Getting Started in Bug Bounty Hunting

Introduction

Welcome to the introduction of getting started with Bug Bounty Hunting in 2026. This guide will be of importance to anyone coming into the bug bounty world, what to expect, and the realistic operations of your daily tasks.

Please Note: All of the information inside of this article is based soley on the primary first-hand real-world experiences from Bearded Viking. Combined with reading and responded to Twitter/X posts as well.

What To Expect?

This has been my most asked question, "What can I actually expect from starting this?" That is a very good question, and my answer is expecting nothing and everything. I know that does not help. But here are some reasons.

When I first started, I spent literally 4-Months before I actually got paid for my first bounty. This is a confusing conflicting operation indeed. However, when you turn in a report, and then the triager immediately closes it saying something like "Unless you can provide a working PoC (Proof of Concept), this is close." Which they can also give you negative scores that will ultimate hurt your future reports.
On another instance, I was submitting another report and was awarded $1,000 just for discovering an exposed API Key on an android application.
I have had reports that had a fully working PoC where I could handle account take over by 2FA enabling and swapping out my authentication token for another user. But due to the fact I needed this to actually work as an MiTM (Man in the Middle) attack, it was considered out of scope and was closed down.

So, I have had programs that would literally allow me to handle a full account lock-out, and account take over pay nothing and gave me negative reputation points, while on the other hand, just reading a document from a decompressed .apk file gave me a grand.

And now you see why I say expect nothing and everything. You literally never know what you will be getting into until you just get started.

Why do you do this?

I get a thrill out of discovering how applications work. I understand what they do, how they work, and how to make them operate in my favor. And to me, that is the ultimate power-house feeling. Just reading someone else's code, and being like "Oh that should not be there, let's see how we can manipulate this to get juicy information!" and then spend hours working and crafting unique scripts and cURL commands to make it work in my favor.

I would love to sit here and say the money is what motivates me, but it is that sweet success of a vulnerability operating in my favor is what drives me the most. Sure, the money is a solid second, but after hours, days, and sometimes weeks of looking, exploring, reading external API documents, etc. and then literally getting a 200 success response. That is perfect for me. That is why I do what I do. I love this job.

The third reason is because it gives me the flexibility to do what I need to do as a man. A father. and a Boyfriend (at the time of writing). If the kids have football games, I can stop and go spend time with the family and watch them play, help them with school work, and help keep the house clean. It gives me the freedom to do what I need to do in the real-world, while I can have scripts running in the back-ground so when I return, I can view the output files and start working again.

And finally, I don't really have a boss telling me what to do, when to start working, etc. I can work any where in the world. As long as I have a computer, internet, and some free time, I am game to work when I want too, and when I don't want too. If I want to take a month long vacation, boom. I just pack up and go.

How much can you make?

This is another heavy question that get's asked a lot when people consult me about my career. Some months, I walk away with nothing, other months, I walk away with $10,000 or more. Some of the more seasoned, veteran, hackers can easily earn up to $100,000+ a year. The answer depends on a few different factors;

How much time are you going to dedicate to learning?
How much time are you going to dedicate to the "Game"?
How precise and accurate/replicable are your reports?

These are the three primary drivers that leads to success. You can study for the next year reading books, handling CTF challenges, and watching YouTube videos. But if you don't actually spend any time to the "job", then you won't make any money. You are just learning and not doing. If you spend 2–3 days a week learning, then spend 3–4 days a week actually doing, you have a strong chance of walking away with some descent money.

If you do all of that, and your reports are not accurate, precise, and easily replicable, then you probably won't walk away with anything.

Reporting is about 90% of your pay-out. I know that sounds lame, and I get it. However, if you do not have clear, precise, and accurate steps that the triager can easily reproduce, then they will call it as informational, or worse non-applicable and give you negative reputation points.

You will need to have a solid report setup going in with clean, clear, and precise steps that they can reproduce. After that, you should also heavily include things like;

As an attacker, I could… ~ Answer this question in all your reports. It showcases you are thinking logically.
The impact of this vulnerability could… ~ Answering this question showcases you understand the specific vulnerability and how it would affect "company" and/or "company customers".
Remedations ~ Showing them HOW they can fix this issue is another massive win in your favor. It clearly showcases you know their infrastructure, you know the vulnerability, and you can help them fix it. Thus reducing their time to triage and ultimately reducing your time to getting paid.

My reports are generally in the following setup and structure:

SUMMARY:

This is where I give a short 1 paragraph introduction to the discovered vulnerability, and talk briefly about what it is.

STEPS TO REPRODUCE:

Here, I tell the triagers how they can replicate my steps. I do this with bullet points, code blocks, etc. I don't just tell them what to do, I show them the results. And if a situation comes up where it may not work properly, I also do my best to give them actions to take to get back on track.

IMPACT:

This is the section where I discuss in 4–6 paragraphs of how devestating this could be for the company and/or their customers.

REMEDATION:

This is where I give them a general over-view of how they can fix these issues. This allows them to easily take the report and start fixing the issues almost instantly after they have tested it out.

Alright, You Talk Good, But WHAT Do I Need To Get Started?

A lot of people think you need a high-end super powerful gaming computer and a server to get started. When in fact, you really don't need anything too fancy.

When I first got started into bug bounty hunting, several years ago. I was facing a critical financial point in my life. I had literally nothing going for me, and did not even have a computer at that time. I saw a post on Twitter about BugCrowd and what it was. So I opened up my phone's browser, navigated around and setup a default dummy account. I wanted to see what was up. At the time I was using a Samsung Galaxy S10. If that tells you how long ago this was! Then, I discovered that I could install a program called "Termux" and from there, I was able to install "NetHunter". Termux is a terminal emulator with real world actions. Just like a terminal you would see on a hacker's computer. And NetHunter allowed me to install tools from the popular Hacker's O.S. "Kali Linux". So, after playing around with these for a few weeks, trying to figure out how they work. I decided I would randomly pick a target. Ended up using some of the basic tools, and ultimately I discovered an SQLi vulnerability on a target. Reported it from my phone, and within 3-weeks, I had $4,500 hit my bank-account. Used some of that money for bills, but then I purchased a cheap $200 laptop from the pawn shop. I figured bigger computer would help with reading things instead of my mobile phone. From that $200 laptop, I was actually able to do more. Using HashCat, John the Ripper, and even got into Burp operations as well. Then, I turned in another report that paid me another $7,000 which lead me to purchasing a high-end gaming desktop. This was not required, but I figured I earned it.

So, what do you actually need to get started? Literally a mobile phone! I personally use Android phones because of the ability to use Termux with NetHunter.

You can learn more about Termux and install it here. You can learn more about NetHunter and install it here.

However, if you don't want to risk your phone, or have a really old phone, what type of computer can you use?

At the time of writing, I decided I would start my life over again. After a divorce, not being able to really do anything in life, and tried to get setup, I found myself in a hotel room with just my son and myself. So, I took my last $300 down to the pawn shop and purchased a cheap $200 Dell Laptop. My current PC Specs are:

CPU: Intel Core i7–4510U Integrated GPU: Intel HD Graphics 4400 (Haswell-ULT) Dedicated GPU: NVIDIA GeForce GT 750M (GK107M) RAM: 16 GB DDR3 Storage (HDD): Seagate ST1000LM014 (1 TB SATA SSHD — hybrid drive) Optical Drive: PLDS DU-8A5LH DVD-RAM Writer WiFi: Intel Wireless-AC 7260 Ethernet: Realtek RTL8111/8168/8411 (Gigabit Ethernet) Card Reader: Realtek RTL8411B Audio: Intel 8 Series HD Audio Chipset: Intel 8 Series (Haswell-ULT LPC Controller)

As you can clearly see, this is nothing fancy by any means. It is easily around 12 years old. However, I installed Debian 13 on it, and install tools as I need them.

If you are seriously interesting in handling Bug Bounty Hunting part time or full time, you really do not need to have anything too powerful. Just something that can handle a few processes, connect to the internet, and some time and patience for this game.

So Many Options for Hacking… Which One(s) Do I Do?

You are not alone here. There are so many different paths you can take. I honestly would recommend starting off with something like TryHackMe. This is a website that offers some free courses on various types of hacking. They have a built-in terminals, full computers, etc. that are interactive allowing you to easily learn various different hacking techniques.

I would heavily recommend doing as many programs as you can in all of the various fields/categories. This way, you can can easily explore and test out different fields of what you think is easiest, or for those of you who are challenge seekers, the hardest. Thus, allowing you to get your feet wet with various types of operations, and still learning new tricks along the way.

Personally, I enjoy going after the ones that few individuals go after.

📊 Summary Table (Hunter Population Density)

Rank | Specialization | Hunter Population | Opportunity Level

Web Application | 🌊🌊🌊🌊 (Massive) | Low (Saturated)
API Securit | 🌊🌊🌊🌊 (Very High) | Medium-High |
Generalists / Reco | 🌊🌊🌊🌊 (Very High) | Low-Medium
Mobile (APK/iOS | 🌊🌊🌊 (Moderate) | High
Cloud / Infrastructure | 🌊🌊 (Moderate) | High *** AI / LLM Securit |** 🌊(Small)🔥 | Very High
Blockchain / Web3 | 🌊 (Small) | High (Elite)
System-Level / Binary | 💧(Tiny) | High (Elite)
IoT / Embedded | 💧(Tiny) | High (Elite)

This table showcases the other hackers in the same field, and what they generally target. This should help you discover where you would want to focus your attention on, and then heavily learn everything you can about that particular "subject".

My personal desired target is Android Applications. Just something about decompiling an application, reading over the specs, and discovering hidden API Keys, Tokens, End-Points, etc. and then manipulate those variables in order to precisely discover PII, server manipulation, and much more.

Getting Started:

Alright my esteemed friends, you read it this far, now it is time to actually get your going with your journey. What to do, how to get setup, etc.

Social Media Accounts: Obviously this is NOT a heavy requirement by anymeans, however it does allow you to easily connect with other hackers, share your success, and discuss with other's about your issues. Personally, I have Twitter/X, TikTok, Reddit, and Medium.
Bug Bounty Platforms: Obviously this is a very CRUCIAL aspect of your journey. With so many platforms out there, my top recommendations for bug bounty hunting are: HackerOne, BugCrowd, Intigriti, YesWeHack.
Hardware: This is a crucial piece of the puzzle. But as stated earlier, you do not need to have a high-end gaming computer to get started.
Linux: You can use Apple OS, Windows, etc. And I know a lot of hackers who use Apple. However, I am more of a Linux man myself. Personally, I use Debian for my base operating system, and then install tools as I need them. You can use Kali Linux that comes pre-loaded with every tool imaginable, but you probably won't use 50% (or more) of the tools that are installed. So use that extra space for what matters most.
Note Taking Software: You can use something as simple as a text editor, or you can use an online service like Google Drive. Personally, I really enjoy using CherryTree for my notes. Easily allows you to create nodes, keeps things organized, and easy to reference.

Once you have your social accounts setup (Optional but recommended), and you have your computer setup, and you have your bug bounty platform(s) setup, now we can begin.

If you want to use Windows as your base computer but want to test out Linux, you can easily use VirtualBox and install Linux there in order to test it out. And if you mess things up, just destroy that virtual machine and start over. I really encourage people who are new to Linux to start there as that is the easiest way to test things out before going all in.

Now, we can discuss some of the basic tools you will need to get you started. These are a collection of tools I personally use in order to start working on literally anything.

Website Hunting:

If you are interested in discovering vulnerabilities on websites and web-based applications, you would benefit from having;

BurpSuite: Community is fine, I personally use Community myself. It is free. However, the pro version (includes SO much more features, can save your work, and much more), is priced at $500 for the whole year. So, it can pay itself off, just depending on how fast you can find, audit, report, and get paid for that. If you have the funds, and want the pro version, go for it. Otherwise, just the community edition will work just fine to get you started.
Python3: This is a programming language that will be helpful. Especially when you start to create scripts to help automate tools and tasks to be executed rapidly.
SQLMap: While these types of vulnerabilities are becoming rare to exploit, SQLMap allows you to inject various payloads into the target URL Parameters and headers in order to try to gain access to at least read information from the remote Database. This is heavily crucial and can earn $1,000+ if you can use this tool for discovering databases.
cURL: This is a terminal based tool that allows you to send packets of data to a URL in order to observe the response back. Helps with limiting your system resources and does not really require a lot of browser interactions. Just send a command and wait for it to come back to you.
HashCat and/or John the Ripper: These tools allows you to easily crack passwords. However, they do use a lot of system resources. Specifically your GPU. So, if you have a crappy GPU, I would recommend not trying to crack passwords and encryptions until you have something that can handle this operation.
Metasploit: This is a heavily powerful tool if used right. I have utilized Metasploit along with MSVenom in order to create and compile an RCE script, attach it to an image file, upload it to the remote server, and use Metasploit to wait for that script to be activated. Then boom, I am inside of the server with Shell Access. This tool can do so much more, but I personally use it for advanced RCE operations myself.
nmap: This allows you to easily scan for ports that are opened up on the remote target server. While 90% of the time, your typical open ports are 443/80, there are a few cases where you may see Port 22 (SSH), 21 (FTP), 6001 (X11), 3001 (MySQL), etc. This tool can help you find those ports, what service(s) are running, and then target a new attack vector based on that new information.

Android App Hunting:

If you are interested in discovering vulnerabilities on android applications, you would benefit from having;

ADB: This is a "bridge" that easily connects your computer to your phone. When you connect your phone to your computer, just fire up ADB and see your device, llist packages, and pull apk files with ease.
APKTool and/or JADX: These tools easily allow you to decompile the APK file in order to read the contents of that Android Application.
Text Editor: I personally use a program called "Kate" to open the directory and start reading the contents inside.
cURL: Like mentioned above, cURL will be your best friend when trying to test end-points.
grep: This command easily allows you to quickly find reference points throughout the entire application without having to read every single document.
MobSF: A highly advanced Go program that allows you to easily add your APK file, and it can scan everything and give you details about the application, what is Critical, High, Medium, Low rewards, etc. Very powerful and amazing tool to have in your arsenol.
Metasploit/MSVenom: Again, if you can discover a remote end-point that allows you to write too, having the ability to handle a PoC for RCE will be crucial. And these tools come in handy again.

AI / LLM Security Hunting:

If you are interested in discovering vulnerabilities in AI and Large Language Model applications, you would benefit from having:

Garak: This is an open-source LLM vulnerability scanner developed by NVIDIA. Think of it like a fuzzer for language models — it systematically probes LLMs for prompt injection, jailbreaks, hallucination, data leakage, toxicity generation, and misinformation. It supports a wide range of models including OpenAI, Hugging Face, Cohere, and custom integrations. This is the natural starting point if you want a broad, automated first pass at scanning an AI application.
PyRIT (Python Risk Identification Toolkit): Developed by Microsoft, this framework helps you run repeatable, structured adversarial campaigns against LLM systems. It simulates jailbreaking and injection attacks at scale, making it ideal for building a recurring red-teaming practice rather than a one-off check. It maps findings to MITRE ATLAS and OWASP LLM Top 10, which makes reporting cleaner and more professional.
Promptfoo: This open-source tool is widely used for prompt and model evaluation, but its red-teaming features let you fold adversarial security checks into the same harness you use for quality evaluations. It excels at discovering application-specific vulnerabilities through intelligent, context-aware testing — especially for complex RAG (Retrieval-Augmented Generation) and agent systems. This is perfect if you want security testing to live alongside your existing CI/CD pipeline.
0DIN AI Security Scanner: Recently open-sourced under the Apache 2.0 license, 0DIN comes with 179 community probes covering 35 vulnerability families, plus six specialty probes drawn exclusively from their bug bounty library. It includes jailbreak taxonomy integration — every finding is categorized against their jailbreak taxonomy, making it easy to understand and report. This tool is purpose-built for bug bounty hunters hunting AI vulnerabilities.
Burp Suite Professional + Burp AI Extension: If you're already familiar with Burp Suite from web application testing, this is an easy addition to your arsenal. The Burp AI extension allows you to test AI-based applications for prompt injection vulnerabilities with automated fuzzing of LLM prompts. It costs $499 per user per year and includes 10,000 free Burp AI credits. This is a natural progression if you're already comfortable with Burp's web testing workflow.

Mission Critical: Define Your "Why"

Before you write a single line of code or fire up a single tool, you need to answer one question. And I mean really answer it.

Why do you want to do this?

I'm not asking for a surface-level answer. I'm asking you to dig deep. Because once you have that answer locked in, everything else falls into place. Your path becomes clear. Your decisions become easier. And when the inevitable dry spells hit — and they will hit — that "why" is what keeps you going.

Let me show you what I mean.

The Big Dream: Buying a House

Let's say your goal is to buy a home. Cash. No mortgage. Just a place that's yours.

Average house these days? A decent 3-bedroom, 2-bath on a small lot will run you around $450,000. That's the target. But here's the thing — you also need to keep the lights on while you're saving. Even if you live cheap like me (extended stay hotels run about $1,400/month with everything included except phone, internet, and food), you still have ongoing expenses.

So now you need to set a realistic timeframe. And I mean realistic.

If you're thinking "I'll save half a million dollars in 3–6 months," you're setting yourself up for disappointment. Could it happen? Sure. The highest payout on HackerOne at the time of writing was $50,000 for a GitHub access token that let someone read AND write to private repos. So it's possible. But don't bet your life on it.

The reality is this: your first 1–3 months will likely bring in exactly zero dollars. If you're lucky, you might see $1,000 — maybe a bit more, maybe a bit less. It all depends on scope, vulnerability severity, impact, and how solid your PoC is.

Here's the golden rule I live by: Report everything, expect nothing.

After those first three months, you'll have submitted 20+ reports. Maybe one landed. Maybe none did. But you're learning. You're diving deeper. You're starting to understand what triagers actually want — detailed, reproducible steps with a fully working Proof of Concept. You realize that PII exposure and RCE vulnerabilities pay more, and you start building a strategy around that.

My realistic expectation for someone grinding part-time? Submit at least 5 reports per week — everything from informational to critical. If you can hit 5 reports weekly and earn $5,000+ per month, you're in a golden zone. But here's the trade-off: you're doing this after your day job. Say goodbye to most of your social life for a while. While your friends are out drinking and hanging out, you're grinding toward your goal. And that's okay. Because your endgame is bigger than a Friday night.

I'll be honest with you — I've had months where I earned $15,000 back-to-back. And I've had 3-month dry spells where nothing came in. It's part of the game.

The Unicorn Story (Because It Happens)

I had a friend hit a $100K bounty in a single weekend. Found a critical vulnerability in a blockchain network that let him bypass gas fees AND duplicate transactions. He sent $500 to one of his other accounts, doubled it, tripled it, and ended up with $15,000 in his second account — all without paying the typical gas fees. One single $500 payment, replicated multiple times from the back-end.

That's the kind of payout that changes lives overnight. But it's also the exception, not the rule.

The Long Game

As you progress and funnel your earnings into savings, you'll watch that account grow. My advice? For long-term savings stretching 3–5 years, put your money in a high-yield savings account. Let the banks help you grow it while you keep adding to it.

Four years of grinding, learning, and saving, and suddenly you've got $500,000 sitting there. You go house shopping. You find a place for $400,000. You close the deal. And now you've got $100,000 left over for furniture, a new computer setup, and a few months of utility bills.

That's the dream, right? But let me tell you something — I recommend starting smaller.

Baby Steps: The Hacker/Gamer Lounge

Maybe you don't want to jump straight to a house. Maybe you want to build out the ultimate hacker/gamer room first. Figure out what you need:

Computer setup
LED lighting
Speakers
Television(s)
Bed
Carpet
Painting
Shelves
Nick-nacks

That'll run you roughly $45,000 for something truly impressive. Start there. Get that win first. Then aim bigger.

My Current Goals (After a Life Reset)

Here's where I'm at right now. After hitting a massive reset button on my life, I'm sitting in a hotel room with nothing but a basic low-end laptop and my son. My goals are simpler:

New Computer: Two-step process. First, get a better computer — nothing fancy, just something that doesn't lag when I run Burp. Then, when I've earned it, build the high-end gaming desktop I've always wanted, maybe even a small server rack to go with it.
New Car: I haven't had a car in over a year. I walk everywhere. My eyes are set on a Ford Mustang GT — roughly $40,000. And I want to walk into that dealership and pay cash for it.

My goals might be simpler than others. But eventually, I'll be starting that savings account for a house somewhere down the road.

But What If You Don't Want Any of That?

Maybe you already have everything you need. You've got a good setup, your bills are covered, and you're just looking for a career change.

That's awesome. Seriously.

Here's my recommendation: Keep your life exactly as it is for at least another year while you build this up. Work your regular job during the day. Hack at night. And when you're ready to make the transition to full-time, here's the formula:

Step 1: Know Your Numbers Figure out exactly what you NEED to live each month and each year. We're talking bare necessities — rent, utilities, food, insurance, car payments. Nothing else.

Step 2: Know Your Fun Money How much do you spend on eating out, streaming services, sports, activities? Add that to the total.

Step 3: Double It During your first year of working both jobs, aim to earn at least double what you need to live for a year. Here's why:

Let's say you need $35,750 for basic living and $22,950 for fun money. That's $60,000 total to live for one year. If you can save $120,000 in your first year? Congrats. You can now live comfortably for the next two years while you focus entirely on bug bounties.

Step 4: Structure Your Year Once you're full-time, here's how I recommend breaking it down:

First Quarter: Grind hard. Earn your basic living expenses for the following year.
Second Quarter: Earn your fun money for the following year.
Third & Fourth Quarters: The rest is yours. Take a 6-month vacation. Keep building your savings. Whatever you want. Just make sure you set aside at least one quarter of the year to cover your taxes.

So I'll Ask You Again

Why do you want to do this?

Is it a new car? A computer? A house?

A new career path?

Just some extra cash on the side?

Whatever your motivation — whatever gets you out of bed and into the terminal every day — start somewhere. Start today. And reward yourself when you hit your milestones.

Because you've earned it.

Advanced Knowledge

Now, if this is something you really want to investigate and potentially start doing, that is awesome! Let's talk business for a second shall we?

The first 1–5 programs you turn in and get paid for, congrats on your play money! That is a huge win and give yourself a pat on the back for me. However, if this becomes a full-time operation for you, I would heavily recommend filing for an LLC in your state. This way, you can start turning in reports as a business, then your business get's paid, not you. You can then setup where when you buy new technology, part of your house, etc. is all a tax write off. And then you can pay yourself a weekly check where taxes are then taken out and your paying your taxes on your own personal income.

Thus, allowing you to have the best benefits from both worlds. Personal paycheck with taxes taken out, combined with heavy tax write offs for as much as you can possibly do.

IF this is the path you are considering, I would heavily recommend having a great accountant. No, not your mother, spouse, or friend. But a third party accountant that can easily help identify key crucial tax breaks, help you setup your bank accounts for direct deposit with taxes taken out, possible medical insurance if you want it, and so much more. A great accountant can help your business stay financially stable and growing while keeping you protected and secured.

What are you waiting for? Go start building yourself today, and let the world pass you by as they are out having fun. You are building your legacy. You are building your future. And most importantly, you will be working for yourself and not for someone else. My best advice for this, have fun doing this job.

Contents