Try to ask in tripadvisor.com
Myself used public transport.

My own itinerary was:
D1: arriving in Surabaya, spent the night at city center (near the not-so-Chinese China Town)
D2: take cab to bus station; take bus to Probolinggo, then take mini bus to a small town near Bromo
D3: Bromo sunrise tour; after that depart for Ijen Crater
D4: visiting Ijen Crater in the morning, then return to Probolinggo
D5: take bus to Malang
D6: return to Surabaya Airport; depart for Malaysia

On retrospect, I found Surabaya to be disappointing. I suggest that you go straight to Probolinggo and spend your first night there. Catch a mini bus to Bromo the next morning.
If you hire driver, you may head to Bromo on the first day.

Note that I joined a group tour to Ijen Crater. I asked the hotel front desk to arrange for it. My 3rd day was particularly hectic, as I rushed to Ijen Crater after the Bromo sunrise tour (also arranged by the hotel), with just 1 hour for shower and breakfast. If you have extra time, spend another day in Bromo and visit nearby villages. You'll need a 4x4 for that.

Malang was a place to savor Javanese food as well as for shopping.

I haven't been to Madakaripura waterfall, so I can't commend on this.

Forgot to add...
Mini buses from Probolinggo to Cemero Lawang have no fixed schedule, but instead depart only when they are full.

When I was there, the bus was not full. The other passengers and I decided to pay for the 'empty seats' to get the bus going.
But it turned out that the bus kept picking up passengers along the way. Before reaching Cemero Lawang, the bus was so full that some secondary school girl students had to hang outside it 

DIY is more fun
But since u have time constraints, tour may be a better option

Lol i dunno them,  i just thought this would be an interesting video to share

When u going btw?

wondering is it safe to go and explore Surabaya, Bromo and some other places nearby for single female traveler? This will be my 1st time traveling alone to Indonesia. I heard the public transport there (Surabaya) is not bad but don't know how reliable they are. And the local as well.