My Second Year in Bug Bounty $$$$

📩 Read for Free CLICK HERE.

Hi, I'm Rivek Raj Tamang (RivuDon), a Security Researcher, Bug Hunter, and Ethical Hacker with a Master's in Cybersecurity, a Certified Ethical Hacker from Sikkim, India. I have secured numerous companies, received bounties, swags, Hall of Fames mentions, Letter of Appreciation / Recognition, CVEs and more.

Feel free to connect with me! You can find out more about me on my LinkedIn, I am active there.

Hi readers, this write-up is about how my second year in Bug Bounty Hunting went — including my experiences, lessons, goals and tips and tricks. You will definitely learn something especially for beginners and Intermediate hunters who want to start and continue their journey, and as you read the article you will find many things that went really well for me so enjoy the read as well.

Here's how My Second Year in Bug Bounty went …

The Start

You have probably read my short introduction above; I would not want to bore you with my introduction again. You can always find more about me on my LinkedIn, and I have a small portfolio website which is not updated but you can check it out, it's not top-notch but, it's a work in progress.

Check out here: Portfolio — Rivek Raj Tamang

If you haven't read my writeup on my first year in bug bounty, please find the writeup at the bottom of this article. Do read it as you will learn my approach and experience as a beginner.

So let's start with my journey in my 2nd year of Bug Bounty not as a beginner but an intermediate bug bounty hunter. As usual my day started with opening LinkedIn, looking at what other hunters are doing and reading about their achievements and bounty rewards, becoming awed by how they do what they do and wake myself up from daydreaming and start my routing of hunting on a target trying to find a bug but this new year I had other plans and other approaches so I started to craft my goals list to work towards them and try to achieve them. At the start of my 2nd year in bug bounty.

Goals

What were these goals?

My goals for the second year were a bit more than simple yet challenging with a gradual increasing difficulty.

CVE [1]
Hall of Fame [50]
Letters/Certificates [10]
Bug Bounty [3]
Swags Goodies [3]
Medium 1k followers

I know for a fact that some people have done crazy numbers on their 2nd year of bug bounty, However I also know for a fact that there are people who have put countless hours and efforts in and still haven't gotten a single bounty in their 2nd year of bug bounty journey as well.

But fair enough I had to challenge myself and push my limits as well, if you have read my other articles you probably know my approach of finding bugs and reporting, so that part has become like a muscle memory to me in short to learn about a topic, research, practice on labs, find the same bug on rdp, vdp then finally on a bbp and eventually get rewarded, but this time I wanted to start with my first CVE (Common Vulnerabilities and Exposures) as well, because we bug hunters also have another official name that we go by i.e. "Security Researcher" so what does a Security Researcher actually do? A security researcher researches on a product or an open-source project, puts their time in, learns about it in depth and finally finds a vulnerability to break the flow and in return get a CVE in their name.

With that In mind I had my eyes set on finding one, I locked in, made a solid plan, learnt the ways of finding a CVE and long story short I actually did it after waiting for a long period of time and now I can finally with a sigh of relief call myself a Security Researcher and I managed to not just get 1 but many.

Note: I will make a detailed guide on how to find a CVE in the upcoming days, stay tuned.

My other goals were to write more articles and reach a wider audience as well and we finally hit 1k Followers at medium as well, Thank you to all my readers for reading my content, Hope I get better and deliver more in the future as well.

That not only motivated me but also inspired me to work harder, smarter and work towards my goals even more. With that mindset I was continuously working on a target, on a bug, on our group, to learning, practicing and writing, with that I slowly yet steadily started finding bugs and started getting better and better at it, hall of fames started coming up one by one, letters/certificates, bounties, swags and goodies as well.

"There are no secrets to success. It is the result of preparation, hard work, and learning from failure." — Colin Powell

They say be the hardest worker in the room, while this may not be true for everyone but for me this works like a charm, working hard towards something is never a loss, even if you don't get the desired output, you actually did put in some real work that some people might not even put in, so for me that is a win even if you don't get rewarded in the first place.

So, with that in mind did we achieve our goals?

Goals Achieved?

CVE [1] ✅
Hall of Fame [50] ✅
Letters/Certificates [10] ✅
Bug Bounty [3] ✅
Swags Goodies [3] ✅
Medium 1k followers ✅

We actually did it, and even better, went beyond.

The wins came slowly at first. I had plenty of self-doubt, and honestly, I still do. But regardless of whether I found a bug that day or not, I kept opening my laptop and working. Some days brought rewards, others brought lessons but every day moved me forward.

Things I didn't plan for

Recognition from NASA and the Chief Minister

I definitely had my eyes on finding a bug on NASA. I already had a Hall of Fame mention in NASA's VDP on Bugcrowd, but I had never received a letter of Appreciation from them. As a big NASA fan and space enthusiast, this meant the whole world to me.

*Program here: NASA Vulnerability Disclosure Program — Bugcrowd

I kid you not, I worked relentlessly to find just one valid bug at NASA. Day in and day out, I mapped assets and kept hunting. Even when I found something, it sometimes turned out to be a duplicate, but I persisted.

After about a month, one report got triaged, followed by another. A few weeks later, five reports were in triage, and I was extremely excited. Sadly, one was marked NA due to a platform-related issue with the technique I had used, while three others ended up being duplicates. I had almost lost all hope, but two reports remained a P4 and a P1.

There were blockers, comments, and several rounds of back and forth with the triagers. I was slowly losing hope, but I kept working through the process. Finally, both reports were accepted, earning me two letters of Appreciation from NASA for a P1 and a P4 vulnerability.

I kid you not, I was over the moon. I was so excited and happy that my heart was full. After all the effort, uncertainty and setbacks, It was an overwhelming moment for me.

Following this, my work received recognition across Sikkim. My name appeared in various newspapers and news channels, and I received so much appreciation, praise, and love from the people of my state. Eventually, I had the opportunity to meet the Chief Minister of Sikkim, for which I remain extremely thankful and grateful.

We discussed cybersecurity in our state, how we could improve it, and my future plans and ideas. I had a great time sharing my experiences and thoughts. I will forever cherish this moment, and as I promised, I will keep working toward my goals, representing Sikkim in cybersecurity and encouraging the youth of Sikkim and beyond by sharing my knowledge and experience.

OSINT Project for a client

I also got the opportunity to work on an OSINT project for a client who reached out through my connections. They needed help with some work, which I unfortunately cannot disclose, but it was a great experience. I enjoyed the work, learned along the way, and got paid in the process.

Many more projects and good things are in progress and in works so stay tuned for more in the future writeups. The future is exciting and I am all for it. Hack the World!

Tips and Tricks

I would like to drop some Tips and Tricks which are general however if you stick to it, it will definitely be fruitful for you.

Your Network is Your Net Worth: Connect with fellow hackers, share knowledge, help others, and build genuine relationships. You never know where an opportunity might come from.
Consistency: You won't find bugs every day, but keep showing up and putting in the work. Every day is an opportunity to learn something new.
Persistence: Rejections and duplicates are part of the journey. Learn from them, improve, and keep hunting, regardless.
Discipline: Motivation comes and goes, but discipline keeps you moving. Make time for learning and hunting, even when you don't feel like it.
Hard work: There's no shortcut to gaining experience. Practice, explore, read write-ups, and get your hands dirty.
Curiosity: Don't just run tools, understand how they work and why things happen. Keep asking questions and exploring.
Love, Passion, and Obsession: Enjoy what you do. Bug bounty can be frustrating, but your passion will keep you going. Stay obsessed with learning but remember to maintain a healthy balance.

The End?

With this I would like to end my article here however I would like to first thank myself, for believing in me and chasing my dream, despite all the noise, distractions, demotivation, and other challenges.

I will try my best going forward and try to also be a little kind to myself and not be so hard on myself.

Secondly, I would like to thank my close ones who encourage, appreciate, motivate me and surround me with love, care and kindness. To them, I owe everything. I am ever grateful and thankful for it.

Onto Next Goals, we keep moving forward …

If you find this article helpful, do clap, leave a comment and follow to read more and encourage me to keep writing. ♥️

🎯Read my other write-ups here ⬇️

List: Rivek's Blog List | Curated by RivuDon | Medium Rivek's Blog List · 32 stories on Medium

My First Year in Bug Bounty $$$ Learn from my experience and use it in yours.

Feel Free to connect with me on LinkedIn:

https://www.linkedin.com/in/rivektamang/

🌐We also have a community of hackers and bug bounty hunters on a WhatsApp group feel free to join:

Hack-R Academy WhatsApp Group Invite

Hack-R Academy *Channel * 564 followers * A channel by - Hack-R Academy Tips and Tricks, Resources and Responsible POCS on Bug…