Bug Bounty: Panduan Memulai untuk Pemula

┌──────────────────────────────────────────────────────────┐
│                BUG BOUNTY WORKFLOW                        │
│                                                          │
│  ┌──────────┐         ┌──────────────┐                  │
│  │ Company  │──(1)──▶│ Bug Bounty   │                  │
│  │ (Target) │ Launch  │ Platform     │                  │
│  │          │ Program │ (HackerOne,  │                  │
│  └──────────┘         │  Bugcrowd)   │                  │
│                       └──────┬───────┘                  │
│                              │                           │
│                    (2) Publish scope & rules             │
│                              │                           │
│                              ▼                           │
│                       ┌──────────────┐                  │
│                       │  Security    │                  │
│                       │  Researchers │                  │
│                       │  (You!)      │                  │
│                       └──────┬───────┘                  │
│                              │                           │
│                    (3) Hunt for bugs!                    │
│                              │                           │
│                              ▼                           │
│  ┌──────────────┐   ┌──────────────┐                   │
│  │ Company      │◀─│  Submit      │                   │
│  │ Triage Team  │(4)│  Report      │                   │
│  │              │──▶│              │                   │
│  └──────┬───────┘   └──────────────┘                   │
│         │                                               │
│  (5) Validate & Assign Severity                         │
│         │                                               │
│         ▼                                               │
│  ┌──────────────────────────────────────┐              │
│  │  Bounty Payout 💰                    │              │
│  │  • Critical: $500 - $50,000+         │              │
│  │  • High:     $250 - $10,000          │              │
│  │  • Medium:   $100 - $2,500           │              │
│  │  • Low:      $50 - $500              │              │
│  └──────────────────────────────────────┘              │
└──────────────────────────────────────────────────────────┘

# ============================================
# Setup Lab Bug Bounty
# ============================================

# 1. Operating System
# Gunakan Kali Linux atau Parrot OS (sudah include tools)
# Download: https://www.kali.org/get-kali/

# Atau install di VirtualBox/VMware:
# - VirtualBox: https://www.virtualbox.org/
# - Kali VM: https://www.kali.org/get-kali/

# ============================================
# 2. Install Tools Essential
# ============================================

# Update system
sudo apt update && sudo apt upgrade -y

# Browser Extensions
# - Burp Suite (community/proxy)
# - Wappalyzer (teknologi detection)
# - HackTools (payloads reference)

# ============================================
# 3. Proxy Setup (Burp Suite)
# ============================================

# Download Burp Suite Community
# https://portswigger.net/burp/communitydownload

# Setup browser proxy:
# Firefox → Settings → Network → Manual Proxy
# HTTP Proxy: 127.0.0.1, Port: 8080

# Install Burp CA Certificate:
# 1. Buka http://burp di browser
# 2. Download CA Certificate
# 3. Import ke Firefox: Settings → Certificates → Authorities

# ============================================
# 4. Practice Platforms (Legal Hacking!)
# ============================================

# PortSwigger Web Security Academy (FREE)
# https://portswigger.net/web-security
# → Interaktif labs untuk semua OWASP Top 10

# TryHackMe (FREE tier tersedia)
# https://tryhackme.com
# → Guided learning paths untuk web security

# HackTheBox (FREE tier tersedia)
# https://www.hackthebox.com
# → Challenge-based labs

# DVWA (Damn Vulnerable Web Application)
# → Local vulnerable app untuk latihan
git clone https://github.com/digininja/DVWA.git
cd DVWA
# Setup dengan Docker:
docker run --rm -it -p 80:80 vulnerables/web-dvwa

# Juice Shop (OWASP)
# → Modern vulnerable app
docker run --rm -p 3000:3000 bkimminich/juice-shop
# Buka: http://localhost:3000

# bWAPP
docker run --rm -p 8080:80 raesene/bwapp
# Buka: http://localhost:8080/install.php

# ============================================
# 5. Reconnaissance Tools
# ============================================

# Subdomain enumeration
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/tomnomnom/assetfinder@latest

# HTTP probing
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

# Directory enumeration
sudo apt install dirb gobuster

# Technology detection
pip install wappalyzer

# ============================================
# RECONNAISSANCE WORKFLOW
# ============================================

# ---- 1. Subdomain Enumeration ----

# Method 1: Brute force subdomain
subfinder -d target.com -o subdomains_subfinder.txt
assetfinder --subs-only target.com > subdomains_assetfinder.txt
amass enum -passive -d target.com > subdomains_amass.txt

# Method 2: Certificate Transparency logs
curl -s "https://crt.sh/?q=%25.target.com&output=json" | \
  jq -r '.[].name_value' | sort -u > subdomains_crt.txt

# Method 3: DNS brute force
gobuster dns -d target.com -w /usr/share/wordlists/subdomains.txt -t 50

# Gabungkan dan deduplicate
cat subdomains_*.txt | sort -u > all_subdomains.txt

# ---- 2. HTTP Probing ----

# Cek subdomain mana yang hidup
httpx -l all_subdomains.txt -o alive_subdomains.txt -silent

# Dengan teknologi detection
httpx -l all_subdomains.txt -tech-detect -status-code -title \
  -o detailed_scan.txt

# ---- 3. Port Scanning (jika diizinkan scope) ----

# Quick scan
nmap -iL alive_subdomains.txt -T4 --top-ports 1000 -oX nmap_results.xml

# ---- 4. Directory Enumeration ----

# Untuk setiap target yang menarik
gobuster dir -u https://target.com \
  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -x php,html,js,json,txt,bak,old,sql \
  -t 50 -o directories.txt

# Fuzzing parameter
ffuf -u https://target.com/FUZZ \
  -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt \
  -o ffuf_results.json

# ---- 5. JavaScript Analysis ----

# Extract JS files
cat alive_subdomains.txt | katana -jc -o katana_js.txt

# Analyze JS for secrets, API keys, endpoints
cat katana_js.txt | grep -E '(api|key|token|secret|password|admin)' 

# Tool: SecretFinder
python3 SecretFinder.py -i https://target.com/app.js -o cli

# ---- 6. Parameter Discovery ----

# Discover hidden parameters
paramspider -d target.com -o params.txt

# Arjun (parameter bruteforce)
arjun -u https://target.com/endpoint -m GET,POST

# ============================================
# VULNERABILITY TESTING CHECKLIST
# ============================================

# ---- Authentication ----
□ Default credentials (admin:admin, test:test)
□ Password reset poisoning
□ Username enumeration (login, register, password reset)
□ Brute force login (rate limiting bypass)
□ JWT attacks (alg:none, weak secret, none algorithm)
□ OAuth misconfiguration (redirect_uri manipulation)
□ MFA bypass

# ---- Authorization ----
□ IDOR (Insecure Direct Object Reference)
  - /api/users/123 → /api/users/124
  - Change order_id, account_id in requests
□ Horizontal privilege escalation (access other user's data)
□ Vertical privilege escalation (user → admin)
□ Function-level access control (call admin API as user)
□ Bypass path traversal: /admin → /Admin → /ADMIN → //admin

# ---- Injection ----
□ XSS (Reflected, Stored, DOM-based)
  - Input fields, URL parameters, HTTP headers
  - Check CSP bypass techniques
□ SQL Injection
  - Login forms, search fields, URL parameters
  - Use sqlmap for automation
□ SSRF (Server-Side Request Forgery)
  - URL parameters, file upload, webhooks
  - Try: file:///etc/passwd, http://169.254.169.254/
□ Command Injection
  - Input fields that execute system commands
□ SSTI (Server-Side Template Injection)
  - {{7*7}} → 49 (Jinja2/Twig)
  - ${7*7} → 49 (FreeMarker/Velocity)

# ---- Business Logic ----
□ Race conditions (simultaneous requests)
□ Price manipulation in e-commerce
□ Coupon/discount code abuse
□ Integer overflow (negative quantities)
□ Step bypass in multi-step processes
□ Time-of-check to time-of-use (TOCTOU)

# ---- API Security ----
□ BOLA (Broken Object Level Authorization)
□ Mass assignment (add role=admin in registration)
□ GraphQL introspection enabled
□ Rate limiting missing on sensitive endpoints
□ API versioning (older versions may be vulnerable)
□ Verbose error messages (stack traces, DB info)

# ---- Misconfiguration ----
□ Debug mode enabled in production
□ Directory listing
□ Exposed .git, .env, .DS_Store files
□ Default pages (Apache, Nginx, Tomcat)
□ CORS misconfiguration (Access-Control-Allow-Origin: *)
□ Missing security headers
□ Exposed admin panels (/admin, /dashboard, /wp-admin)

# ============================================
# IDOR Proof of Concept
# ============================================

# Temuan: Endpoint /api/v1/orders/{order_id} bisa diakses 
# dengan order_id milik user lain

# Request oleh User A (order_id miliknya):
GET /api/v1/orders/1001 HTTP/1.1
Host: api.target.com
Authorization: Bearer eyJhbG... (token User A)

# Response: 200 OK — data order User A
{
  "order_id": 1001,
  "user_id": "user_a",
  "items": ["Laptop", "Mouse"],
  "total": 15000000,
  "address": "Jl. Sudirman No. 123, Jakarta"
}

# =====================================================

# Manipulasi: Ubah order_id ke 1002 (milik User B):
GET /api/v1/orders/1002 HTTP/1.1
Host: api.target.com
Authorization: Bearer eyJhbG... (token User A — TETAP)

# Response: 200 OK — data order User B berhasil diakses! 🚨
{
  "order_id": 1002,
  "user_id": "user_b",
  "items": ["Phone", "Case"],
  "total": 8000000,
  "address": "Jl. Thamrin No. 456, Jakarta"
}

# =====================================================

# Impact: Attacker bisa:
# 1. Mengakses semua data order user lain
# 2. Mengetahui alamat, item, dan total pembelian
# 3. Menggunakan IDOR untuk enumerasi semua order di sistem
# 4. Potensi memodifikasi/menghapus order user lain

# Severity: HIGH (CVSS 7.5+)
# Category: OWASP A01 - Broken Access Control

# =====================================================
# Cara Mencegah:
# =====================================================
# 1. Validasi authorization di server: pastikan user hanya
#    bisa akses resource miliknya
# 2. Gunakan UUID bukan sequential ID
# 3. Implementasi RBAC (Role-Based Access Control)
# 4. SELALU cek: resource.user_id === authenticated.user.id

#!/bin/bash
# ============================================
# RECON PIPELINE — simpan sebagai recon.sh
# ============================================

DOMAIN=$1
OUTPUT_DIR="recon_$DOMAIN_$(date +%Y%m%d)"

mkdir -p $OUTPUT_DIR

echo "[*] Starting recon for $DOMAIN"

# 1. Subdomain Enumeration
echo "[+] Finding subdomains..."
subfinder -d $DOMAIN -silent > $OUTPUT_DIR/subdomains.txt
assetfinder --subs-only $DOMAIN >> $OUTPUT_DIR/subdomains.txt
sort -u $OUTPUT_DIR/subdomains.txt -o $OUTPUT_DIR/subdomains.txt
echo "[+] Found $(wc -l < $OUTPUT_DIR/subdomains.txt) subdomains"

# 2. HTTP Probing
echo "[+] Probing for alive hosts..."
httpx -l $OUTPUT_DIR/subdomains.txt -silent \
  -status-code -tech-detect -title \
  > $OUTPUT_DIR/alive.txt
echo "[+] Found $(wc -l < $OUTPUT_DIR/alive.txt) alive hosts"

# 3. URL Discovery
echo "[+] Discovering URLs..."
cat $OUTPUT_DIR/subdomains.txt | \
  gau --threads 5 > $OUTPUT_DIR/urls_gau.txt
cat $OUTPUT_DIR/subdomains.txt | \
  waybackurls > $OUTPUT_DIR/urls_wayback.txt
cat $OUTPUT_DIR/urls_*.txt | sort -u > $OUTPUT_DIR/urls_all.txt
echo "[+] Found $(wc -l < $OUTPUT_DIR/urls_all.txt) URLs"

# 4. Extract Parameters
echo "[+] Extracting parameters..."
grep '=' $OUTPUT_DIR/urls_all.txt | \
  qsreplace FUZZ > $OUTPUT_DIR/params.txt

# 5. Nuclei Scan
echo "[+] Running nuclei scan..."
nuclei -l $OUTPUT_DIR/alive.txt \
  -severity critical,high,medium \
  -o $OUTPUT_DIR/nuclei_results.txt

# 6. XSS Check
echo "[+] Checking for XSS reflections..."
cat $OUTPUT_DIR/params.txt | \
  dalfox pipe --silence > $OUTPUT_DIR/xss_results.txt

echo "[+] Recon complete! Results in $OUTPUT_DIR/"
echo "[+] Subdomains: $OUTPUT_DIR/subdomains.txt"
echo "[+] Alive: $OUTPUT_DIR/alive.txt"
echo "[+] URLs: $OUTPUT_DIR/urls_all.txt"
echo "[+] Params: $OUTPUT_DIR/params.txt"
echo "[+] Nuclei: $OUTPUT_DIR/nuclei_results.txt"
echo "[+] XSS: $OUTPUT_DIR/xss_results.txt"

# ============================================
# BUG BOUNTY REPORT TEMPLATE
# ============================================

## Title: [Jenis Bug] di [Endpoint/Fitur] — [Impact Singkat]
# Contoh: "IDOR pada /api/orders — Bisa Akses Data Order User Lain"

## Summary
# Ringkasan 2-3 kalimat tentang bug yang ditemukan.
# Jelaskan apa, di mana, dan dampaknya.

"Endpoint /api/v1/orders/{id} tidak memvalidasi apakah user yang 
meminta adalah pemilik order. Attacker dengan akun biasa bisa 
mengakses order milik user lain hanya dengan mengubah ID."

## Severity: HIGH (CVSS 7.5)
# Tentukan severity berdasarkan CVSS atau platform rating
# Critical: RCE, Auth Bypass, Akses data massal
# High: IDOR, Stored XSS, SQLi terbatas
# Medium: Reflected XSS, CSRF, Info Disclosure
# Low: Version disclosure, Missing headers

## Affected Endpoint
GET /api/v1/orders/{order_id}
Host: api.target.com

## Steps to Reproduce
# Langkah SANGAT DETAIL — harus bisa direplikasi oleh siapa saja

### Step 1: Login sebagai User A
POST /api/v1/login HTTP/1.1
Host: api.target.com
Content-Type: application/json

{"email": "attacker@test.com", "password": "test123"}

Response: 200 OK
{"token": "eyJhbG...", "user_id": "user_a"}

### Step 2: Buat order baru (gunakan token User A)
POST /api/v1/orders HTTP/1.1
Host: api.target.com
Authorization: Bearer eyJhbG...

{"item": "Test Item", "quantity": 1}

Response: 201 Created
{"order_id": 1002, "status": "created"}

### Step 3: Akses order User B (IDOR)
# Ubah order_id dari 1002 ke 1001 (milik user lain)
GET /api/v1/orders/1001 HTTP/1.1
Host: api.target.com
Authorization: Bearer eyJhbG... (token TETAP User A)

Response: 200 OK ← SEHARUSNYA 403 Forbidden
{
  "order_id": 1001,
  "user_id": "user_b",          ← User lain!
  "items": ["Laptop"],          ← Data sensitif
  "total": 15000000,
  "address": "Jl. Sudirman..."  ← Data pribadi!
}

## Impact
# Jelaskan dampak secara detail:
# - Siapa yang terpengaruh?
# - Data apa yang bisa diakses?
# - Apa yang bisa dilakukan attacker?
# - Berapa banyak user yang terdampak?

- Attacker bisa mengakses data order dan alamat SEMUA user
- Data sensitif (alamat, item pembelian) terekspos
- Potensi untuk mengakses/mengubah/menghapus data user lain
- Jika dikombinasikan dengan ID enumeration, bisa dump semua data

## Remediation
# Saran perbaikan untuk developer:
# - Pastikan validasi authorization: check user_id === order.owner_id
# - Gunakan UUID bukan sequential integer sebagai identifier
# - Implementasi RBAC di level API

## Supporting Material
# - Screenshots (gunakan Burp Suite untuk capture)
# - Video PoC (jika diminta atau untuk bug kompleks)
# - HTTP request/response lengkap (dari Burp)