I keep getting asked the same question. Someone reads about a hunter pulling six figures, they want in, and they want a roadmap. So here it is.

This is the path I'd walk on day one if I was starting over. It assumes nothing. You don't need a degree. You don't need a fancy laptop. You need a quiet evening and the patience to keep showing up.

What you're actually doing

Bug bounty programs pay you for finding real security issues in their systems. Not UX complaints. Not crashes that have no impact. Security flaws that, if a bad actor exploited them, would hurt the company or its users. That's the product you're selling.

Three platforms run most of the market. HackerOne is the biggest, very US friendly when it comes to payouts. Bugcrowd is a close second, with more European programs. Intigriti is Europe first, growing fast, and worth signing up for early.

Pick one. Make an account. Read the rules of every program you touch. People get banned in week one for skipping that step.

The tools you actually need

Forget the YouTube tool stack videos. The bare minimum looks like this.

Burp Suite Community Edition for inspecting and replaying HTTP traffic. Subfinder for discovering subdomains. Httpx for probing which of those are alive. Nuclei for templated vulnerability scanning. Ffuf for fuzzing directories and parameters.

Every one of those is free. They all run on Windows, Linux, and Mac. Install them today, before you read another tutorial.

Pick one vulnerability class and own it

The biggest mistake beginners make is chasing every kind of bug at once. Pick one class. Live in it for sixty days. Become the person who sees that pattern faster than anyone else.

My pick for a beginner in 2026 is IDOR. Insecure Direct Object References. The bug where an app trusts a user supplied ID without checking if you should be allowed to access that resource. They're still everywhere. They pay anywhere from a hundred dollars to several thousand depending on impact. And once your eye is trained, you start seeing them in places no one else looks.

Recon is where the bugs hide

Beginners skip recon because it feels boring. That's exactly why people who do it eat well.

The loop looks like this. Pick a program with a wide scope, the kind that covers anything under a big wildcard. Run subfinder. Pipe the results through httpx so you keep only the live hosts. Screenshot the lot with a tool like gowitness. Then sit back and read.

You are not looking for bugs yet. You are looking for forgotten infrastructure. The staging server someone spun up in 2021. The admin panel that someone forgot was indexed. The half migrated service that returns a stack trace if you breathe on it wrong. Those are where the bugs live.

Reports are half the game

A real bug with a bad report earns nothing. A clean report on a mediocre bug can still pay. Treat your writeup like a product. Title that says exactly what the bug is. One paragraph summary. Numbered repro steps a junior engineer could follow. Screenshots. Exact requests. A blunt impact statement.

The reports that get triaged fast share one trait. The person reading them never has to ask you a single follow up question.

The timeline nobody wants to talk about

Month one you will earn nothing. You will submit one or two reports and they will both probably come back as duplicates. That is normal.

Month two or three, with a bit of luck and a lot of hours, you land your first valid bounty. It will be small, maybe a hundred to five hundred dollars. The dopamine is worth more than the money.

Month four through six, if you kept going, something clicks. You start spotting patterns. You build a private list of programs you know how to attack. Part time you can realistically clear five hundred to two thousand dollars a month.

Past month twelve you are either committed or you have already quit. Most people quit. The ones who stay get good slowly.

If you need money this week, this is the wrong path. Take a freelance gig. If you want a skill that pays for decades, keep reading.

The one habit that separates earners from lurkers

Read public writeups every day. Not weekly. Daily.

HackerOne's Hacktivity feed. The PentesterLand weekly newsletter. The InfoSec Write-ups publication on Medium. Every writeup is a pattern. Patterns compound. Three months in you will start spotting things in the wild that you would have walked past on day one.

That's the whole roadmap. No paid course. No Discord required. Just a quiet evening, a real target inside scope, and the willingness to keep showing up after the first hundred failures.

The money is real. The path to it is unglamorous.

Go find something.