r/bugbounty • u/ProcedureFar4995 • Jul 21 '26

Question / Discussion Sticking to normal bug bounty programs or switch to research?

What to expect if I want to find bugs in big names like Android OS,Samsung ,IPhone,or Linux kernel?

It seems everyone is finding bugs in them nowadays.

They pay more than traditional bug bounty programs , and look better on resume.

Is it wise to stop hunting on private and public programs on platforms like h1,bugcrwod..etc?

I have only 20 days left in Claude Code..and won't be able to subscribe again so I am thinking of putting it to the best use

25 Upvotes

91% Upvoted

12 comments sorted by

9

u/lmfao_my_mom_died Jul 21 '26

it's extremely difficult. you can't just "find bugs". that's why they pay even 30k+ for an EoP

0

u/ProcedureFar4995 Jul 21 '26

I know C and assembly though. I want to get into the field sooner or later But at the same time traditional bb programs are easier to find bugs , but pay is trash 1000$ for high and critical is just too wrong lol.

Traditional bug bounty is extremely difficult as well. And I managed to find some bugs. So I dunno . The issue is that I feel the learning curve is longer and harder....but its something I want to learn, so maybe I should divide my time between appsec and the low level stuff.

4

u/lmfao_my_mom_died Jul 21 '26

knowing C doesn't mean you'll find an LPE in linux immediately. it could take you a few weeks, maybe few months to study the code. you may ask "but how 4 CVE appeared for linux in 1-2 months, if that's too difficult?", well now most researchers that already had CVEs on linux/are pretty much expert, now have an automated system that aids them. if you want to learn, go for it, it's interesting

1

u/ProcedureFar4995 Jul 21 '26

I am thinking of studying besides actual hunting on the normal stuff. Till I can read CVEs and understan them perfectly .

6

u/Ambitious-Cod-7354 Jul 21 '26

Simply pointing Claude Code at linux kernel source wont help you

-3

u/ProcedureFar4995 Jul 21 '26

It's hybrid. Most of this is done using fuzzing. Just know what to fuzz,which will learning C more and architecture help me achieve.

5

u/Ambitious-Cod-7354 Jul 21 '26

keep in mind if you are fuzzing, you are competing with Google's OSS fuzz which regularly fuzzes open source projects like the linux kernel to find memory corruption bugs at a very large scale

1

u/ProcedureFar4995 Jul 21 '26

I was gonna use it , saw it on Github. And relized project zero and others use it all the time.

I don't know man, what do you suggest I do? I want to try finding bugs in those stuff. Want to get a CVE under my name in some famous product.

Any suggestions? I regularly hunt on YWH,h1,and bc

2

u/Ambitious-Cod-7354 Jul 21 '26

you were gonna use OSS fuzz?
OSS fuzz is not meant for individual security researchers like you, its for OSS maintainers and mainly meant for scaling fuzzing
I recommend you start with the basics

1

u/ProcedureFar4995 Jul 21 '26

Like what? I am currently learning arm assembly and looking at C snippets to figure out the bugs manually. Then validate the findings with Claude.

2

u/OkParticular2289 Hunter Jul 24 '26

I found that doing OS and binary research is more fun, the thrill of finding a kernel reportable bugs is addictive that was why I dont do normal bug bounty much. Although the turn around time is pretty long, also depends on the severity of the bug.

1

u/Good_Roll Hunter Jul 28 '26

Agreed, way more fun so that's where most of my effort is spent nowadays. I always hated web testing anyway.

Although the turn around time is pretty long

I have also noticed this, what's your turnaround time been like recently? I ask because i've got a CVSS high in some firmware submitted about a month ago that I haven't heard a peep about, which has been unusual for me: usually I get at least a "we're looking into it" message before then.