From Recon to Report: Complete Bug Bounty Workflow for 2025 (With Tools, Commands, and Tips)

✨ Introduction

In the world of cybersecurity, bug bounty hunting is not just a skill, it is a full journey. From gathering information to reporting bugs to companies, every step matters. Many beginners learn tools but miss the proper direction. That is why in this article, we are going to walk you through the complete bug bounty workflow for 2025.

We will cover everything you need:

• Real Indian style explanation
• Tools with commands
• Tips that work in the real world
• And a structure that takes you from beginner to pro

Let us begin!

💪 Phase 1: Reconnaissance (Information Gathering)

🎯 Goal: Collect data about your target

Before you start testing anything, you need to know your target inside and out. Recon is the foundation of bug hunting.

🔧 Tools for Recon

Passive Recon: (no direct interaction)

• Subfinder – Finds subdomains from public sources
• Assetfinder – Fetches assets like subdomains
• Waybackurls – Gets old archived URLs
• crt.sh – Certificate search for subdomains
• Github-Dorks – Find secrets from public code

Active Recon: (direct scanning)

• Amass – Powerful subdomain enumeration
• HTTPX – Checks for live hosts
• Nmap – Port and service scanner
• Dirsearch – Directory brute-forcing
• Whatweb – Detect technologies

🧠 Pro Tips

• Use both passive and active recon
• Organize results in folders: subdomains.txt, live.txt, wayback.txt, etc.
• Do not skip recon, even if it takes hours

🧪 Example Commands

subfinder -d target.com -o subdomains.txt
httpx -l subdomains.txt -o live.txt
amass enum -passive -d target.com -o amass.txt
cat live.txt | waybackurls > wayback.txt
dirsearch -u https://target.com -e php,html,js -o dirs.txt

🔍 Phase 2: Enumeration and Vulnerability Scanning

🎯 Goal: Find weak points in the app

You now have URLs, subdomains, directories. Time to dig deeper. This is where we look for parameters, test responses, and scan for known issues.

🛠️ Tools for Enumeration

• Burp Suite – Manual testing with request/response
• Nuclei – Fast automated vulnerability scanner
• GF Patterns – Filters for common bugs (like XSS, SSRF)
• ParamSpider – Finds hidden parameters
• Arjun – GET/POST parameter discovery
• Dalfox – XSS detection

🔑 Commands You Can Use

cat wayback.txt | sort -u | gf xss
cat live.txt | nuclei -t cves/ -o nuclei.txt
python3 paramspider.py -d target.com -o param.txt

✅ Common Vulnerabilities To Check

• XSS (Cross-Site Scripting)
• SQLi (SQL Injection)
• IDOR (Insecure Direct Object Reference)
• Open Redirect
• SSRF (Server Side Request Forgery)
• Rate limiting bypass
• Broken authentication

📘 Tips for Indian Beginners

• Focus on one bug class at a time (start with XSS)
• Do not only depend on tools. Think manually
• Take notes in Notion or Google Docs/Keeps

⚔️ Phase 3: Manual Testing & Exploitation

🎯 Goal: Confirm and exploit the bug

Found something suspicious? Now test it properly. This phase separates script kiddies from real hackers.

🧪 Tools You Need

• Burp Suite: Repeater, Intruder, Decoder, etc.
• Postman: For API testing
• curl: Quick testing in terminal
• Browser DevTools: For JavaScript bugs

💡 Manual Testing Examples

• Change ID in request: /user?id=101 → /user?id=102
• Try inserting payloads like <script>alert(1)</script>
• Remove tokens or cookies and observe response
• Try HTTP method tampering: PUT, DELETE, etc.
• Replay request with modified headers

💬 Headers To Modify

• X-Forwarded-For
• Referer
• User-Agent
• Authorization

📸 Save Everything

• Take screenshots
• Save request/response in Burp
• Copy curl commands for your report

📄 Phase 4: Writing the Report

🎯 Goal: Clearly explain the bug to the company

You found the bug. Now your report should make it easy to understand. If they cannot reproduce, you do not get paid.

🛡️ Bug Bounty Report Format (Minimal & Effective)

## Title: [IDOR] Unauthorized Account Deletion via UserID in /api/delete

### Summary:
An IDOR vulnerability in the DELETE /api/delete endpoint allows any authenticated user to delete accounts of other users by modifying the id parameter.

### Impact:
Any logged-in user can delete other users' accounts, leading to data loss and account takeover scenarios.

### Steps to Reproduce:
1. Login as a regular user (User A)
2. Capture the request to DELETE /api/delete?id=123
3. Change id=123 to another user's ID like id=124
4. Send the request
5. Observe that User B's account is deleted

### Proof:
curl -X DELETE https://target.com/api/delete?id=124 \
  -H "Authorization: Bearer <UserA_Token>"

### 🛠️ Mitigation:
• Add proper authorization checks on the server.
• Ensure that the authenticated user's ID matches the ID in the request.
• Use session-based ownership validation from backend logic, not just frontend.

🔥 Tips to Make Report Stand Out

• Use simple English (no heavy technical terms)
• Use bullet points
• Mention business impact
• Give suggestions for fix
• Include screenshots, curl, Burp file, video (if needed)

🎁 Bonus Phase: Reporting Platforms and Next Steps

🏆 Platforms To Join

• HackerOne – Large companies and good bounties
• Bugcrowd – Structured programs
• Intigriti – EU-based, less competition
• YesWeHack – Growing in India too
• Private programs – Some invite-only

📌 How To Get Invites?

• Stay active
• Submit quality reports
• Share writeups online (blog, Twitter, Linkedin)

📢 Write and Share

• Start a blog
• Post reports (after disclosure)
• Help others, join communities

🧠 Final Thoughts and Indian Advice

• Learn one tool every week
• Follow top Indian hackers
• Do not jump to bug hunting on Day 1
• Master recon and reading responses
• Stay humble, stay hungry

Bug bounty is not just tools. It is strategy + patience + mindset. Anyone can run Nmap, but few can report a smart IDOR.

So make a daily plan, join communities, take notes, and enjoy the hunt.

🧭 Your Checklist (Keep This Saved)

• Recon
• Subdomain Enumeration
• Dir Bruteforce
• Param Discovery
• Manual Testing
• Screenshot & Record
• Report Writing
• Submission

Happy Hunting! 🇮🇳

References:

• Bug Bounty Roadmap 2025: The Only Roadmap You’ll Ever Need
• Top Bug Bounty Tools Every Ethical Hacker Should Know in 2025