Bug Bounty Hunting 101

What bug bounty is (and isn't)

You're paid by companies for finding and responsibly disclosing real security bugs. You are not free to attack anyone — read the program scope carefully.

Programs to start with

• HackerOne, Bugcrowd, Intigriti — the major platforms.
• GitHub Security Lab — pays well for impactful findings.
• Look for programs with *.example.com wildcards rather than a single host — more attack surface.

Writing reports that get paid

A good report has:

1. Title — vulnerability + impact in one line.
2. Steps to reproduce — numbered, paste-able commands.
3. Impact — what an attacker actually gets.
4. Suggested fix — optional but it helps the triager rank it.

Avoid:

• Theoretical findings ("could lead to XSS in some configurations…")
• Volume-spam from automated scanners (P5 noise)
• Out-of-scope hosts even if you found something cool

A first-30-days plan

• Pick one program. Deep > wide.
• Map subdomains (subfinder, amass).
• Look for old / forgotten apps — they're where the bugs live.
• Try the boring stuff first: IDORs in numeric ids, SSRF in URL params, missing auth on internal endpoints.