CBBH practice examsIn development
HTB Certified Bug Bounty Hunter
Bug bounty hunting as a paid discipline: scope checked first because an out-of-scope finding earns nothing, reconnaissance mapped widely to reach the forgotten subdomain and old API, and the injection, file and inclusion classes each confirmed with a minimal deterministic proof; then cross-site scripting proven by real impact, IDOR and business logic flaws found by comparing two accounts, API authorisation tested endpoint by endpoint, and a clear honest report that turns a bug into an accepted, paid finding.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Reconnaissance and the core web vulnerabilities | Not published |
| Client-side, access control and reporting | Not published |
Two sample questions
1. Which JSON Web Token flaw arises from confusing a public key with a shared secret?
- An asymmetric token verified as symmetric, so the public key forges it — correct
- A token whose algorithm header is set to none and is therefore unsigned
- A token whose expiry claim the server neglects to check on each request
- A token whose signature is verified against a key from the header itself
Why: If the verifier is persuaded to treat the algorithm as symmetric, the publicly known key becomes the signing secret, which allows anyone to produce a valid token.
2. Why can a timing difference confirm blind injection?
- A conditional delay reveals execution — correct
- Timing is unrelated to injected input
- The response body shows the data
- Timing reflects network latency alone
Why: If an injected conditional sleep changes response time, it confirms the input is being executed by the backend.
The real CBBH exam
| Length | 7 days |
|---|---|
| Questions | Practical: live web targets scored on flags plus a graded report |
| Pass mark | A defined flag threshold and an acceptable vulnerability report |
| Price | Included with the academy path subscription; a voucher is issued on completion |
| Recommended before you sit it | Completion of the bug bounty hunter path in the HTB Academy. |
| Valid for | Does not expire |
Exam facts as published by Hack The Box; always check the vendor’s page before you book.
Study CBBH with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.