The goal of the work is to provide an open-source framework for automatable processes in bug bounty hunting. Nowadays, most of the bug hunters are writing their own (mostly bash) scripts to automate some tasks. Even though there are several tools, attempting to merge tools together (e.g., LazyRecon), most of them are private or only in a closed group of people (e.g., BountyMachine). The goal of the student is to outline a solution that allows to merge open-source tools available in a modern and scalable way.

In the theoretical part of the thesis, examples of a common class of bugs appearing in the bug bounty platforms will be introduced along with particular examples. Furthermore, benefits and differences with the traditional penetration testing approach will be covered along with a comparison of two major platforms from both, hacker's point of view, and the company's point of view (in cooperation with Kiwi.com).

This work may be inspired by closed-source BountyMachine [1].