We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.
Stay tuned for updates coming soon!
iffu has reached Level 4 with 75+ unique vulnerabilities discovered and they have proven to us that they understand web application vulnerabilities and how to discover them. If you run a bug bounty/vulnerability disclosure program and you are looking for an active, professional researcher, we recommend considering this user
| Report Title | Event ID | Severity | Vulnerability Type |
|---|---|---|---|
| Leakage of P2 information of users who have taken appointment | FirstBlood v1 | High | Insecure direct object reference |
| Stored XSS on /drpanel/drapi/query.php?aptid | FirstBlood v1 | High | Stored XSS |
| Open Redirect /drpanel/logout.php | FirstBlood v1 | Low | Open Redirect |
| P2 information disclosure of the users attending the events | FirstBlood v1 | CRITICAL | Information leak/disclosure |
| Found a way to register as non-admin user | FirstBlood v1 | High | Auth issues |
| Privilege Escalation on /drpanel/drapi/query.php and /drpanel/drapi/query.php | FirstBlood v1 | CRITICAL | Application/Business Logic |
| Reflected XSS on /login.php using ref parameter | FirstBlood v1 | Medium | Reflective XSS |
| Reflected XSS on /login.php using the GET paramter 'goto' | FirstBlood v1 | Medium | Reflective XSS |
| Open Redirect on /login.php via goto body parameter | FirstBlood v1 | Low | Reflective XSS |
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles 
