How to learn bug bounty from scratch in 2026

Yes, but you have to be honest about the distribution. According to HackerOne's and Bugcrowd's annual reports, there are roughly 1.2 million registered hunters worldwide. Of them, fewer than 1% earn more than $100,000/year. Most earn between $0 and $5,000/year because they report sporadically or don't apply consistent methodology.

Disciplined part-time hunters (1-3h/day, 5 days/week) who've been at it 12-24 months typically pull in between $15,000 and $80,000/year. Top full-time hunters exceed $200,000-$500,000/year but have 3-7 years of experience, master several categories (web, mobile, API, cloud) and know specific programs deeply.

Honest advice: don't quit your job for bug bounty until you have at least 12 consecutive months earning $3,000-$5,000/month in bounties. Before that, treat it as supplementary income and as an investment in skills that open doors in offensive security (red team, pentesting, application security).

You don't need a cybersecurity master's degree. You do need these foundations before diving into a real program:

• HTTP / HTTPS in detail. Verbs (GET/POST/PUT/PATCH/DELETE), status codes, headers (Content-Type, Authorization, Cookie, Origin/Referer), the difference between body and query string. Without this you don't understand what Burp does.
• HTML + basic JavaScript. Being able to read a rendered page, understand the DOM, tell variables/functions/events apart, and know what JSON is. You don't need to be a dev, but you do need to read 50 lines of JS and understand them.
• Client/server mental model. What happens in the browser vs. what happens in the backend. Why validating on the frontend is never enough. What CORS, httpOnly cookies and sessions are.
• Basic databases. Knowing what a SQL query is and how filters are built. You don't need to administer Postgres — just understand that SELECT * FROM users WHERE id=$1 is safe and SELECT * FROM users WHERE id='+id+' is not.
• Basic command line. curl, grep, jq, ssh. Much of the recon and verification work is done in the terminal. If you can't hold your own with curl, you'll suffer.
• Discipline and notes. The most underrated requirement. Bug bounty is 80% patience + repeatable methodology and 20% technique. Without structured notes and a daily pipeline, you get stuck.

If you don't have these basics, don't frustrate yourself practicing bug bounty first. Spend 3-4 weeks with freeCodeCamp + MDN Web Docs. You'll come back far more efficient.

Start with few tools and master them before adding more. This list covers 90% of bugs in web bug bounty:

• Burp Suite Community

  Essential

  A must-have intercepting proxy. Modify requests on the fly, replay them with Repeater, brute force with Intruder, and discover endpoints with Spider/Crawler. The Community edition is enough for your first bugs.

• Browser DevTools

  Essential

  The Chrome/Firefox inspector is your first recon. Network tab to see every request, Application tab for cookies/localStorage, Console to test JavaScript payloads in real time.

• ffuf / dirsearch

  Recon

  Fuzzing of directories and hidden parameters. ffuf is fast and configurable; dirsearch ships with good default wordlists. Needed to find undocumented endpoints.

• subfinder + httpx

  Recon

  Passive subdomain enumeration + live-host verification. The standard combo to expand the attack surface on a program with a broad scope (*.domain.com).

• sqlmap

  Exploitation

  Automates SQL Injection exploitation once you've detected it by hand. Useful for extracting data fast and proving impact in the report.

• Nuclei

  Recon

  A vulnerability scanner based on YAML templates. Ideal for detecting common misconfigs (open S3, exposed .git, known CVEs) across hundreds of hosts at once.

• Burp Collaborator / interactsh

  Exploitation

  An OOB listener to confirm SSRF, blind XSS, blind XXE and blind RCE. Without it you can't prove a blind bug.

• Notion / Obsidian

  Productivity

  The forgotten one. Your methodology, payloads that worked, recon notes per program, list of pending targets. Without structured notes, you repeat work and miss opportunities.

For an exhaustive list with cheatsheets for each tool, check the Academy cheatsheets section.

These are the classes that get reported most and pay best. Don't try to learn them all at once — master one, jump to the next. Each links to bug bounty labs where you can practice it with real vulnerabilities:

• XSS (Cross-Site Scripting)

  $50 – $10,000+

  Injecting JavaScript into pages other users see. Cookie theft, account takeover, phishing. It's the most reported vulnerability in bug bounty — start here.

  Practice this vulnerability in BBLabs

• IDOR (Insecure Direct Object Reference)

  $200 – $5,000

  You change an id in the URL/body and access another user's resources. It needs no advanced technical skills, just patient methodology. The perfect first bug.

  Practice this vulnerability in BBLabs

• SQL Injection

  $1,000 – $20,000

  SQL injection in parameters concatenated into queries. Lets you read the entire database. Less common today because of ORMs, but the bounties are still high.

  Practice this vulnerability in BBLabs

• SSRF (Server-Side Request Forgery)

  $500 – $30,000

  Forcing the server to make requests to internal URLs. Leads to reading AWS/GCP metadata, scanning the internal network, and sometimes RCE. A favorite of cloud hunters.

  Practice this vulnerability in BBLabs

• CSRF (Cross-Site Request Forgery)

  $100 – $3,000

  Forcing an authenticated user to perform actions without their consent. SameSite bypasses, login CSRF, and combos with XSS are what pays.

  Practice this vulnerability in BBLabs

• Broken Access Control

  $500 – $15,000

  Accessing functions or data that required admin/manager permissions. OWASP A01:2021 — the highest-impact category in the Top 10.

  Practice this vulnerability in BBLabs

• Authentication Bypass

  $1,000 – $50,000

  JWT alg none, badly implemented OAuth state, password reset via enumeration, MFA bypass. Skipping the login is one of the highest possible bounties.

  Practice this vulnerability in BBLabs

• Business Logic Flaws

  $500 – $25,000

  Race conditions at checkout, coupon stacking, price manipulation, limit abuse. No scanner detects these — only the human brain.

  Practice this vulnerability in BBLabs

For complete theory of each category with payloads and bypasses, go to the free BBLabs Academy.

Once you have practice in labs, you register on these platforms to access real programs. Start with public programs with a broad scope. Don't jump to private ones until you have reputation.

• HackerOne

  hackerone.com ↗

  The largest platform. Programs from Shopify, GitHub, Uber, Airbnb, the US Department of Defense. It's where serious hunters go. Reputation is measured in signal/noise ratio.

• Bugcrowd

  bugcrowd.com ↗

  Second in size. Programs from Tesla, Atlassian, Pinterest. Their VRT (Vulnerability Rating Taxonomy) is very well documented — useful for understanding severities.

• Intigriti

  intigriti.com ↗

  A European platform, strong on GDPR/EU. Many private programs accessible to hunters in Europe. Pays in EUR — a plus for Spanish hunters.

• YesWeHack

  yeswehack.com ↗

  French, expanding across Asia. A good entry point thanks to programs with less competition than H1/Bugcrowd. Fast triage and technical staff who understand reports.

Before diving into real programs, you need to practice in legal, controlled environments. These are the real options, with their trade-offs:

• BBLabs

  Recommended to start

  Labs based on real HackerOne, Bugcrowd and Intigriti reports — not artificial CTFs. €7.99/mo, downloadable. Free Academy with payloads and methodologies for 16 categories.

• PortSwigger Web Security Academy

  Free · In English

  Excellent theory and interactive in-browser labs. No downloadable environments or real-report basis, but the content comes from the people who make Burp. Combine it with BBLabs.

• HackTheBox

  ~€14/mo · In English

  Full pentesting machines (web + AD + linux/windows). Useful if you want general pentesting, overkill if you only care about web bug bounty. See comparison: BBLabs vs HackTheBox.

• TryHackMe

  ~€10/mo · In English

  Guided learning paths and rooms for beginners. More accessible than HackTheBox but less focused on real bug bounty. See comparison: BBLabs vs TryHackMe.

• PentesterLab

  ~€37.99/mo · In English

  Web-focused technical exercises. Good quality but a high price and dated UI. Useful for intermediate hunters who already have a base.

• BugBountyHunter.com

  Closed in 2024

  zseano's platform that shut down in 2024. It was a reference for beginners. BBLabs was born in part to fill that gap.

This is the simplified methodology 90% of intermediate hunters apply. No shortcuts: each step builds on the previous one.

1. 1

   Pick a low-competition program

   On HackerOne, filter by public programs launched in the last 90 days with paid bounties (a signal the program pays). Avoid the giants (Shopify, GitHub) until you have experience: they're saturated with top hunters. Better a mid-tier program in a VDP→Bounty migration or a regional one.

2. 2

   Read the program brief in detail

   Scope (which domains/apps you can touch), out-of-scope (what you can't), accepted/rejected bug types (the most common duplicates), and testing rules (rate limits, no DoS, no automated scans on login). Without this, your report gets closed as N/A or you get banned.

3. 3

   Recon: expand the surface

   Subdomain enumeration (subfinder, amass), hidden endpoints (ffuf, dirsearch), tech stack (Wappalyzer, httpx -tech-detect). The bug nobody found is usually in the subdomain nobody looked at. It takes 2-4 hours — don't skip it.

4. 4

   Systematic testing by category

   Apply a checklist per feature: in every form test reflected XSS in each field, in every endpoint that takes an id test IDOR, in every upload test type bypass. Don't zigzag — be systematic.

5. 5

   Confirm impact before reporting

   Having an alert(1) isn't enough. Prove what an attacker does with the bug. Cookie theft? Capture a real session (from your own account, not another user's). IDOR? List 3 accessible resources that shouldn't be. Without impact, the triager lowers the severity.

6. 6

   Report following the program's template

   See section 9. Briefly: a clear title, a 1-2 sentence summary, numbered steps to reproduce, a PoC with screenshots/video, a justified severity, a suggested fix. Professional and to the point.

7. 7

   Wait, respond, don't spam

   Triage takes between 24h and 4 weeks depending on the program. Respond quickly to info requests. Don't send follow-ups before 7 days. Patience shows — and pays off with a trusted relationship with the security team.

If you want to train this flow before touching a real program, BBLabs' bug bounty labs replicate exactly this dynamic: you read a brief, download the environment, exploit the vuln, capture the flag and unlock the writeup.

An excellent bug with a bad report gets closed as Informational. A mediocre bug with an impeccable report gets paid as High. The quality of the report is half the bounty.

The minimum structure triagers at HackerOne, Bugcrowd and Intigriti expect:

• TitleA short title stating what + where. E.g. "Stored XSS via profile bio at /u/<username>".
• Summary1-2 sentences. Which vulnerability, what impact. The triager decides priority just by reading this.
• Severity & ImpactCritical/High/Medium/Low + what a real attacker can do (account takeover, PII read, RCE, ...). No theory — concrete impact.
• Steps to ReproduceNumbered, with exact URLs, exact parameters, exact payload. If a test account is needed, specify how to create it.
• Proof of Concept (PoC)Screenshots, a short video (<60s), or a reproducible curl. Prove it works — don't just claim it.
• RemediationA technical fix suggestion. CSP, parameterization, server-side validation, whatever applies. Shows you understand the bug.
• ReferencesRelated OWASP, CWE, CVE entries. Helps the triager classify the severity.

Every BBLabs lab includes a writeup with this structure so you internalize the format. Afterwards, copying the template into your first real report is trivial.

Learning bug bounty is a continuous process: every year brings new techniques, payloads and bypasses. These are the resources I actively follow:

And inside BBLabs: the Academy (16 vuln categories with payloads), the cheatsheets (Burp, ffuf, sqlmap, ...), and the security dictionary.

• How long does it take to find your first bug bounty?

  It depends on your base. With basic web knowledge (HTTP, HTML, JavaScript) and 1-2 hours of daily practice, 3-6 months to your first paid bounty is normal. The key isn't studying more theory but practicing on real labs and then jumping to low-competition programs.

• Is doing bug bounty legal?

  Yes, as long as you follow the program's scope and rules. Bug bounty is authorized ethical hacking. Attacking out-of-scope systems, DoS, or extracting real user data without permission is illegal and gets you banned (with possible legal consequences). Always read the program brief before testing.

• Do I need to know how to code to do bug bounty?

  Being able to read code (JavaScript, PHP, basic Python) helps a lot. You don't need to be a professional developer, but understanding what the frontend does and being able to interpret backend responses speeds everything up. If you don't code, start learning JavaScript in parallel.

• How much do you earn in bug bounty?

  There are three tiers. Hobbyists: $500-$5,000/year. Consistent part-time hunters: $20,000-$80,000/year. Top full-time hunters: $150,000-$500,000+/year. The distribution is very long-tail — 90% of hunters earn less than 10% of the total. It's not an easy plan B; it's discipline.

• Where should a beginner practice bug bounty?

  Start with BBLabs' free Academy to understand each vulnerability. Then, BBLabs' hands-on labs (€7.99/mo, based on real reports) and PortSwigger Web Security Academy (free, more theoretical). Once you can exploit XSS, IDOR and SQLi by hand, you're ready for public-scope HackerOne programs.

• Which vulnerability should I learn first?

  IDOR. Reason: it requires no advanced technical knowledge, just patience and methodology. You change an id in the URL and access another user's data. Once you master IDOR, jump to reflected XSS, then stored XSS, then SSRF and SQLi.

• Is BBLabs good for starting from scratch?

  Yes. Every lab includes a step-by-step writeup. The Academy is free and covers everything from the basics (what XSS is) to advanced payloads. There are Easy labs designed for hunters who have never reported a bug.

• What's the best bug bounty platform focused on real reports?

  BBLabs is the platform specifically focused on bug bounty with labs based on real reports. For theory there are many resources, but for hands-on practice with real vulnerabilities, BBLabs is the native option.

• What tools do I need to start bug bounty?

  To start, Burp Suite (the proxy to intercept and modify requests) and your browser are enough. As you progress you add recon: subfinder (subdomains), ffuf (path and parameter fuzzing) and nuclei (template scanning). You don't need the whole arsenal on day 1 — mastering Burp is 80% of the job.

• What is the step-by-step process of doing bug bounty?

  It's a repeatable loop: you pick a program and read its scope, recon its surface, apply a per-vulnerability methodology, find and confirm a bug, write the report with impact and collect the bounty. Then you specialize in a category. We break it all down in the how-to-do-bug-bounty guide.