Finding Your First Bug: Impact and Report Writing

Welcome to the final episode in the Finding Your First Bug series, today we’re talking about the final stage of bug hunting, report writing. Specifically, we’re looking at: how do you know if you’ve found a bug? When do you report a bug? What should a bug report contain? What’s the key to getting high bounties? We’re going to talk all about those really key questions! And also talk about some bug bounty etiquette and how to express yourself.

Case Studies

Further Reading Bugcrowd University

Contact Me
@insiderPhD on Twitter

[omarbdrn]

lol That Kholy report killed me 😂😂😂😂😂😂😂😂

[ImranKhan-tcjz]

Thank you! This series was sooo good, Looking forward to new stuff from you.

[skwtf]

Thanks for the video, Katie. Really interesting to see what sort of things the triagers have to go through.
Can you please consider zooming in on the images a bit for the next video?

[robbie]

Just got this in the feed. Big thumbs up for this video. Great presentation and explanation! This should have much much more views.

But I guess it is like that... People like YT "low hanging fruit" (10min, be a haxor video) of how easy this job is and how everyone can do it.

[christenw.]

Yes, this video is very useful. Thank you for teaching us.

[tahasamar]

you actually have the best "how to start bug bounty" in the youtube but I still can't find my answer to how to practically start doing it . I mean like how to work with a bug hunting website ?and what is N/A means that every body says we will see in starting days ?what are the steps to report and get answer and how do these sites pay? and these stuff

[eli_chaps]

We are into the bug but more the impact
Bigger the impact the bigger the cash and rep

[karimsz]

Ty Dr for your unique content, That little immature attitude made me laugh a lot.

[mubashirparay]

THANKS, for producing content like this. It is truly epic. One more thing can u make a video on Wayback machine and how to find some easy bugs using wYBck.

[gcm]

38:20 "maybe they would have got triaged a little faster if they had fully explained it". The report was so good and concise it was triaged, solved and payed out in 24h.

[TheAlanCulley]

Should I report a particularly vicious bee that attacked me the other day?
I understand that they are becoming an endangered species so I am somewhat reluctant to take action.
What would you recommend?

[AnwarSabry]

thanks for your content.
i'm from Egypt so i have to tell you that your bad example about that Egyptian guy called as Ahmed Kholy was very good
that guy is a big nothing, he belongs to the family of the president of Egypt so that he was shown as a great hacker and save Egypt from terrorism !

[skarverse]

i am a beginner....i always like your way of have some questions, guess you could help me....how to find the bug-bounti-programs that does not frustrate me(Beginner) to analyse the programs in bugcrowd or hackerone in this perspective? ....Thnx in Advance....