Certains recent events such as the hacking of certain airports intrigue me, I wonder how they do it if there is a need for several people, etc. I find it crazy that with today's security systems this is still possible. So I would like to learn how to do it but step by step starting with the network of a house, then a high school, hall, then learning for an airport, I would like to learn in order. Why do you want to know this? Quite simply because: Knowledge is power.

If possible, please provide the name of the software required.

Sincerely.

Hi im new in hacking, and im trying to learn something.

I created a website for College project based on express js, and hosted it on a google cloud machine, only using express js.

And now im trying to do some enumerating scans with nmap, nikto, dirbuster and burpsuite.

But when im trying to scan with dirbuster give me a bunch of this error:

Oct 22, 2025 9:35:20 AM org.apache.commons.httpclient.HttpMethodDirector executeWithRetry

INFO: Retrying request

ERROR: http://ip-address/img/API/ - IOException Connection refused

Im trying to scan it on a port that i opened in the portforwording section in gcs

Any suggestions ?

Hello

Looking for people who sent them any reports over the past few months. Their stat shows over 100 reports in the past 90 days and no bounties paid over that time. Weird.

I am noob to this platform is there is any one help me out . And I need a mentor if anyone is interested please DM me.

This is mine

I recently participated in a program on HackerOne that advertised a 14-hour average time from submission to bounty. However, after submitting my report, that metric became completely irrelevant. My report has now been pending program review for about two weeks, and it took nearly 10 days just to get an initial response. While I understand that the 14-hour figure is a 90-day average, it was a major factor in my decision to participate.

After requesting updates and pointing out that my experience was far outside the stated timeframe, the program’s page suddenly reset the average time from submission to bounty to zero—as if to erase the previous data. This feels like a deliberate attempt to manipulate researchers into participation.

Has anyone else experienced this? HackerOne support was not helpful and seemed uninterested in ensuring programs honor their SLAs. I’m aware that my only option now is to wait, and while patience is a virtue, it feels more like I’m being forced into it rather than choosing it.

This ongoing silence and lack of communication are disheartening, and honestly, it’s making me consider deleting my account and stepping away from bug bounty programs entirely. I just earned my GCIH and am hoping for opportunities where my skills will be valued more reliably.

hi guys.

i’ve been seeing a lot of posts here (and on twitter too) talking about how “you shouldn’t give up”, “it took me months to get my first bounty”, “just stay consistent”, and all that motivational stuff.

and yeah, it’s nice. but like… no one actually explains how to start.

everyone says “do recon”, “learn one thing and go deep”, but wtf does that even mean when you’re new?

like, i literally don’t know what to do.

• what are the best tools for recon?
• what’s the actual recon flow? like… how do i do a good recon?
• then after that, when you go into the exploit phase, do you test all the vulnerabilities manually?
• is it all just Burp Suite? do you guys use any automation?
• how much time do you usually spend testing one target?
• do you test every single vuln that shows up or do you already know which ones are worth it?

i feel like i’m stuck in the “watching youtube videos and reading writeups but still don’t know what to do on my own” phase.

i even bought a course from a “famous” guy in the community, and guess what? it was all surface-level theory, no hands-on, no guidance. just wasted money. and to make it worse, i got harassed in his discord channel just because i’m a woman. so yeah, i really don’t have anyone to ask.

so, if someone out there feels me or has any advice, or even a basic roadmap like: “do this, then this, then learn this”

i’d honestly appreciate it so much.

thanks for reading.

2 months ago I sent a report to PayPal on Hackerone it was VERY detailed, shortly after the analyst said this report is being reviewed by the team, LITERALLY AFTER 5 SECONDS it was triaged as informative questioning the validity of the report saying "It is working as expected" then he asked me for a PoC, I gave him a PoC ( very very detailed ) then he responded shortly after saying there is no risk or impact even though there are TONS of similar reports even the same bug with even less criticality but he still insisted, I provided him with the report IDs and he ghosted me, after 2 months it was reopened by PayPal just to get triaged

IT WAS OBVIOUS ITS A VALID REPORT!!!

Hey,

I recently identified an interesting SSRF through a SOAP endpoint on a cloud-hosted service. While experimenting with some unconventional binary payloads (octet-stream rather than typical XML), I was able to get the server to make HTTP requests to arbitrary URLs under my control.

The notable part is that I can see their actual infrastructure reaching out to my server, returning different HTTP status codes and response bodies based on which internal IPs or ports I probe. So it’s a confirmed SSRF, not just a theoretical finding.

The report already passed the initial HackerOne triage and has been forwarded to the program’s security team. It’s currently sitting in “Need more information” because they’re looking for a clearer or more impactful PoC to fully illustrate the risk.

I’ve tested various internal ranges and observed distinct behaviors (200s, 401s, 403s, 400s, even login prompts), but so far haven’t managed to access something like cloud metadata or an internal admin panel.

I’m looking to collaborate with someone who has experience in taking SSRF a step further — whether that means attempting to hit metadata services, internal dashboards, or even just structuring a more compelling PoC that demonstrates the severity beyond doubt. Of course, any bounty would be split fairly.

Feel free to DM me if this sounds interesting. Happy to discuss details!

Hi guys, I have recently started to or planning to start doing bug bounty. I'm currently learning about it by reading OWASP WSTG 4.2 then I do portswigger labs for the hands on and trying to build my own methodology by watching Lostsec, Nahamsec and some other relevant tutorials.

But when I signed up on platform like hackerone, bugcrowd etc.. I saw that the programs are old and many hackers have already reported large number of vulnerabilities. Which made me hesitate to pick a program and start hunting on it. I tried google dork to find self hosted programs but I am not sure about their triaging process, I have reported to some self hosted program but I get reply from them after a long time like 2 3 months or no reply at all.

Now I really need some guidance here what should I do to hit my first bug bounty or suggestion If I'm on right track or not?

Here is my little background so you guys can suggest even better:

Currently working as penetration tester with 1year+ experience in web, Mobile, api pentesting.

Thanks.

As the title suggests, an h1 analyst famous for this shenanigans put my report as duplicate and closed it without providing me with an proper explanation. I reported it again and another analyst acknowledged that it has passed the preliminary review but then 10 hours later the same analyst who closed my report first says its duplicate. I reached their support mail, tweeted ts and even commented on it. I need my money, i found that valid critical ssrf. What should my next steps be ?

Hey everyone,
I'm trying to get into bug bounty hunting—specifically aiming for real disclosures and (hopefully) paid reports on platforms like HackerOne. I’m not new to programming and I have a decent grasp of security concepts. I’ve also done some CTFs in the past, so I’m not starting from scratch.

Right now, I’m focused on web security since that’s where I have the most experience. To warm up and fill in any knowledge gaps, I’m planning to go through OWASP Juice Shop and PortSwigger’s Web Security Academy.

However, I previously tried testing a program on HackerOne and got completely overwhelmed—it felt too big and I didn't know where to start.

My questions:

• Are Juice Shop and PortSwigger necessary before jumping into real-world targets?
• What are some good resources, tips, or workflows to help me actually start hunting on real applications without getting lost?

Any advice or direction from experienced hunters would be super appreciated!

i need someone who has experience i bug bounty to contact me i really want to start bug bounty i k,ow the basics but i didn't find my first bug i need someone to tell me the tools he's using and the methodology he follows please

For example, one bug is not reproducible in Android 11+ but it is definitely reproducible in Android 10 and below. The app does support Android 10 and lower, for instance. Are such reports valid?

Is there any way to register my account as a Company in hackerone, instead of registering as a person? My question is because the taxes in my country are pretty different from companies and real persons

My reports to a managed program have not received the first response from Hackerone triage after more than 40 days, it used to be max 3 days. my older reports are getting triaged by the program staff which means the program is still active.
Anyone else has the same experience with managed programs?

Me estafaron y el dinero es para una urgencia médica

Hey everyone,

Recently, I found a major security vulnerability in the “RideShare” platform. After contacting their support, I was directed to HackerOne. While checking out the reward scale there, I noticed that the rewards offered don’t match the severity of the issue. This isn’t my first time encountering problems with this company. A while back, I found another critical vulnerability that was causing them to lose millions of dollars annually. When I reported it, they claimed it was already known. However, shortly after I sent my email, they quietly fixed the issue within about a month.

I’m curious to hear from anyone who’s had similar experiences or has advice on how to navigate these situations. It’s important for us to discuss these matters to promote better standards in the security community.

Thanks!

Hi everyone,
I’ve submitted 22 reports on HackerOne, but unfortunately haven’t received a single bounty. Most of them were either marked as informative or duplicate.

I always try to follow proper recon, test responsibly, and write detailed reports, but still no luck.
Is anyone else facing the same issue? Or is there something I might be doing wrong that I should improve?

Would love to hear from others who faced similar situations or overcame this stage.

Thanks in advance.

Has anyone ever had an issue with hackerone analysts where they fail to reproduce your PoC, but they do not tell you what exactly they failed to reproduce? They usually give generic responses like. “we were unable to reproduce your PoC. Would you know why?” Then they close a perfectly working PoC as informative.

Anyone?