This Programme will teach you how you can earn money just by reporting Bugs that you find in web application,Software,Network.
Study have shown that Hackers are earning millions of dollar seating at home just by Doing Bug Bounty.
Bug Bounty Platform
also check out : Penetration Testing
Some More Info
A bug bounty program is a deal offered by many websites, organizations and software developers by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to exploits and vulnerabilities.
These programs allow the developers to discover and resolve bugs before the general public is aware of them, preventing incidents of widespread abuse. Bug bounty programs have been implemented by a large number of organizations, including Mozilla, Facebook, Yahoo!, Google, Reddit, Square, and Microsoft.
Companies outside the technology industry, including traditionally conservative organizations like the United States Department of Defense, have started using bug bounty programs. The Pentagon’s use of bug bounty programs is part of a posture shift that has seen several US Government Agencies reverse course from threatening white hat hackers with legal recourse to inviting them to participate as part of a comprehensive vulnerability disclosure framework or policy
Vulnerability Disclosure Policy Violations
In August 2013, a Palestinian Computer Science student reported a vulnerability that allowed anyone to post a video on an arbitrary account. According to the email communication between the student and Facebook, he attempted to report the vulnerability using Facebook’s bug bounty program but the student was misunderstood by Facebook’s engineers. Later he exploited the vulnerability using the Facebook profile of Mark Zuckerberg, resulting into Facebook denying to pay him a bounty.
Facebook started paying researchers who find and report security bugs by issuing them custom branded “White Hat” debit cards that can be reloaded with funds each time the researchers discover new flaws. “Researchers who find bugs and security improvements are rare, and we value them and have to find ways to reward them,” Ryan McGeehan, former manager of Facebook’s security response team, told CNET in an interview. “Having this exclusive black card is another way to recognize them. They can show up at a conference and show this card and say ‘I did special work for Facebook.’” In 2014, Facebook stopped issuing debit cards to researchers.
In 2016, Uber experienced a security incident when an individual accessed the personal information of 57 million Uber users worldwide. The individual supposedly demanded a ransom of $100,000 in order to destroy the users’ data. In Congressional testimony, Uber CISO indicated that the company verified that the data had been destroyed before paying the $100,000. Mr. Flynn expressed regret that Uber did not disclose the incident in 2016. As part of their response to this incident, Uber worked with partner HackerOne to update their bug bounty program policies to, among other things, more thoroughly explain good faith vulnerability research and disclosure.
India, which has either the first or second largest number of bug hunters in the world, depending on which report one cites, also tops the Facebook Bug Bounty Program with the largest number of valid bugs. “India came out on top with the number of valid submissions in 2017, with the United States and Trinidad & Tobago in second and third place, respectively”, Facebook quoted in a post.
Yahoo! was severely criticized for sending out Yahoo! T-shirts as reward to the Security Researchers for finding and reporting security vulnerabilities in Yahoo!, sparking what came to be called T-shirt-gate. High-Tech Bridge, a Geneva, Switzerland-based security testing company issued a press release saying Yahoo! offered $12.50 in credit per vulnerability, which could be used toward Yahoo-branded items such as T-shirts, cups and pens from its store. Ramses Martinez, director of Yahoo’s security team claimed later in a blog post that he was behind the voucher reward program, and that he basically had been paying for them out of his own pocket. Eventually, Yahoo! launched its new bug bounty program on October 31 of the same year, that allows security researchers to submit bugs and receive rewards between $250 and $15,000, depending on the severity of the bug discovered.
Similarly, when Ecava released the first known bug bounty program for ICS in 2013,they were criticized for offering store credits instead of cash which does not incentivize security researchers. Ecava explained that the program was intended to be initially restrictive and focused on the human safety perspective for the users of IntegraXor SCADA, their ICS software.
In October 2013, Google announced a major change to its Vulnerability Reward Program. Previously, it had been a bug bounty program covering many Google products. With the shift, however, the program was broadened to include a selection of high-risk free software applications and libraries, primarily those designed for networking or for low-level operating system functionality. Submissions that Google found adherent to the guidelines would be eligible for rewards ranging from $500 to $3133.70. In 2017, Google expanded their program to cover vulnerabilities found in applications developed by third parties and made available through the Google Play Store.
Similarly, Microsoft and Facebook partnered in November 2013 to sponsor The Internet Bug Bounty, a program to offer rewards for reporting hacks and exploits for a broad range of Internet-related software. In 2017, GitHub and The Ford Foundation sponsored the initiative, which is managed by volunteers from Uber, Microsoft, Facebook, Adobe, and HackerOne. The software covered by the IBB includes Adobe Flash, Python, Ruby, PHP, Django, Ruby on Rails, Perl, OpenSSL, Nginx, Apache HTTP Server, and Phabricator. In addition, the program offered rewards for broader exploits affecting widely used operating systems and web browsers, as well as the Internet as a whole.
In March 2016, Peter Cook announced the US federal government’s first bug bounty program, the “Hack the Pentagon” program. The program ran from April 18 to May 12 and over 1400 people submitted 138 unique valid reports through HackerOne. In total, the US Department of Defense paid out $71,200.
Open Bug Bounty is a crowd security bug bounty program established in 2014 that allows individuals to post website and web application security vulnerabilities in the hope of a reward from affected website operators.