How to do bug bounty, step by step

The 6 steps to do bug bounty

It's not magic or luck: it's a repeatable process. These are the steps you run on every program, in order.

1. 1. Pick a platform and program (and read the scope)

   Sign up on HackerOne, Bugcrowd, Intigriti or YesWeHack and pick a program with broad scope (many subdomains) and a good payout reputation. Read the scope and out-of-scope carefully: half of rejected reports are for attacking something out of scope. Start with VDPs or beginner-friendly programs if it's your first time.

2. 2. Reconnaissance (recon)

   Map the whole surface: enumerate subdomains (subfinder, amass), discover endpoints and parameters (ffuf, gau, waybackurls), fingerprint technologies (Wappalyzer) and read the JavaScript for API routes and keys. The goal is to have more surface than other hunters — bugs live where nobody looks.

3. 3. Apply a per-vulnerability methodology

   Don't test at random. For each feature, walk the vulnerability classes with a checklist: access control and IDOR, XSS, SSRF, injections, CSRF, business-logic flaws, file upload, open redirect… Prioritize what pays most and what the security team covers worst (no scanner catches business logic).

4. 4. Find and confirm the bug

   When something behaves oddly, isolate it with Burp Suite: replay the request, change an identifier, try a payload, watch the response. Confirm it's genuinely exploitable (real impact), not a false positive. A bug you can't reproduce reliably isn't a reportable bug.

5. 5. Write the report

   A good report gets paid; a bad one is closed as duplicate or informative. Include: a clear title, business-impact summary, numbered reproduction steps, a proof of concept (request/video) and a suggested mitigation. Write for the triager reading it in a hurry.

6. 6. Get paid, learn and specialize

   When the program validates the bug, you earn the bounty. Read every public report in your category, tune your checklist with what you missed, and specialize in 1-2 vulnerability classes: specialization is what separates a one-bug-a-year hunter from one who does this for a living.

What you need to start doing it today

• Web fundamentals: HTTP, cookies/sessions, HTML and some JavaScript.
• A proxy: Burp Suite (Community works to start) or Caido.
• Understanding of the most common vulnerability classes (OWASP Top 10).
• An account on a bug bounty platform and patience — the first bugs take time.

You don't need to be a senior programmer or have a certification. You need method and practice on real bugs.

A web hunter's basic stack: Burp Suite (proxy), subfinder/amass (subdomains), ffuf (path and parameter fuzzing), nuclei (template scanning), httpx and gau/waybackurls (URL recon). You don't need all of them from day 1.

• Attacking out of scope — rejected report and a hit to your reputation.
• Skipping recon and only testing the main page (where 500 hunters already looked).
• Chasing what everyone chases (reflected XSS in the search box) instead of business logic.
• Not reading public reports — you repeat mistakes others already documented.
• Giving up after a week. The first bug can take weeks; that's normal.

Frequently asked questions

• How long does it take to find the first bug?

  It depends on your baseline and hours, but taking several weeks to a few months with consistent practice is normal. Practicing on replicated real bugs speeds it up a lot because you train your eye before hitting a live program.

• Do I need to know how to program to do bug bounty?

  Not at a senior level. You need to understand HTTP, HTML and some JavaScript to read responses and modify requests. Programming helps automate recon, but it isn't a requirement for your first bugs.

• Is doing bug bounty legal?

  Yes, as long as you stay within the scope of a program that explicitly authorizes testing. Attacking systems without authorization is illegal. That's why you practice on labs (your own safe environments) and then on programs with permission.

• How much do you earn doing bug bounty?

  It varies enormously: from bounties of tens of euros for low-severity flaws to thousands for critical vulnerabilities. Top hunters do it full-time, but most start alongside studies or a job. Consistency and specialization are key.

• I'm a total beginner, where do I start?

  Start with web fundamentals and the vulnerability classes, then practice each on labs before touching a live program. We have a dedicated guide on how to learn bug bounty from scratch linked above.

Keep going