Master Bug Bounty Hunting: Your Guide to Breaking into Cybersecurity for Newcomers

Discovered by: Michael Kim Vendor: ui-lib (Uilibrary) Product: Stocky – POS with Inventory Management & HRM (“Ultimate Inventory Management System with POS”) Affected Version: 5.0 (as released June 2025) Impact: Arbitrary JavaScript Execution (Stored XSS →

Discovered by: Michael Kim & Sergio Medeiros Vendor: iNiLabs Product: School Express – School Management System (SMS Express) Affected Version: 6.2 (other versions not tested) Impact: Arbitrary JavaScript Execution (Stored XSS) Attack Type: Remote (Authen…

Discovered by: Michael Kim & Sergio Medeiros Vendor: LiquidThemes Product: MagicAI (a.k.a.

Introduction: As a seasoned cybersecurity researcher and penetration tester, I am constantly on the lookout for certifications that sharpen my skills and keep me at the forefront of web application security.

Late one night, after working on a couple of bug bounty platforms, I decided to revisit a CVE I found last month.

Late in the evening, I decided to explore some PHP applications focused on Student Information Systems, inspired by my recent success in finding systemic stored XSS vulnerabilities in a private bug bounty program.

It was late at night, and I was starting to burn out from hunting bugs in a few bug bounty programs I am active on.

I was scrolling through LinkedIn and noticed a couple of hackers on my newsfeed posting that they passed the mock exam for the CAPen Certification by The SecOps Group.

Usually, when newcomers approach me in the bug bounty field, they often ask about the tools, methods, and any other "secret sauce" I use when searching for vulnerabilities in bug bounty programs.

While enumerating the scope of a target on a private bug bounty program, I came across a subdomain used for generating PDF files.

Since I began my journey of becoming a professional "hacker" and bug bounty hunter, I've always been fascinated by researchers who hunt and look for zero days in web applications.

Finally!

I began my journey pursuing a cyber security career professionally about a year ago, with the focus on obtaining only hands-on practical certifications with the intent to pivot careers after a decade-long run in Sales.

I started my journey with practical certifications in the Cyber Security world because I have been trying to pivot careers after being in technical sales in the Fintech space for nearly a decade.

While doing some basic recon, and digging through subdomains on various targets on different bug bounty platforms and VDP's, I came across something interesting hanging around on the Pizza Hut domain that peaked my interest.