Overview
Asset discovery identifies the applications running on the in-scope hosts — the web apps and services where most bug bounty vulnerabilities are found. This lesson covers application discovery.
Learning objectives
- Explain identifying applications in asset discovery.
- Describe characterizing an application's surface.
- Connect applications to vulnerability hunting.
Core concept
Applications are the web apps and services running on in-scope hosts — the actual software a researcher will test. Application discovery identifies what applications exist, their purpose and functionality (login, dashboards, e-commerce, admin, APIs), and their general surface (pages, features, technologies). Since most bug bounty vulnerabilities live in application logic and functionality, characterizing each in-scope application — especially its sensitive or complex features — is where discovery translates into hunting opportunities.
How it works
For each in-scope host/subdomain, the researcher identifies the application(s) present and characterizes them: what the application does, what major features it has, whether it involves authentication, sensitive data, payments, admin functions, or APIs, and what technologies it uses. This builds a per-application profile of the surface to hunt. Applications with rich, sensitive functionality (accounts, transactions, admin) offer more and higher-impact opportunities than static or simple ones. Application discovery feeds directly into prioritization (which apps to focus on) and into the endpoint/parameter mapping that precedes vulnerability testing.
Practical example
Across the in-scope hosts, the researcher discovers several applications: a customer web app with login, profiles, and payments; an admin application; a static marketing site; and an API-driven service. They characterize each — noting the customer app and admin app have rich, sensitive functionality (accounts, payments, privileged actions) while the marketing site is static. This profiling reveals that the customer and admin applications are the high-opportunity targets, guiding where to concentrate hunting. Application discovery turned "hosts exist" into "here are the apps and what's worth testing."
Cybersecurity relevance
Application discovery is where asset discovery meets vulnerability hunting: most findings live in application functionality (the web-security vulnerability classes), so identifying and characterizing in-scope applications — especially sensitive/complex ones — directs effort to where impactful bugs are likely. It informs prioritization and sets up endpoint/parameter mapping and the web-security testing techniques. For defenders, it underscores knowing and securing all exposed applications. Thorough application discovery, within scope, ensures the researcher hunts the applications most likely to yield valuable, in-scope findings.
Common mistakes
- Not characterizing applications' functionality, missing where high-impact bugs are likely.
- Treating all applications equally, ignoring sensitive/complex ones.
- Overlooking API-driven or admin applications that offer rich opportunities.
Key takeaways
- Applications are the web apps/services on in-scope hosts — the software you test, where most bug bounty vulnerabilities live.
- Application discovery identifies what apps exist and characterizes their purpose, features, sensitivity, and technologies (esp. rich/sensitive functionality).
- It feeds prioritization and endpoint/parameter mapping, directing hunting toward high-opportunity applications and setting up web-security testing.
Check your understanding
- Why is characterizing an application's functionality important for hunting?
- Which kinds of applications typically offer the most (and highest-impact) opportunities?