Curious about some the bug bounty rules and what tools I can be used

Recon Techniques
6

  1. I have not seen any program say explicitly do not test for sql injection, but use common sense you dont need to dump the whole database to prove sql injection.

  2. read here Researcher Resources - Tools, watch level up, go on thebugcrowd leaderbaord and follow the top guys on their twitter, a lot of them have some type program or script they have wrote on github and read their blog posts, many have a medium.com page. many of the tools on kali are now more often updated on github for example if you use sqlmap on kali and run sqlmap --update it advises to use github.

  3. you can use https://google-gruyere.appspot.com/ which is a live website to practise on, or watch this to install mutillidae and xampp on your kali box https://www.youtube.com/watch?v=CWThOgW4iZM but if you do decide to use mutillidae get the git version by pasting this in your terminal git clone https://git.code.sf.net/p/mutillidae/git mutillidae-git

good luck

3 Likes