(untitled)

Lainons help me! (Also general bug bounty noobies thread) I need to earn money during the holiday as I am low on cash and still studying (this means I can't go to work). I don't want to work as a programmer, I've been doing it whole last summer. I earned 1000$ per month. This job wasn't developing at all I feel like I wasted best holiday at my life (rich kids from my school were sunbathing their asses in some nice places around the world and I've been sitting in front of PC 8hs a day). So you see the picture. I am 19 years old and rather poor. But I am also interested in security and bug hunting. I have played ctfs for a long time and I am getting good at it. I have an idea emerging in my mind about fuarrrking working during summer and focusing on bug bounties. But I am afraid of the risk behind it. If I fail and will not be able to find any bug, I will have to move back to my parents I reduce my expenses to minimal minimum. Tell me your bug bounty stories. How good need one be to earn ~2000$ from it in two months? (I know there is a lot of luck involved in this research but skills are still like 90%). Share your bug bounty stories. And it is also exciting that g00gle pays 31337$ for RCE Such money would improve my life for better a lot.

>>4712 You should absolutely play around and try to break things, but don't expect to get any money from it. Most companies will fix the bug and then sue you for having broken their system, so make sure it's a company with a reputable bug bounty program. Unfortunately companies with reputable bug bounty programs have usually had all the low hanging fruit picked already. Also, there are people with years and years more experience than you going up against the same code. Now of course you only get to those years and years of experience if you start now, so by all means start breaking things, but don't expect to get paid even minimum wage for the hours that you're putting in because it might result in $0.

>>4713 Well, I looked at: https://hackerone.com/hacktivity?sort_type=latest_disclosable_activity_at&filter=type%3Aall&page=1&range=forever and some of the bugs are really low-hanging It's also funny that you can earn 5000$ just by scanning their networks (if they are misconfigured)

>>4714 https://hackerone.com/reports/291057 For example this one. This looks trivial. I know that one need to be lucky to find things like that, but this idea of bug bounty is so temptating

I've been doing bounties on and off since 2016, but I've only managed to find 3 bugs for a program that doesn't offer money. I'm pretty sure I just suck at them, but I keep trying nonetheless. It gets pretty addicting, almost like gambling. I think you should give it a shot, because there a definitely people out there who have seen success off of little to no experience. For example this fella https://www.youtube.com/watch?v=3gWBg8A-uik. (also the others interviews on this channel are pretty nice.) And then there's people like me who can barely find 3 bugs in 2 years. If you do decide to go for it the only advice I feel I can offer is to read as many write ups as you can. Also I'm curious if anyone else's bug bounty journey is as fruitless as mine.

>>4731 I wouldn't get too discouraged based on that info. I don't want this to come off the wrong way, but a lot of the low hanging fruit is taken by hoards of testers in the developing world. You basically have to find some fairly 1337 soykaf or get lucky at this point. The main way the "good" people are reaping consistent bug bounties is "early access" See if you got in early to the bug bounty system, you have a high trust rating and many vendors let you into the bug bounty program before the programs are made public. That's how bug bounty stars keep staying stars despite the glut of labor.