How to Start Bug Bounty Hunting

Bug bounty is a different path than pentesting: no client engagement, no fixed scope handed to you by an employer, and no guaranteed payout for time spent. It rewards a specific kind of persistence — testing a lot of surface area, methodically, for a payout that isn't guaranteed. That's worth knowing going in, before the rest of this roadmap.

This assumes the fundamentals from the general ethical hacking roadmap — this isn't where you learn HTTP or Linux basics for the first time.

Pick a platform and read the rules before touching anything

HackerOne, Bugcrowd, and Intigriti are the major platforms. Every program has a written scope and a set of rules — what's in scope, what's explicitly excluded, what testing is disallowed (no automated scanning against production for some programs, no social engineering, no DoS testing). Read this before you test anything. Testing out of scope isn't a gray area; it can get your account banned or worse.

Start with recon, not exploitation

Most real bounties come from finding assets or endpoints other researchers haven't looked at yet, not from finding a novel exploit technique. A basic recon workflow:

Subdomain enumeration against the in-scope domains
Resolve and screenshot live hosts to see what's actually running
Look for forgotten/staging subdomains, exposed admin panels, and old API versions — these get missed far more often than the main application

Depth of recon is a real competitive advantage here — a lot of hunters skip straight to testing the obvious main application and miss everything else in scope.

Vulnerability classes worth focusing on early

IDOR (Insecure Direct Object Reference) — changing an ID in a request to access another user's data. Simple to test for, still extremely common in real programs.
Broken access control generally — role/permission checks enforced client-side or inconsistently server-side.
XSS, especially stored XSS in less-obvious input fields (profile fields, file uploads, support ticket forms)
Business logic flaws — things a scanner will never find, like a checkout flow that doesn't validate a price server-side, or a workflow that can be replayed or reordered to skip a step

Burp Suite is the core tool for all of this — get comfortable with Repeater and Intruder before you start hunting seriously.

Writing a report that actually gets triaged

Clear, numbered reproduction steps — assume the triager has never seen the application before
A concrete statement of impact, not just "this is a vulnerability" — what can an attacker actually do with this
A proof-of-concept (screenshot, video, or request/response pair), not just a description

A well-written report on a moderate-severity bug often gets resolved and paid faster than a poorly-written report on something more severe.

Common mistakes

Testing out of scope, deliberately or by not reading the program policy carefully
Submitting duplicates without searching for existing reports first — most platforms show you if a report was a dupe, and repeated dupes hurt your reputation score
Chasing every program at once instead of going deep on a few. Familiarity with a specific application's quirks finds more bugs than breadth across dozens of programs you've only glanced at
Automated-scanner-only testing. Scanners find the same shallow issues everyone else's scanner already found. Manual testing on overlooked surface area is where the real bounties are

Realistic expectations

Very few people make full-time income from bug bounty, especially in the first year. Most successful hunters treat it as a way to sharpen real-world skills and earn supplemental income, not a guaranteed replacement for a job. Programs with less competition (smaller/newer programs, private invite-only programs you get invited to after building reputation) tend to pay better relative to time spent than the largest, most-hunted public programs.

Next step

If you're not yet comfortable reading and manipulating raw HTTP requests, go back to Burp Suite fundamentals before spending real time hunting — it's the tool you'll live in. If the target is an AI-powered feature rather than a traditional web app, see how to start hacking AI — it's a distinct vulnerability set with its own growing bounty scope.