Overview
With hosts, applications, APIs, and cloud assets discovered, prioritization decides where to focus hunting for maximum return. This capstone lesson covers prioritizing discovered assets and consolidates asset discovery.
Learning objectives
- Explain prioritizing across discovered asset types.
- Describe factors for ranking assets to hunt.
- Consolidate the asset-discovery module.
Core concept
Prioritization ranks the full set of discovered in-scope assets — hosts, applications, APIs, cloud assets — by their likely value for finding impactful vulnerabilities, so limited time is spent where return is highest. Building on the recon-methodology prioritization, factors include: rich/sensitive functionality (auth, payments, admin, personal data), APIs (high-value, often under-tested), newer/less-tested assets, complex/custom applications, and assets showing signs of weaker hardening. The researcher focuses first on the highest-priority assets across all types, keeping the rest as backlog.
How it works
After discovery, the researcher evaluates every in-scope asset against value factors and ranks them collectively: a feature-rich application handling sensitive data, a directly-callable API with object-referencing endpoints, and a potentially-misconfigured cloud asset would rank high; a static marketing host would rank low. They then hunt the top-priority assets first, where impactful, well-rewarded vulnerabilities are most likely, revisiting lower-priority assets later. This is strategic: bug bounty rewards finding valuable bugs efficiently, so concentrating on high-opportunity assets across the discovered surface maximizes return on limited time.
Practical example
The researcher's discovered in-scope assets include a customer app (auth + payments), an admin app, an API with object-referencing endpoints, a cloud storage bucket, and a static site. Prioritizing, they rank the API (high-value, object-level-authorization potential), the customer and admin apps (sensitive functionality), and the cloud bucket (misconfiguration potential) above the static site. They hunt these first. Prioritization across all asset types focused their effort on the highest-opportunity targets, maximizing the chance of valuable findings.
Cybersecurity relevance
Prioritization across discovered assets is the strategic bridge from discovery to hunting: with a large in-scope surface and finite time, focusing on high-value assets (sensitive apps, APIs, likely-misconfigured cloud, less-tested assets) maximizes impactful, well-rewarded findings — risk-based thinking applied to effort allocation. It consolidates asset discovery — hosts, applications, APIs, cloud assets, and prioritization — which together produce a complete, in-scope asset picture and a ranked plan for where to hunt. This feeds the technology-fingerprinting and endpoint-discovery modules and the actual vulnerability hunting, ensuring effort goes where it counts.
Common mistakes
- Not prioritizing across asset types, spreading effort thinly.
- Ignoring high-value APIs or likely-misconfigured cloud assets in favor of low-value ones.
- Never revisiting the backlog after high-priority assets.
Key takeaways
- Prioritization ranks all discovered in-scope assets (hosts, apps, APIs, cloud) by likely value, focusing limited time on the highest-opportunity targets.
- High-priority factors: sensitive functionality, APIs (object-level-auth potential), newer/less-tested assets, complex apps, and likely-misconfigured cloud assets.
- It is the strategic bridge from discovery to hunting and consolidates asset discovery (hosts, applications, APIs, cloud, prioritization) into a ranked hunting plan.
Check your understanding
- What factors make a discovered asset high-priority for hunting across types (apps, APIs, cloud)?
- Why is prioritizing across the whole discovered surface important for bug bounty return?