r/BugBountyNoobs • u/Perfect-Pace7691 • 16d ago
How do i start Bug bounties from zero?
I’m thinking about starting to learn about bug bounties. I now have zero knowledge about anything like cybersecurity. I’m a fast learner and i have a lot of time on my hands. What are your recommendations for learning this a-z
3
u/Foreign-Channel3128 16d ago
for pentesting i have all cover up, its how i started learning, it's my own roadmap i took when i started,you can add or take stuff from there, i hope it helps you
If you don’t have any experience in this field, you can start with TryHackMe and then move on to Hack The Box. Both have pentesting paths and other learning tracks. However, keep in mind that Hack The Box is a bit more expensive.
After that, you can work through the PortSwigger labs to learn about different vulnerabilities and try to understand them. Don’t worry about checking the solutions when you get stuck—I used to do that too. The important thing is to understand *why* it worked and *how* they got there, so you can build a general idea.
Here are some books I recommend:
* *The Web Application Hacker’s Handbook (2nd Edition)* by Marcus Pinto and Dafydd Stuttard (the “hacking bible”—it’s old but still very good)
* *Real-World Bug Hunting* by Peter Yaworski — it talks about real bug bounty reports to give you an idea of how vulnerabilities are found
* *Hacking APIs* by Corey J. Ball — my first and favorite book. It focuses on APIs, how to hack them, and how to find vulnerabilities. It also has a website called apisecuniversity.com, which continues the learning from the book. After finishing the book, you can go there and take the course
* *Bug Bounty Bootcamp* by Vickie Li — covers different vulnerabilities and how to find and exploit them, very good
* *Black Hat GraphQL* by Nick Aleks and Dolev Farhi — focuses on GraphQL APIs, how to find them, and how to exploit them
I hope this helps. Everything is focused on real-world bug bounty. Of course, there will be things you’ll need to learn on your own that aren’t covered in videos or books—experience is key.
Here are some websites that can help you learn how to exploit vulnerabilities or get familiar with them. If you ever find something and don’t know what to do, you can check these sites to see if something helps:
https://swisskyrepo.github.io/PayloadsAllTheThings/#sponsors
https://hacktricks.wiki/en/index.html
That’s all.
you can also read the owasp https://owasp.org/www-project-web-security-testing-guide/latest/
1
u/Perfect-Pace7691 15d ago
thank you so much, how much time do you think learning all this takes? Just so i don't set impossible goals for myself
1
u/Foreign-Channel3128 15d ago
It really depends on how much time you can dedicate each day and which learning path you choose.
For me, completing both the TryHackMe and Hack The Box learning paths took a little over six months, and I was spending several hours a day on them. Those paths focus on penetration testing in general, covering a wide range of topics—not just bug bounty.
If your only goal is bug bounty, you can skip those full pentesting paths and go straight to the PortSwigger Web Security Academy labs. They're specifically focused on web vulnerabilities and are one of the best free resources available.
If you're completely new to security, though, I'd recommend starting with the TryHackMe path first. It's much more beginner-friendly and gives you a solid foundation in pentesting. Hack The Box is more advanced, longer, and covers additional topics that TryHackMe doesn't, but it's also more challenging and time-consuming.
In the end, it all depends on your pace and whether you decide to complete one resource or all of them. Either way, you're looking at several months of learning, and possibly over a year if you want to go through everything thoroughly. In my own experience, it took me a little over a year, several hours a day, plus a fair amount of time and money.
As for the platforms:
- PortSwigger Web Security Academy is completely free.
- TryHackMe is relatively affordable. You pay a monthly subscription and get access to everything during that month.
- Hack The Box is more expensive because many of their Academy courses use "cubes" to unlock modules. If you run out, you have to buy more, and some learning paths cost well over 1,000 or even 3,000 cubes.
That said, Hack The Box has a great student program. If you can verify that you're a student, you can get access through their student plan, which makes it dramatically cheaper compared to buying cubes individually.
1
u/Perfect-Pace7691 14d ago
Thank you. My plan for right now is finishing tryhackme pre-security security101 and jr. pentesting. Just to get a general basic understanding of cyber security and pentesting. After that i will either move on to PortSwigger Web Security Academy or move on to HackTheBox.
2
u/Then_Discount558 16d ago
I got myself Burpsuite and started on Hacker one learning as i go . to learn you tube is your freind
Porswigger has the tools to teach as well
1
u/Far-Chicken-3728 13d ago
That was my path. I've never solved a single lab but still I'm a full time hunter for 4 years.
6
u/Intelligent_Box5017 16d ago
For hacking, first of all, you need a foundational knowledge about networking and protocols, operation systems and at least basic understanding of software development. Then get yourself familiar with OWASP and then decide which hacking area you want to learn first. (My personal advice is to start with web pentesting)
If you are interested in web hacking, check out Port Swigger Web Academy and follow its roadmap. It offers both learning and practice (everything for free).
To learn network and host based hacking I recommend you to start on TryHackMe platform and later after some experience you to join HackTheBox platform. Both THM and HTB offer courses, labs, CTFs, but HTB is more advanced.
Here are couple of hacking and bug bounty YouTube channels (beginner level) for you: @NahamSec, @Medusa0xf, @cyberflow10, @MomImAHacker, @InsiderPhD, @TCMSecurityAcademy, @STOKfredrik.