I found my first real vulnerability on a Tuesday afternoon in December 2024. It was a straightforward IDOR — Insecure Direct Object Reference — on a mid-sized SaaS platform. Nothing earth-shattering. But the moment the program triaged it as "Valid — Medium," something clicked. I had gone from reading CVE writeups to writing one.
Here's how I got there in about three months, starting from scratch.
Why Bug Bounty?
I was already studying web security as part of my computer engineering degree and doing the occasional CTF. But CTFs felt disconnected from reality. Bug bounty flipped that: real systems, real impact, real money. Even a $50 payout feels different from a CTF flag — someone actually cared about what you found.
The other reason: it forced me to think, not just memorize. You can't Google your way through a real target.
The Stack I Started With
Before touching a live target, I spent the first three weeks just building my environment and learning the tools:
Burp Suite Community is non-negotiable. Learn it before anything else — the Proxy, Repeater, and Intruder tabs will be your daily workspace. The paid version is better, but Community is enough to start.
OWASP WebGoat and PortSwigger Web Security Academy are the best free practice grounds. PortSwigger's labs are hands-on and cover every major vulnerability class. I completed about 60% of them before going live.
Subfinder + httpx for reconnaissance. Before you test anything, you need to know what's in scope and what's actually alive. These two tools together give you a solid asset map in minutes.
ffuf for directory and parameter fuzzing. Simple, fast, configurable.
I kept everything organized in a single Notion workspace: one page per target, with notes on endpoints tested, parameters found, and hypotheses to check.
Choosing the Right Platform
I started on HackerOne because the disclosure policies are clear and the program variety is good. For beginners, I'd suggest filtering for programs with:
- A "New" label (less competition)
- A defined scope that's not too broad
- A response time SLA (so you're not waiting weeks for triage)
Avoid the huge tech companies at first. Their attack surfaces are enormous, their bug classes are well-documented, and tens of thousands of researchers are already hunting them. Find a smaller program in a niche you understand.
My First Three Months: What I Actually Did
Month 1 — Setup and study. PortSwigger labs, Burp Suite setup, reading past disclosed reports on HackerOne. Reading old reports is massively underrated — you learn what testers missed and what they found.
Month 2 — Passive hunting. I tested two programs without finding anything valid. I reported one false positive (embarrassing but educational). I started keeping a "patterns" document — things I noticed that weren't bugs but felt off.
Month 3 — Active hunting with hypotheses. Instead of just clicking around, I started forming specific hypotheses before I tested. "This endpoint takes a numeric ID — does it validate ownership?" That IDOR came from exactly this shift in mindset.
Mistakes I Made (So You Don't Have To)
Testing out of scope. I almost reported something on a subdomain that wasn't in scope. Read the policy twice before you even start recon.
Reporting too fast. My first report was sloppy — I hadn't confirmed reproducibility and my PoC was incomplete. Slow down. A well-written report with a clear PoC gets triaged faster and signals professionalism.
Chasing P1s too early. Critical vulnerabilities exist, but they're rare and usually require deep knowledge of the target's architecture. Start with P3/P4. You'll learn more and actually earn payouts.
The Honest Numbers
In my first three months: 1 valid medium ($150), 2 informational, 4 duplicates, 1 N/A. Not impressive. But enough to confirm the approach worked and to get noticeably better at identifying patterns.
The learning curve is steep at the start and then compounds quickly. The researchers who stick with it for six months are far better than they were at month one — not because they found more bugs, but because they developed intuition.
Resources I Actually Used
If you're just starting out: don't wait until you feel ready. Set up Burp Suite, finish 10 PortSwigger labs, pick a small program, and start testing. The feedback loop of real bug hunting teaches you faster than any course.
Questions? Reach out — I'm happy to point you in the right direction.