Practical Introduction to OSS Bug Hunting

0.1. Getting Started

1. Purpose of This Book
2. An Invitation to the Real World
3. A 30-Day Intensive Roadmap
4. A Message from the Author

0.2. 30-day Roadmap

1.1. [Day 1-2] Orientation

1. Welcome to the World of Bug Hunting
2. Overview of CVE
3. Etiquette and Rules of Bug Hunting
4. Selecting a Target

1.2. The Process for Obtaining a CVE ID

1. The Five Steps
2. Five Actions from a Bug Hunter’s Perspective (Report → Acquisition)
3. The Key to Success: GitHub Security Advisories

1.3. The Secret to Target Selection

1. Target Types and Difficulty Levels
2. Selection Priority Checklist
3. Targets to Avoid
4. Finding Your Target OSS

1.4. Vulnerability Types and Characteristics by Target

1. About General Web Vulnerabilities
2. Characteristics by OSS Type
3. 1. CVE Examples: Web Applications
4. 2. CVE Examples: Libraries
5. 3. CVE Examples: Frameworks
6. Advice from the Author

2.1. [Day 3-4] Environment Construction and Tool Setup

1. OSS Environment Construction
2. Tool Setup
3. Summary of Recommended Tools
4. Advice from the Author

2.2. Tools and Debugging

1. Three Essential Tool Elements to Master
2. Main Uses of Tools
3. Overview of the Tool Workflow
4. Objectives of Debugging
5. Debugging Techniques
6. Benefits of Debugging Skills
7. Advice from the Author

3.1. [Day 5-10] Initial Investigation Phase

1. Understanding Specifications and Functions
2. Identifying Input Points
3. Intuition for Suspicious Areas (The Bug Hunter’s Scent)
4. Important Attacker Perspectives

3.2. Vulnerability Scent and Strategy

1. Characteristics by Target Type
2. Points for Intuition and Instinct
3. Turning Your Preferences into Strengths
4. Bypassing Security Controls
5. Advice from the Author

3.3. Taint Analysis in Practice

1. The Three Elements of Taint Analysis
2. Examples of Sink Lists by Language
3. Choosing Between Backwards and Forwards Approaches
4. Examples of Tracking Approaches
5. Standard Taint Analysis Workflow
6. Advice from the Author

3.4. Re-Examination of Past CVEs

1. Listing and Dissecting Past CVEs
2. Thinking Methodology: Devising “Bypass Techniques” from Fix PRs
3. Common Bypass Technique Examples
4. Mindset for Successful Bypassing
5. 3 Steps for Re-verification
6. Advice from the Author

3.5. Considering Attack Scenarios

1. The Five Ultimate Goals
2. Resolution of Attack Scenarios
3. Attack Scenario Examples
4. Advice from the Author

3.6. Multifaceted Perspectives and Note-Taking

1. Common Multifaceted Perspectives
2. Critical Thinking
3. Thinking Evolution: Connecting the Dots
4. Effective Note-Taking
5. Advice from the Author

4.1. [Day 11-20] Vulnerability Investigation Phase

1. The Hypothesis Verification Cycle
2. Common Verification Points
3. Core Verification Techniques
4. Preserving Evidence
5. Advice from the Author

4.2. Dynamic and Static Analysis in Practice

1. Dynamic Analysis
2. Static Analysis
3. Secure Code Reading
4. Grep Techniques
5. Deep Dive into Libraries
6. Strategies by Analysis Style
7. General Investigation Flow
8. Recommended Steps from the Author

4.3. AI Secure Code Review

1. Approaches to AI Code Review
2. Approaches to AI Secure Code Review
3. The Three Principles
4. Prompt Engineering Tips Examples
5. Three Mindsets for Working with AI
6. Advice from the Author

4.4. Threat Consideration and Proof

1. Proving the Value of a Vulnerability
2. The Boundary Between “Feature” and “Vulnerability”
3. Solidifying Decisive Evidence
4. Advice from the Author

5.1. [Day 21-25] Report Writing and Presentation

1. Report Entry Items
2. General Points
3. Points for Reproduction Steps
4. Points for Risk Assessment
5. CVSS Score
6. Follow-up After Reporting
7. Advice from the Author

5.2. Creating a Proper PoC

1. Why Provide a PoC?
2. 1. JavaScript PoC Using DevTools
3. 2. Python PoC Using the Terminal
4. Choosing the Right PoC Format
5. Important Considerations When Creating a PoC
6. Advice from the Author

5.3. CVE Reported Cases

1. 1. Improper Rate Limiting
2. 2. Blind SSRF
3. 3. SSTI to RCE
4. 4. SQL Injection

6.1. [Day 26-30] Fixing the Vulnerability and Obtaining a CVE

1. Verifying the Patch and Final Confirmation
2. CVE ID Issuance and Disclosure
3. Actions After Obtaining a CVE
4. Lessons from Failure

6.2. 30-day Review and Next Steps

1. Reviewing the 30 Days
2. Potential Next Steps
3. Differences Between OSS and Bug Bounty Programs

7. Conclusion

1. The 30-Day Challenge
2. To My Readers
3. Final Words: With Gratitude
4. Happy Bug Hunting!