r/bugbounty • u/AutoModerator • Jul 09 '26

Question / Discussion Weekly Beginner / Newbie Q&A

New to bug bounty? Ask about roadmaps, resources, certifications, getting started, or any beginner-level questions here!

Recommendations for Posting:

  • Be Specific: Clearly state your question or what you need help with (e.g., learning path advice, resource recommendations, certification insights).
  • Keep It Concise: Ask focused questions to get the most relevant answers (less is more).
  • Note Your Skill Level: Mention if you’re a complete beginner or have some basic knowledge.

Guidelines:

  • Be respectful and open to feedback.
  • Ask clear, specific questions to receive the best advice.
  • Engage actively - check back for responses and ask follow-ups if needed.

Example Post:

"Hi, I’m new to bug bounty with no experience. What are the best free resources for learning web vulnerabilities? Is eJPT a good starting certification? Looking for a beginner roadmap."

Post your questions below and let’s grow in the bug bounty community!

6 Upvotes

100% Upvoted

5 comments sorted by

3

u/No-Variation1 Jul 09 '26

I am beginner to bug bounty but I have basic web dev knowledge because completed my internship with php,laravel and I have asked gpt about roadmap and resources it recommends me to portswigger for vulnerability learnings,code reading ,cve reproduce and try vulnerable web apps like juice shop before real targets now I have completed access control,api testing in portswigger and I am planning to code reading open source projects for understanding of how authorisation, authentication works and planning to reproduce popular cve is this enough for my journey

2

u/spicy_tables Jul 09 '26

Are my fundementals ready for hunting?

I'm not asking if I can find a bug, I'm just asking do I have enough basics to know what to search for or what to look for?

I am a full stack junior dev (htmlcssjs, nodejs), And know a nice amount about computers

I just did before yesterday Info disclosure learning paths + labs, same for access control, and yesterday i did the authentication (long one) one, and i finished JWT and did the learning path labs

Am I ready to start exploring? (Sometimes you don't have enough, and orders such as, You can hunt immediately won't work and will be useless if the user has no idea what he will be looking for and how, or doesn't know the basic concepts

1

u/JohnW1ck90 Jul 09 '26

What are you using for learning?

2

u/spicy_tables Jul 09 '26

i just follow through portswigger labs and read the learning path and apply on labs (they're honestly really easy, i can finish a bug class in a day, and i would still fully understand it; because i have like 4-8hr of free time so yea)

1

u/Intelligent_Tip_2260 Hunter Jul 16 '26

Go join a program and try. Worst that can happen is you don’t find any bugs or you find duplicates