From Zero to Bug Hunter: My First Real Vulnerability and Why You Should Start Today

Hi, I'm Sukhveer.

If you are reading this, you probably know me as a security researcher or a bug bounty hunter. But a few years ago, I was just a guy with a laptop, a lot of curiosity, and absolutely no idea where to start.

I used to read blog posts by famous hackers and think, "How do they find these bugs? They must have superpowers."

The truth? They don't have superpowers. They just learned how to look at the internet differently.

Today, I want to share my story — specifically, how I found my first real vulnerability. This isn't a story about a million-dollar payout or a super complex exploit. It's a story about a simple mistake that changed how I look at websites forever.

If you are trying to get into cybersecurity or bug bounties, this is for you.

The "Aha!" Moment

When I started, I spent weeks watching videos on "SQL Injection" and "Cross-Site Scripting (XSS)." I learned the theory, but every time I opened a target website, my mind went blank.

I felt stuck.

Then, I changed my approach. Instead of trying to hack the whole website, I decided to just try to break one small feature.

I picked a target (let's call it redacted.com). It was a private program, so I can't share the name, but the story is what matters.

The Bug: It Wasn't Magic

The website had a "Contact Us" form. You know, the boring box where you type your name, email, and message.

Most beginners skip these forms. They think, "What could go wrong here?"

I filled it out normally. Nothing happened. Then I thought, "What happens if I put something weird in the Name field?"

Step 1: The Fuzzing I typed Sukhveer"<script>alert(1)</script> into the name field. Result: The website blocked it. It said, "Invalid characters detected."

Okay, so they had a filter. But filters are often incomplete. They usually block <script>, but do they block everything?

Step 2: The Bypass I tried a slightly different payload. Instead of a script, I just tried to break the HTML structure. I entered: "<h1>Hacked</h1>

Result: When I viewed the page after submitting, my name appeared as a giant heading. The HTML injection worked! I had broken out of the "Name" text and injected my own code into the page.

Step 3: The Impact I realized this wasn't just about making text big. If I could inject HTML, could I steal cookies? Could I redirect users?

I crafted a payload that would create a fake login form. When the admin of the website viewed my "Contact Us" submission, they would see a login box asking for their password.

I reported it. A few days later, I got the email: Triaged. Then Resolved.

I got my first bounty. It wasn't a fortune, but it was proof. I wasn't a fraud. I was a bug hunter.

3 Practical Lessons for Beginners

If you are Sukhveer from 2 years ago — stuck and confused — here is what you need to do right now:

1. Stop Chasing "Critical" Bugs Don't look for the next big RCE (Remote Code Execution). Look for a Reflected XSS or an IDOR (Insecure Direct Object Reference). These are everywhere. They are easy to find if you look closely at how data moves through a website.

2. Read the JavaScript This is the biggest secret. When you open a website, press F12, go to the Sources tab, and look at the JavaScript files. You will often find hidden API endpoints, secret keys, or logic that tells you exactly how the developer built the site. If you find an endpoint like /api/v1/user/delete, try to see if you can delete someone else's user account.

3. Focus on the "Boring" Stuff Everyone is looking at the login page. Very few people are looking at the "Change Password" page, the "Invite Friend" feature, or the "Export Data" button. Try this:

• Create an account (User A).
• Create a second account (User B).
• Try to use User A's session to access User B's data.

If it works, you just found an IDOR. That is a valid bug. That pays money.

The Reality Check

Let me be honest with you. Bug bounty hunting is hard. You will spend hours staring at a screen and finding nothing. You will report bugs and get marked as "Informative" or "Duplicate." You will feel like quitting.

But you only need one good bug to change your momentum. The first bug is the hardest. After that, you start seeing patterns. You start understanding how developers think.

Let's Grow Together

I'm starting this Medium page to document my journey. I want to share the tools I use, the payloads that work, and the mistakes I make.

I'm not a guru. I'm just a guy who likes to break things so they can be fixed.

If you are on this path, let's connect. Drop a comment with your first bug story, or say hi on my socials.

Stay curious, keep hacking, and never stop learning.

— Sukhveer Singh