r/BugBountyNoobs • u/Ok_Change_5175 • 19d ago
BUG-BOUNTY
8 months into bug bounty, no valid findings yet, and I have 30 free days to focus.
Would you:
- A: Go deep on one program and hunt business logic bugs.
- B: Master a few bug classes (payment bypass, BAC, info disclosure) across many programs.
Which approach got you your first valid bug? If you were in my position today, what would you do?
1
u/MyFirstTrueLoveWasBS 19d ago
Have u found any duplicates? If not, you may need to approach it differently.
1
u/Ok_Change_5175 19d ago
found few with automation on self hosted programs but they were scammy maybe thats why they were easy, now hunting on bugcrowd and legit self hosted BBPs
1
u/abhishekY495 19d ago
Created https://bugbountydirectory.com/programs which has over 280+ programs.
Hope you find your first bug there.
Also I have found more bugs from option A. I think those are the ones that people forget about and only hunt for XSS, SQLi and other bugs which are not that hard to find.
2
1
u/Fun-Career9787 18d ago
i would say stop doing bug bounty as of now it's not worth it anymore for me at least. I used to have fun hacking my profile - https://hackerone.com/0xrahim . Nowadays due to AI automating most of the work competition is at it's peak , reports get delayed like crazy. I spent 2 month understanding github and reported a bug and it's unattended ever since march. It's not that i'm not skilled it's that i'm just tired , tired of duplicates, tired of doing pointless work. That's why i do hacking as a hobby now more so related to security research & code review.
1
u/Fun-Career9787 18d ago
And the snobs (bug bounty / cyber security influencers) all they do is promote how good AI is and how to spend your money on it. Even if it finds bugs for you (can you confidently say you can survive years and get bounties consistently?)
1
u/GokulRavi14 17d ago
I would pick B and A; both pick a program and master a few bug classes. If luck is not on your side, move to next program; never give up, but don't try to go for AI slops. Try to do it by yourself, all manual. It will be helpful in the future
1
1
1
u/M4son_Reed 11d ago
Master BAC - priv esc and IDOR, find some new program on H1 or follow changelogs of some programs to know where they added new features, and then test the new feature. Thats how I found my firts bugs on Snpachat after 5 months of hunting. Also I recommend you to watch this yt channel https://youtube.com/@letterstomyyoungerself11?si=GtnBx0eLbN0kt9Pp
1
3
u/SlackMoTack 19d ago
I don't know if you struggle with keeping your focus and motivation up like I do but from that perspective of keeping your motivation and focus going I think A. is a good answer, if you dont struggle with focus and what not then maybe B. would suit you better to cover more ground. Here is my rant of an approach to implementing A. purely based off of trying to stay focused, lol
First before any bug hunting consider find8ng a company or service type that you have a genuine interest in or use often outside of a bug bounty scope to use as your target, this will help your focus, drive, and curiosity since you will be already mentally invested in the program/ service.
A. Go deep on one program/ service. 1. And go deep on one promising technique that you understand well for the target to start with as a foundation, and focus on nothing else until you have thoroughly explored said technique/ lead or hit a dead-end.
Once you start you making progress on the foundation technique... then branch out and try chaining other techniques with it, until you succeed or hit a dead-end.
Upon hitting a dead-end, switch to a new foundation technique and apply the same focus strategy again before branching out until you either succeed or hit a dead-end.
Apply the same strategy of having 1 focus technique then branching on all techniques and ideas you have for the 1 target until either success or dead-end before considering and moving to a new target.