This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

Get Started with OWASP Bug Bounty

Revision as of 15:46, 16 September 2016 by Johanna Curiel (talk | contribs) (Check the code)

Jump to: navigation, search

OWASP Bug Bounty programs are run different from most traditional Bug Bounties. First of all, the applications to be tested are not available as deployed web applications online. For this part you will need to download the applications and deploy or install them on your computer. The following is a guideline for each bug bounty program we are running:

OWASP ZAP Bug Bounty

The OWASP ZAP Bug Bounty program can be found here:

OWASP ZAP is a client application written in JAVA. Therefore is important that you keep in mind the scope of the bounty. Download the version(2.5.0) mentioned on the scope and install it on your computer.


Check the code

OWASP ZAP is an open source application, meaning that you have access to the source code and you can debug it while testing it. This offers you a much better view of what is happening, but also, you have the ability to white-test the application and find out vulnerable Java Methods faster than the Blackbox approach.

<iframe width="560" height="315" src="" frameborder="0" allowfullscreen></iframe>

  • You can also use STATS analysis tools that might unmask vulnerable methods.

OWASP Source code can be found here:


Any design or implementation issue that is reproducible and substantially affects the security of ZAP users is likely to be in scope for the program, but in particular:

  • Remote code execution [1]
  • Unauthorized API actions [1]