Bug Bounty from Zero: Series Guide — Walking Through XSS, Memory, VM Escape, TEE, and AI Bounty Payouts in Plain Language

🌏 繁體中文版

This is the reading entry point for Bug Bounty from Zero. The series has 15 posts (parts 0–14) arranged along one arc: start by reading program rules and reward tables, set up a reproducible workbench, move from web bugs (XSS, IDOR) to RCE, then down to memory bugs, buffer overflows, VM/hypervisor escapes, Hyper-V escape, TEE, AI product bounty payouts, payout-map fact-checking, and finish with certifications and a learning map.

Each post covers one decision, backed by verifiable official sources. It does not teach abuse of attack tools, and does not encourage unauthorized testing.

What this series answers

When you open Google VRP, Meta Bug Bounty, or Microsoft MSRC, you see terms like In-scope, Out-of-scope, Rewards, and Exceptions. This series turns those long rules pages into a practical starting plan, and answers three questions:

1. What am I allowed to test? Read scope and exclusions on the rules page — don't assume, don't guess.
2. How do I prove what I found? Use a repeatable workbench and report template so a reviewer can reproduce without guessing.
3. What is the finding roughly worth? Compare against each program's reward table and actual rulings — don't reverse-engineer value from a headline number.

What this series is not

• Not a penetration-testing course. No walkthroughs of attack tools, no guidance on finding real targets.
• Not a certification prep course. Part 14 mentions certs, but it does not replace official exam guides.
• Not encouragement of illegal testing. All examples run on local practice servers or targets you have explicit authorization to test.

Learning path

Part 0 (this post) → Part 1 Rules → Part 2 Web fundamentals → Part 3 Workbench
     → Part 4 XSS/IDOR → Part 5 RCE → Part 6 Reporting & expected value
     → Part 7 Memory → Part 8 Buffer overflow → Part 9 VM/Hypervisor
     → Part 10 Hyper-V escape → Part 11 TEE → Part 12 AI bounty payouts
     → Part 13 Payout map fact-check → Part 14 Certifications & learning map

Numbering is a reading order, not a capability assessment. Parts 0–6 form a complete web-testing flow; parts 7–11 move into lower-level system bugs, a steeper cliff — read parts 0–6 first before deciding whether to continue.

Post by post

Stage 1: Rules and workbench (parts 0–3)

0. Series guide (this post)
Reading entry point: the context, order, and boundaries of all 15 posts.

1. How to Read Bug Bounty Rules: Scope, Rewards, Exclusions, and Reporting
The four sections of a rules page: scope (what you may test), rewards (what gets paid), exclusions (what is excluded), reporting (what evidence to keep).

2. What Do the Browser and Server Exchange When You Click a Link?
HTTP, cookies, sessions, and input validation basics — the vocabulary for the bugs that follow.

3. A Bug Bounty Workbench: Capture Requests, Change Parameters, and Check Authorization
Burp Suite Community, browser DevTools, and a local practice server: repeat one request, change one input at a time.

Stage 2: Web bugs and reporting (parts 4–6)

4. The Two Most Common Web Bugs, XSS and IDOR, and Why Google Pays Them Differently
XSS vs IDOR: how they differ, and why two browser-side bugs earn very different rewards from Google.

5. Why RCE Pays the Most in Google's Reward Table: Command Injection and Unsafe Deserialization
From "user input pasted into a shell command" to "untrusted data deserialized into objects": recognizing RCE and why it's dangerous.

6. How to Write a Bug Report That Earns the Full Reward: Quality Multipliers, a One-Page Template, and Expected Value
Report template, impact analysis, low/medium/high severity, and whether the whole testing process is worth your time.

Stage 3: Lower-level system bugs (parts 7–11)

7. How Programs Use Memory: Addresses, the Stack, the Heap and Return Addresses
Where variables live, where a function returns to — the C and memory concepts needed to read lower-level examples.

8. How a Few Extra Characters Can Hand Someone Your Program: Buffer Overflows for Beginners
Writing past a buffer's length to overwrite adjacent memory, hijacking control flow, and replacing it with a length-limited call.

9. Virtual Machines and Hypervisors: Which Wall the L1 and L2 Rows of the Hyper-V Bounty Table Break
The wall between a VM and its hypervisor, and which layer Hyper-V's L1/L2 bounty rows correspond to.

10. A Hyper-V Escape Case Study: CVE-2021-28476, From a Guest's Packet to a Host Crash
One real, patched bug with public technical analysis — what a hole in that wall actually looks like.

11. TEEs and Confidential Computing: Why WhatsApp Put AI in a Room Even Meta Can't See Into
Trusted execution environments and confidential computing: why some AI processing is invisible even to the platform itself.

Stage 4: AI bounty payouts and a learning map (parts 12–14)

12. Bug Bounty for AI Products: What Google, OpenAI, Anthropic and Meta Accept, and What They Pay
AI bounty pages mostly don't pay for what a model says (jailbreaks, hallucinations); they pay when a model acts on someone else, and for ordinary bugs around the AI product.

13. Bug Bounty Payout Map: What Google, Hyper-V, Meta TEE, Apple and Mozilla Pay For
Going row by row through each program's caps and conditions — putting "hundreds of thousands of dollars" back into context.

14. Bug Bounty Certifications and a Practice Map for Articles 0–14
Where certifications fit, a practice path through parts 0–14, and how to keep learning afterward.

Things to know

• Authorize first, test later. A technically valid bug still gets rejected if it's out of scope or a duplicate.
• Examples run locally only. The shop.mjs practice server listens on 127.0.0.1 and never touches real targets.
• Don't estimate payouts from memory. Reward tables and rulings change; check the current official rules when assessing a finding.

Related series on this site

This series is a from-zero practical entry point rather than a deep dive into one technology. If you want to go deeper after reading:

• Security Cert Prep — certification prep paths built on official exam guides.
• Private Corpus Pipeline — the lifecycle of private data entering an index, echoing part 12's data-exfiltration angle.
• AI Model Families — architecture and licensing of individual model families, as background for part 12.

How to read

• In a hurry: read part 0 (this post) and part 1 (rules), then jump to whichever topic interests you (e.g. part 12 for AI bounty payouts).
• Walk the whole path: read from part 0 to part 14 in order; after each post, check whether you can restate its core decision in plain language.
• Already have a background: skip parts 0–3 and start at part 4 (XSS/IDOR) or part 7 (memory).

Each post ends with official sources and further reading — follow them to go deeper.

References

• Google VRP Rules — program scope and reward conditions.
• Meta Bug Bounty scope — invalid report reasons, duplicate handling, and payout factors.
• Microsoft MSRC Bounty — Microsoft's vulnerability reward program overview.
• PortSwigger: Burp Suite documentation — workbench tool reference.
• OWASP Juice Shop — an intentionally vulnerable practice application.
• 繁體中文版