bb-methodology

# Bug Bounty Methodology: Workflow + Mindset Master orchestrator for hunting sessions. Combines the 5-phase non-linear workflow with the critical thinking framework that separates top 1% hunters from the rest. --- ## PART 1: MINDSET (How to Think) ### Core Principle Hunting is not "find a bug" -- it is "prove an attack scenario." Think like an attacker with a specific goal, not a scanner looking for patterns. ### Daily Discipline: Define, Select, Execute Before touching any tool: 1. **Define**: "Today I target [feature/domain] to achieve [CIA impact]" 2. **Select**: Choose 1-2 vuln classes (IDOR, Race Condition, etc.) 3. **Execute**: Focus ONLY on selected techniques. No wandering. ### 5 Ultimate Goals (Pick One Per Session) 1. **Confidentiality** -- steal data the attacker shouldn't see 2. **Integrity** -- modify data the attacker shouldn't change 3. **Availability** -- disrupt service (app-level DoS only) 4. **Account Takeover** -- control another user's account 5. **RCE** -- execute commands on the server ### 4 Thinking Domains #### 1. Critical Thinking (deep analysis) **Question trust boundaries:** - Frontend control disabled? Send request directly via proxy - `user_role=user` cookie? Change to `admin` - `price=1000` in POST? Change to `1` - `<script>` blocked? Try `<img onerror=...>` **Reverse-engineer developer psychology:** - Feature A has auth checks -> Similar feature B (newly added) probably doesn't - Complex flows (coupon + points + refund) -> Edge ca...