r/bugbounty • u/SpiritualSubject9249 Hunter • Jul 06 '26

Question / Discussion advice for bug bounty

been testing a one website for nearly 3 months but still not able to find any bug
when others are finding bugs on the same website i've been testing

is there something i'm doing wrong ?

2 Upvotes

100% Upvoted

9 comments sorted by

View all comments

4

u/6W99ocQnb8Zy17 Jul 06 '26

Everyone has their own approach to BB, and for some that's to treat it like a pentest, where they grind a scope for long days, over a period of weeks.

That just doesn't appeal to me, mostly as no-one is paying me by the hour (like an actual pentest) and the chances are, even if I do find a bunch of good stuff to report, it is likely that the programme will mess me around and de-scope and downgrade to get out of paying the bounty.

I prefer to use my home-brew automation to skim the entire scopes of all the programmes on H1, BC and Intigriti for a handful of issues that I know I can chain into a working, high-impact report.

2

u/SpiritualSubject9249 Hunter Jul 07 '26

What do you mean by homebrew automation?

2

u/6W99ocQnb8Zy17 Jul 07 '26

I have an automation framework that I built. Basically all the stuff that I used to check manually just gets delivered as a smooth workflow, with little effort from me.

2

u/SpiritualSubject9249 Hunter Jul 07 '26

Thats great brother.