A program pays attention when you can show a real effect on an app you were allowed to test, in steps another person can follow. At Computer Education And Cybernetics (CEC) you learn that on lab web apps and APIs: read the scope, confirm one flaw, and write the report. Screenshots without impact are the submissions that get closed.
Or reach us directly
+91 75740 10176 · info@cecyours.org
Four moves before you submit
You filter by scope, confirm one effect on an app you may test, and describe that effect so a stranger can see it. Anything else is noise.
A high-signal vulnerability report names an asset inside the program’s published scope, states a concrete impact, and gives the shortest steps another person can repeat, with secrets removed. Scanner output and out-of-scope hosts are spam. Computer Education And Cybernetics (CEC) teaches this standard on lab web apps and APIs in Ahmedabad and does not promise payouts.
A program publishes the hosts, apps and APIs you may test, and the ones you must leave alone. You collect candidates with recon, then delete every result the rules do not name. A true bug on a forbidden host is still the wrong submission.
Triagers look for a consequence: another user’s order, a price the server should have rejected, a login that should have stopped you, an internal address the app fetched for you. A scanner line with no consequence is spam, even when the tool name is famous.
You keep the accounts, the requests and the result. You remove tokens, passwords and anything that is not needed to see the effect. High severity comes from the data or the action you showed, not from extra steps you only imagined.
You send the report to the program — on platforms such as HackerOne or Bugcrowd, or to the contact the company lists. You do not post the finding publicly while they are still fixing it, and you do not test past the invitation.
Six classes. For each one you confirm a single effect on a practice app, then you write only that effect.
Confirm. Walk the real journey on a practice shop and note where a rule is skipped, doubled or trusted from the browser.
Write. Which rule broke, what a customer could gain, and the two requests that show it.
Confirm. Change an id the app uses — an order, a file, a profile — and see whether the server checks ownership.
Write. Whose record opened, which fields were visible, and that you used only test accounts.
Confirm. On a deliberately vulnerable lab app, see user input reach a database query and return data it should not.
Write. What the database exposed, and that parameterised queries are the fix. You do not run this on a live site.
Confirm. On an isolated lab target, see the server request a place you chose, including an address only the server can reach.
Write. What internal resource responded, and that the lab — not a company’s network — was the target.
Confirm. Map login, reset and session checks on a practice app and find the one check that is missing or confused.
Write. Which account you reached and which check failed. You do not claim access you did not get.
Confirm. Spot a company name that still points at a service the company no longer controls.
Write. The dangling reference and the risk. You report it. You do not claim the name.
A check you do on paper first
Before you open a report form, answer three questions: Is this asset on the allowed list? What can another person actually do or see? Can I show that with the requests I saved? If one answer is no, you are not ready to submit.
Logic flaws hide in ordinary shopping steps. This one is on a practice checkout we control. The lesson is the report, not a trick you reuse on a live shop.
A practice checkout shows ₹1,000 in the cart. A coupon field says “10% once per order.” You are allowed to test this app. You are not allowed to test the shop next door on the internet.
You apply the coupon. The page shows ₹900. In the proxy you notice the browser sends the final total, and the server stores that number without recalculating the discount.
You send the same request again with a lower total. The server accepts ₹810. The rule “once per order” lived only in the page, not on the server. That is a business logic flaw.
Any customer can stack a one-time coupon by repeating the request, so the shop charges less than its own rule allows. You rate it by the money the shop would lose, not by how clever the request felt.
Two requests, both totals, the test account, and the missing server check. No extra claims about emptying the database. A triager can repeat those two requests and see the same prices.
An honest limit: most new hunters earn little or nothing from programs at the start. We will not tell you a lab coupon bug turns into income. The skill that transfers is proving a rule the server forgot to enforce.
Three changes already decide which reports get read. In class you hold an AI-drafted paragraph next to your saved requests and strike every line the requests do not support.
Public programs already receive floods of low-effort reports. AI makes a weak write-up faster to produce, so triagers spend their time on the few that match real evidence.
Recon and proxy macros catch missing headers and known patterns quickly. Those findings pay less. Logic flaws and access bugs a scanner cannot see stay worth a careful report.
Companies list exact hosts and reject anything outside them, including duplicates of issues they already know. Reading the page before you test is part of the skill.
Where an assistant still fails you
What stays valuable
Judgement. You decide what you actually proved, what you only suspect, and whether the program allowed you to look. Scripts and assistants speed up collection. They do not make that decision.
Paid bug bounty reporting is shifting as automation and AI increase low-effort submissions, so programs weigh concrete impact, logic flaws and strict scope more heavily. The durable skill is judging what you proved and whether you were allowed to test it, which CEC trains in Ahmedabad.
About 80% of our training is practical. Our 25+ full-time corporate trainers read your draft the way a triager would: Is the asset allowed, is the impact real, and can someone else repeat the steps?
School learners of any grade start with counseling. After 12th anyone can apply, from any stream. If web requests are still new, we start you on the cyber security course, then move you into hunting drills.
You script subdomain and path collection against a lab range, then throw away every host that is not on the allowed list. Speed without that filter is how people test the wrong company.
You do not collect ten screenshots. You take one logic flaw or one access bug on a practice app and rewrite it until impact, steps and evidence fit on a single page.
A web-testing proxy such as Burp Suite shows the request the app really sent. You intercept, change one value, and repeat. A paid Pro licence is not required to learn that, and we do not promise to supply one.
You may ask an assistant to outline sentences. You then delete every line you cannot point to in your own saved requests.
Programs decide rewards. Many accepted reports pay little or nothing, especially at the start. We treat hunting as a skill you can show an employer, not as income we can promise.
These labs sit inside our Cyber Security & Ethical Hacking with AI course. Counseling decides whether you start with foundations or with hunting drills.
What we will not tell you
Nayan Nathani
Software Faculty · CEC Maninagar · 2+ years
Data Analytics, Cyber Security
Nishant Yadav
Hardware Networking · CEC Nikol · 3+ years
Cyber Security, Server Administration
At Computer Education And Cybernetics (CEC) in Ahmedabad, bug bounty training starts with counseling, then lab practice on web apps and APIs we control. Learners script recon, discard out-of-scope results, confirm one flaw, and rewrite the report until a mentor can repeat it. CEC does not promise payouts from programs such as HackerOne or Bugcrowd.
A clear lab report is also something you can show an employer. We help you with the job. We do not chase a bounty cheque for you.
How we stay with you
More detail on placement support at CEC.
Finding a flaw is the start. How you report it decides whether you helped the program or created a new problem.
Test only assets, accounts and methods the program allows. If the rules say “do not test payments,” you stop at payments even when you can see a flaw.
Show enough to make the impact undeniable: the accounts, the requests, the result. Do not pull extra data, change other users’ records, or keep going once the point is made.
Remove session tokens, passwords and personal data that the triager does not need. A report that leaks a real customer’s details creates a second incident.
The program needs time to fix the issue. Posting a write-up, a screenshot thread or a proof while the fix is open helps the next attacker more than it helps you.
Responsible disclosure means you test only what a program invites, prove the smallest impact that makes the issue clear, remove secrets from the evidence, and wait before any public write-up. Computer Education And Cybernetics (CEC) teaches that standard in Ahmedabad on lab apps, and applies the same limit to any live program a learner later joins.
Counseling is available at Maninagar, Nikol and Vatva, or by call, WhatsApp or email from anywhere. Visiting is optional.
~2 minutes from Maninagar Railway Station
2nd floor, Gopal Tower, Computer Education And Cybernetics, near Maninagar Railway Station Road, Maninagar, Ahmedabad, Gujarat 380008+91 75740 10176Near / opposite New DMart, Nikol (Satyam Plaza)
S -25/26, D-mart, Satyam Plaza, Raspan Cross Rd, opp. Suketu Residency, near Nikol, Ankur Chokadi, New India Colony, Nikol, Ahmedabad, Gujarat 382350+91 91049 37871Near Vatva Lake Garden; opposite Kashiben Hospital
1st Floor, Computer Education And Cybernetics, Opposite Kashiben Hospital Beside Khodiayar Vav, Near Vatva Lake Garden, Vinzol Crossing Rd, Deriya Para, Vatva, Ahmedabad, Gujarat 382440+91 91571 90839If your question is about a specific program’s rules, bring that page to counseling. We will read the scope with you.
A company publishes a program: which apps and APIs you may test, which techniques are forbidden, and how to send a report. You look only inside that list, confirm a real impact, and submit steps someone else can repeat. Platforms such as HackerOne and Bugcrowd host many of these programs. Testing a site that has not invited you is not a bounty. At Computer Education And Cybernetics (CEC) you practise the same sequence on lab apps first.
A course cannot promise that. The program decides whether a report is valid and what, if anything, it pays. Many hunters go a long time before a submission is accepted, and many valid reports pay little or nothing. We teach you to write a high-signal report and to stay in scope. Any reward is between you and the program.
A high-signal report names an in-scope asset, states who is affected, gives steps a triager can follow, attaches evidence with secrets removed, and suggests a fix. Spam is a screenshot, a scanner line, an out-of-scope host, a duplicate, or an impact you did not demonstrate. Programs close spam quickly, even when a real bug is hiding in it.
Business logic flaws, insecure direct object references, SQL injection, server-side request forgery, authentication bypass and subdomain takeover. You also practise recon that throws away out-of-scope results, and a proxy habit for seeing and repeating one request. Each class is confirmed on a lab app, then written up. We do not practise on random websites.
The app trusts an identifier, such as an order number, and does not check that the logged-in user owns that record. On a practice app, changing the number can reveal another test user’s data. A good report shows that access and stops there.
You need the habit of intercepting a request, changing one value and reading the response. We teach that with a web-testing proxy such as Burp Suite. A paid Pro licence is not required to learn the method, and we do not promise to provide one.
Yes, if you can use a browser and are willing to learn how a web request works. After 12th anyone can apply, from any stream. Counseling will start you on foundations when networking or web basics are still thin, then move you into hunting labs.
You hunt on practice apps we control, script recon and then discard out-of-scope results, and rewrite one report until a mentor can repeat your steps. AI may draft wording; you delete every claim your own requests do not support. Counseling at Maninagar, Nikol or Vatva — or by phone — decides where you start.
AI and automation increase low-effort submissions, so programs pay more attention to concrete impact, logic flaws and strict scope. Obvious bugs found by scripts are worth less. The durable skill is judgement: what you proved, what you did not, and whether you were allowed to look.
Counseling is available at our three Ahmedabad centres — Maninagar, Nikol and Vatva — or by call, WhatsApp or email on +91 75740 10176 or info@cecyours.org. Visiting is optional.
Tell us what you already know about the web. We will say honestly whether you start with foundations or with hunting labs — and we will not promise you a payout.