    ).



 :     safe harbor,      .  ,       .

   safe harbor   .      .  ,      ,   scope   - .




2.5.   



  ,  ,   .   ,    safe harbor.

 .     PoC.  SQL-      ,     (   L-SQLI,       ).



 .      ,    ,     .  PoC         .



   .         ;    .       .



   .     //.       ( HunterMart    ).



  URL.        URL  query-.




2.5.1.     


  SSRF, XXE,         .  (   9  11):

   ,  ,  ;



   ,  metadata-   ;



  ,     .

         HunterMart      .   ,     .




2.6.    



    scope      ,     . ,     ,           , -   .       allowlist.

  huntkit.safe_client ( 12):   ,         allowlist;  allowlist   .








 allowlist,   ,   ,   (    allowlist)  .      :           .      12.

Allowlist   (example.com)            .    ,   .      ,  .




2.7.   



  .          .       .



 write-up.           .   ( )         .



.      ,     .               ( 14).




2.7.1. Worked-:    


 ,     ,     (        ):

    ( scope,  ).



    .        .



 ( //;  ).



   (  /).



   (  ).



  (coordinated disclosure):  write-up        .

    :       (     );    ;     ,     .            .

  -   ,      .     /,     .




2.8. 



 1.      VDP/Bug Bounty  (    ,  - )  : scope, out-of-scope,  ,    safe harbor.  ,   .

 2.  HunterMart   scope:    (.     15),      ,       .      .

 4.  huntkit.safe_client  allowlist   127.0.0.1:8000  ,         DisallowedTargetError. ,          .




2.8a.   ( 15)



 1.     ( ) scope, out-of-scope  .



 2.  *.shop.example ,        scope,  .



 3. ,     - safe harbor,  .



 4.  huntkit.safe_client       .



 5.        .




2.9.   



   scope.  :  ,  .



  safe harbor   .      .



    .   ,   - ;  PoC.



    .    .



   .        (allowlist).




2.10.   (  )



 scope  out-of-scope ;    .



  safe harbor       .



    ,      .



     :       .




2.11. 



    ,     : scope, out-of-scope, , , safe harbor. Safe harbor ,       .      ,    ,        ,       ( allowlist).       ,      .




2.12.  



           ?



       wildcard-scope *.example.com?



   safe harbor.



           ?



  allowlist     ?



   write-up       ?




2.13. 



OWASP Vulnerability Disclosure Cheat Sheet  https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html (https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html) ( 2026-10-19).



disclose.io ( , safe harbor, )  https://disclose.io/ (https://disclose.io/) ( 2026-10-19).



ISO/IEC 29147 (Vulnerability disclosure)  30111 (Vulnerability handling)      ; .  ISO https://www.iso.org/ (https://www.iso.org/) ( 2026-10-19).



-      .




 3. HTTP, , cookies, , TLS  -



 .    -  ,   :    -,   HTTP    ,   cookies  ,  TLS  ,       .       .

 .  12.    ,   -.

 .  : (1)         ; (2)  HTTP-       ; (3)  cookies,     ; (4) ,   TLS; (5)  security headers .




3.1.  -



 -    .         ,         ( 9, 11).

  :








    ,     . ,    ,      ( ,  1).



DNS    (huntermart.example)  IP-.



CDN /    , ,  TLS.     cache poisoning  request smuggling (   ).



    - ( HunterMart  FastAPI).



    ( HunterMart  SQLite).

          ( DFD HunterMart   1).     ,          .




3.1.1. -   SPA


   HTML  . SPA (Single-Page Application)    :   JavaScript,    API (REST/GraphQL)  .    :       JS- (    5),     API ( 11)    ( 8).




3.2. HTTP:  



HTTP (HyperText Transfer Protocol)      .    (stateless):       ;  ()    cookies   ( 3.5).




3.2.1.  


 HTTP-:  , ,  ,  .   HunterMart:








 :  (GET),  (/api/orders/1001 +    ?a=1),  (HTTP/1.1),  (Host   1.1),  ( GET  ).   .




3.2.2. 









*     HTTP (   ),   .  ,     :  GET   (  CSRF, ).   .




3.2.3.  


2xx  (200, 201, 204); 3xx  (301, 302, 304, 307, 308); 4xx   (400, 401, 403, 404, 429); 5xx   (500, 502, 503).

    ,   . 401 ( )  403 (); 404  403         ( 6);  /  /       .




3.3.   



   ,   .    :








 , ,   (Server, X-Powered-By    ).  security headers  ;  huntkit.headers ( 12)     OWASP Secure Headers Project:








 security-   ,     .  CSP ,     XSS.           .




3.3.1. Worked-:  CORS


CORS (Cross-Origin Resource Sharing)  ,     origin    ( Same-Origin Policy).       CSRF    : CORS    -,    .   :








    Origin   Access-Control-Allow-Origin   Allow-Credentials: true:








            . :   Origin  ,     Allow-Origin  Allow-Credentials: true.   allowlist  origin,     Origin,   *  Allow-Credentials.

Access-Control-Allow-Origin: *  Allow-Credentials    (,  API  )        .       -.




3.4.  ,    



  (query string)  ?key=value&key2=value2.           ( 2).



   POST/PUT/PATCH.  : application/json, application/x-www-form-urlencoded, multipart/form-data ( ,  9).



JSON    API. REST     HTTP; GraphQL      ; WebSocket   .      11.




3.5. Cookies  



 HTTP  ,   cookie  Set-Cookie,      Cookie:








 cookie    :

HttpOnly    JavaScript (    XSS,  8).



Secure     HTTPS.



SameSite (Lax/Strict/None)       (    CSRF,  8).



Path/Domain   ;   Domain  .

  .     cookie ( )      Authorization (  HunterMart).   HunterMart  (    )       10.




3.5.1. Worked-:    


  HunterMart   ?   ,  .  1  :








    ()    . HunterMart     ,       Authorization (     Set-Cookie       , . 3.5).  2   :








   : (1)      ,   HTTP  ; (2)     (),       1001     (,  6); (3)   Authorization,    401   ,  ,   .    :











3.6. 



 3xx  Location  . 301/308  , 302/307  ; 307/308    , 302      GET.    Open Redirect (       ).  HunterMart   /go (   L-OPENREDIR;       ):











3.7.  



HTTP/1.1  ,      ( keep-alive).  Host.    1.1      request smuggling.



HTTP/2  ,  ,   (HPACK).   .



HTTP/3   QUIC ( UDP), TLS 1.3 ,  head-of-line blocking  .

        ( ),        smuggling   .




3.7.1. Worked-:    


 ,      (, -/CDN  -) -      .    HTTP Request Smuggling:      ,        (-   Content-Length  Transfer-Encoding  HTTP/1.1,    HTTP/2?HTTP/1.1).           ,    .

     ,        ,       .   ,     (CDN,  )     .   ;    :   HTTP       ,       .




3.9.1. Worked-:     


 (, , CDN)    ,    ,    (    Vary).  ,      ,     :

Cache Poisoning.     ,     (,  ,     ),   :    ,        .



Cache Deception.        ,      (,    URL  ,    ).

   :           ,   ?        ( Vary),     (Cache-Control: private, no-store),  ,    .




3.8. TLS:  



TLS (Transport Layer Security)         . HTTPS = HTTP  TLS.   :

   (TLS 1.2/1.3)  ,   ,      .



SNI (Server Name Indication)      (   ).



Certificate Transparency     ;     ( ,  5).



 HTTPS       (MITM);   HSTS ( 3.3).

 TLS   :








        HunterMart (http://127.0.0.1:8000)     .         scope ( 2).




3.9. 



 Cache-Control, ETag, Last-Modified, Vary   (, , CDN).   (If-None-Match)  304.    :           ,        cache poisoning  cache deception ( ).




3.10. 



 2.  HunterMart,       curl -v.  , ,    ,    content-type;    .

 3.         huntkit.headers.analyze.    :      ?  ,     ?

 4.  TLS    (  ,  )    3.8  ,    subject/issuer/dates.




3.10a.   ( 18)



 1.   HTTP-     3.2.1 (, , , ).



 2.  curl -v     ;    .



 3.       huntkit.headers;  .



 4.   401/403/404   HunterMart   .



 5.  cookie-  Set-Cookie   .



 6.   ,  GET,  ,   (CSRF/).



 7. ,          smuggling.



 8.   security-  HunterMart   .




3.11.   



    . 200 ?  , 404 ?  .



  security-  .    .



 HTTP-   .



    .     -     .



,     .    .




3.12.   ( )



  ;     GET.



 security headers ;    (Server, X-Powered-By).



  cookie (HttpOnly, Secure, SameSite); HSTS  HTTPS.



     (Cache-Control: private, no-store).




3.13. 



-        , /CDN,   . HTTP           ;   cookies     . TLS     .     ,      ,     ,   .       .




3.14.  



        ,    .



    HTTP-?   Host  HTTP/1.1?



   401/403      ?



 cookie- HttpOnly, Secure, SameSite?    ?



  TLS    HSTS?



  CSP   ,     ?




3.15. 



RFC 9110 (HTTP Semantics), 9111 (Caching), 9112 (HTTP/1.1), 9113 (HTTP/2), 9114 (HTTP/3)  https://www.rfc-editor.org/ (https://www.rfc-editor.org/) ( 2026-10-19).



RFC 6265 (Cookies)  https://www.rfc-editor.org/rfc/rfc6265.html (https://www.rfc-editor.org/rfc/rfc6265.html) ( 2026-10-19;  SameSite       ).



RFC 8446 (TLS 1.3)  https://www.rfc-editor.org/rfc/rfc8446.html (https://www.rfc-editor.org/rfc/rfc8446.html) ( 2026-10-19).



OWASP Secure Headers Project  https://owasp.org/www-project-secure-headers/ (https://owasp.org/www-project-secure-headers/) ( 2026-10-19).



MDN HTTP  https://developer.mozilla.org/en-US/docs/Web/HTTP (https://developer.mozilla.org/en-US/docs/Web/HTTP) ( 2026-10-19).




 4. Linux,  , Git  Python  



 .    :    Linux  ,  , Git   ,  Python   .   :             ( 12).

 .  13.   Linux- ( WSL/ ).

 .  : (1)       ; (2)     (grep/sed/awk/jq); (3)    Git; (4)    Python-    (venv)  .




4.1.   Linux



 ,         Linux.    (  , , )   (,   ).    Windows   WSL   ;  macOS   ,    (sed, grep)   (BSD  GNU).

    (  )  :              .




4.2.   



 (shell,  bash)  .  : , , .








 (pipes)           :








: > ( , ), >> (), < ( ), 2> ( ).











4.3.    



Linux     /.  : /etc (), /var/log (), /home ( ), /tmp ().    (/home/user)   (./file, ../up).

 (ls -l  -rwxr-xr--):   (, , )    ( r,  w,  x).








  :   ,    ;           (security misconfiguration).




4.4. , , 



: ps aux, top/htop,   kill <pid>.    &,   jobs, fg, bg.



 : export NAME=value; env  .        env    .env  (     scope!).



:  Debian/Ubuntu  apt,       .

       .      ,        (      ),   .     .




4.5.  : grep, sed, awk, jq



       (, ,  URL).

grep     ( ):








sed    ():








awk     ():








jq    JSON (  API):








sort | uniq -c | sort -rn    ( ):











4.5.1. Worked-:   


   access.log    (IP, ,   , , ):








 :








       ,    URL;   awk/sort/uniq     ( 5)     ( 12).




4.8.1. Worked-: Python   JSON-


    JSON- API.     resp.json:








    : .get(...)     data["results"]           (  ,  1).        huntkit ( 12):     ,     .




4.6.    



curl -v        ( ,  3).



dig  DNS- ( A/AAAA/CNAME/MX/TXT),   ( 5).



openssl s_client    TLS-   ( 3).



ss -tlnp       (   ).











4.7. Git:  



Git    .       :   ,   ,     .








     Git  :      ,   git diff      (     ).

 .gitignore  ,     (.venv/, .env, __pycache__/).        .




4.7.1. Worked-: Git-  


  ,      ,   :








  : (1)       ; (2)        ; (3)      .      :      ,   git diff      (      ).  :       .gitignore,  git status  .




4.8. Python  : 



Python     : ,      .   Python 3.12. , ,   (   12):








  JSON   (  ):











4.9.    



           (venv):








    (requirements.txt),    .        (2026-10-19).




4.10.  



     .    pytest:















  (huntkit.*)        ;   ,       ( 12).




4.11. 



 2.  :     URL    ,   . (: awk -F/ '{print $3}' | sort | uniq -c | sort -rn.)

 3.  Python-,   JSON- /api/products/search      .     results .

 4.  Git   ,         git diff  . ,    .




4.11a.   ( 16)



 1. ,        cmd > out 2> err.



 2.  - ( 4.5.1)  -5 IP   4xx/5xx.



 2.   -rwxr-x---    chmod.



 3.  Python-,  JSON-      .



 4.  Git,      git diff  .



 5.        pytest;  ruff  mypy.



 6.  -  curl + jq + sort|uniq -c    API.




4.12.   



         venv.



   .venv   .gitignore .



 BSD  GNU  (macOS/Linux)   .



           .



      .




4.13. 



     Linux   (, , , ),    (grep/sed/awk/jq),   (curl/dig/openssl), Git     Python       .          12.




4.14.  



   cat f | grep X | wc -l    cat  ?



   -rwxr-x---    chmod 750?



     JSON,   ,    ?



 venv      ?



      Git?



            ?




4.15. 



The Linux Documentation Project  https://tldp.org/ (https://tldp.org/) ( 2026-10-19).



GNU Coreutils / grep / sed / gawk manuals  https://www.gnu.org/manual/ (https://www.gnu.org/manual/) ( 2026-10-19).



jq manual  https://jqlang.github.io/jq/manual/ (https://jqlang.github.io/jq/manual/) ( 2026-10-19).



Pro Git ()  https://git-scm.com/book (https://git-scm.com/book)




  .


   .

   ,     (https://www.litres.ru/book/zyct-10-34112528/bug-hunter-ot-pervykh-shagov-do-professional-nogo-bug-bounty-74690254/)  .

      Visa, MasterCard, Maestro,    ,   ,     ,  PayPal, WebMoney, ., QIWI ,       .


