Bug Bounty Hunting Essentials

Writing the proof of concept of a report

Without the proof of concept replication steps, there is no way that the team can recreate the scenario that you just created, so it is important that you list down the steps exactly as you replicated the vulnerability. You should always treat the program owner as a newbie when explaining the proof of concept to them. This way, you can list down all of the steps in a hierarchical manner. Having simple, easy-to-follow, step-by-step instructions will help those triaging your issue to confirm its validity at the earliest opportunity. For instance, if I identified an XSS vulnerability, here is what the replication steps would look like:

1. Go to the following [URL].
2. Log in using your username and password ...