How to set up your bug bounty environment

Choosing your operating system

The first step is picking an operating system that lets you work comfortably with security tools. The most popular options are:

Kali Linux

The best-known pentesting distribution. It ships with hundreds of preinstalled security tools. It's ideal if you want to get started fast without configuring too much.

# Update Kali after installing it
sudo apt update && sudo apt upgrade -y

Parrot OS

Similar to Kali but lighter and more privacy-focused. It includes development tools on top of the security ones. A good alternative if your machine has limited resources.

Ubuntu/Debian + manual tooling

If you prefer total control over your setup, you can start from a clean Ubuntu and install only what you need. This option is ideal for cloud environments (VPS).

Virtual machines vs. native install

If you use Windows or macOS as your main system, you can run any of the above in a VM with VirtualBox or VMware. The upside is isolation; the downside is performance.

Essential tools

Burp Suite

This is the fundamental tool for bug bounty. It works as an intercepting proxy and lets you analyze, modify and replay HTTP requests.

# The Community edition is free
# Download it from portswigger.net
# The Pro version (~$449/year) is worth every cent if you do this seriously

Must-have Burp extensions:

• Autorize: Automated authorization testing
• Logger++: Advanced request logging
• Param Miner: Discovering hidden parameters
• Turbo Intruder: High-speed fuzzing

Reconnaissance tools

# Subfinder - Subdomain enumeration
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# httpx - Live host probing
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

# Nuclei - Template-based vulnerability scanner
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# ffuf - Fast web fuzzer
go install github.com/ffuf/ffuf/v2@latest

# Amass - Advanced subdomain enumeration
go install -v github.com/owasp-amass/amass/v4/...@master

Additional handy tools

# gau - Fetch known URLs of an application
go install github.com/lc/gau/v2/cmd/gau@latest

# waybackurls - Historical URLs from the Wayback Machine
go install github.com/tomnomnom/waybackurls@latest

# gf - Filter patterns in URLs (XSS, SSRF, SQLi, etc.)
go install github.com/tomnomnom/gf@latest

# qsreplace - Replace query string values
go install github.com/tomnomnom/qsreplace@latest

Browser extensions

Install these extensions in Firefox or Chrome:

• FoxyProxy: Manage proxies easily (switch between Burp and a direct connection)
• Wappalyzer: Identify the technologies a site uses
• Cookie Editor: View and modify cookies
• HackBar: A toolbar for quick injections

Note-taking and organization

Notion or Obsidian

Keeping organized notes is crucial. Build a structure like this:

📁 Bug Bounty
  📁 Programs
    📁 Program_X
      📄 Scope and rules
      📄 Recon (subdomains, endpoints)
      📄 Vulnerabilities found
      📄 Reports submitted
  📁 Techniques
    📄 IDOR
    📄 XSS
    📄 SSRF
  📁 Tools
    📄 Cheatsheets
    📄 Custom scripts

Organizing targets

For each program, create a directory with this structure:

mkdir -p ~/bounty/program_x/{recon,vulns,screenshots,notes}

# recon/     → Subdomain, port and URL results
# vulns/     → Vulnerability evidence
# screenshots/ → Screenshots
# notes/     → General notes

Basic automation

Create an initial recon script that you run for every new target:

#!/bin/bash
# recon.sh - Basic automated reconnaissance
DOMAIN=$1
OUTPUT=~/bounty/$DOMAIN/recon

mkdir -p $OUTPUT

echo "[*] Enumerating subdomains..."
subfinder -d $DOMAIN -silent | sort -u > $OUTPUT/subdomains.txt

echo "[*] Probing live hosts..."
cat $OUTPUT/subdomains.txt | httpx -silent > $OUTPUT/alive.txt

echo "[*] Fetching known URLs..."
cat $OUTPUT/alive.txt | gau --threads 5 > $OUTPUT/urls.txt

echo "[*] Scanning with Nuclei..."
nuclei -l $OUTPUT/alive.txt -severity medium,high,critical -o $OUTPUT/nuclei.txt

echo "[+] Reconnaissance complete for $DOMAIN"
echo "[+] Subdomains: $(wc -l < $OUTPUT/subdomains.txt)"
echo "[+] Live hosts: $(wc -l < $OUTPUT/alive.txt)"
echo "[+] URLs collected: $(wc -l < $OUTPUT/urls.txt)"

chmod +x recon.sh
./recon.sh target.com

Proxy configuration

Configure your browser to route traffic through Burp Suite:

1. Open Burp Suite and go to Proxy > Options
2. Check that it's listening on 127.0.0.1:8080
3. Set up FoxyProxy to send traffic to that port
4. Import Burp's CA certificate to intercept HTTPS

Conclusion

You don't need every tool from day one. Start with Burp Suite, subfinder and httpx. Add tools as you need them. The most important thing is developing a consistent methodology and keeping your notes organized. The perfect setup is the one that lets you be efficient and not waste time hunting for previous results.