How My First Two Bug Bounty Reports got rejected?

Imagine spending 3 months trying to understand networking, linux basics, completing tryhackme, hackthebox, picoctfs and portswigger labs so that you can grasp as much as information in order to earn that little bit bounty amount to give boost to your ego also add the tag of beginner bug bounty hunter.

I have been also the victim of this mentality. I am saying victim because, thinking about and doing bug bounty is totally different thing and let me remind you that I totally chose the wrong way to find the bug on the 2 targets where my 2 reports has been rejected. It was so frustrating and it reminded me that I am playing this game with only the purpose of earning that title, earning that monetary reward.

So I picked this one BBP and dive into it not so deeply. That's where everything had gone wrong. I read lots of medium articles where the writers or the bug bounty hunters are saying it loud that manual recon is only the next big thing in the bug bounty. And I don't know why I didn't listen to that advice which costed me 4 whole days doing automated recon.

I chose the program set up caido and fire up opencode and loaded all the bug bounty skills thaty I find on the internet. And wrote a little prompt into it that: "Plan the attack surface and find something related on this target and also give me the steps to reproduce this bugs so that I can submit the report on the BBP." Funny isn't it? I know but that long waiting hours for doing manual recon and finding nothing will be so frustrating to me. Opencode was doing its thing loading my tools and find something that he got from the skills that I injected into it.

But after a while it hallucinated very badly, only asking me for the tokens and asking me the sudo password which obviously I was not going to give it. I am not that much of a fool :). And doing this for exact 4 days (2 days on each program). The only thing opencode has given me that it founded CORS on both the website. I instantly asked him, how much bounty will I get? And he said that as low as 50$ which was fine to me but I was wrong there. I created two reports that too using ai with some steps to reproduce the bugs and submitted it.

After two days, I got the mail from one platform that my report has been marked as informative and another mail said that my report has been rejected. I felt depressed and demotivated not because my reports got rejected but because I didn't do anything other than giving prompts. This thing arises the question in my mind that, manual recon and understanding the target are more important things than finding the bugs which I will be doing from now on. Of course I will use ai to reduce the manual tasks or to read the javascript code but I will make sure that I will be doing all the manual things that I need to do all by myself.

This 4 days has taught me that BugBounty is not easy money scheme and with the rise of AI in it made it way different that it was used to be. I encourage all of you who are reading this that Don't give up. Do manual tasks where it is needed to and use AI as your buddy not your servant.

Till then peace :)