Bug bounty hunting has seen a lot of changes in recent times. If you were someone who started in 2017 or 2018, you know it was pretty easy peasy to find bugs.

But the landscape has changed since then. The thing that made this even difficult for beginners to get started is because of the automation that's being done.

You see automation wasn't non-existent at that time. But it wasn't too mainstream I would say. For example, back then we didn't have Nuclei.

Now, every hunter is using nuclei to scan their targets to grab the easy one first. Before Nuclei, it wasn't like this.

Also, there wasn't much awareness about this skill. But as people started making more Youtube videos and how to find bugs, it garnered a lot of attention from other people, even from those who didn't have any tech experience.

The Fake Promise

I'll tell you about a very basic thing that most people don't comprehend. We all know that some people are naturally more talented than others.

Perhaps they are more inclined or hardworking then you are. So they outperform the one's that don't have these qualities.

This means that you may not get successfull in a few months. You might have to spend a few more months or generally more time to understand how to find bugs.

The one person you saw tweeting their success story and how he became a million dollar bug hunter might be doing something else that he doesn't tell you.

He might have some hacker friend who got him into this and he doesn't tell all this. Also, he might be a developer in the past so that's why he's making big bucks in bug bounties.

One more thing, it's not all speculation. It's all true. All these million dollar hackers have either spend so much time learning and diving into the concepts or they are hiding something else that gave them the easy start.

So don't listen to anybody again that says you can replicate the same success in few months of time.

I was in the same condition. I didn't found many bugs in my first year despite giving so much time. But 8 or 9 months in, I got one bug and then a few little ones after 12 months of efforts.

Since then, it's been a roller coster. I get a few bugs here and there. Nothing too crazy after a year of effort. But I'm better than the previous year, when I only found one bug.

But the competition has increased also. Also, I ditched the love for XSS for sometime. If you ask me why? I would say don't just fall for vulnerabilties that excite you like popping up an XSS.

Sure it feels amazing to see XSS pop up. However, there will be basic vulnerabilites lying around that can support you for whole month.

Learning basic bugs like Social Media Account takeover and session doesn't expire after logout do pay the bills. Though you have to first check and see what's in scope and what's not.

Also, try and stalk famous hackers. Sometimes, they reveal vulnerabilties that aren't told anywhere.

So yeah, you can still become a million dollar bug hunter but only if you give it time. Don't panic if you don't find anything for months.

A little tip I have for you is focus on learning big vulnerabilties like SQLI, RCE because the payouts are very awesome.

Finding only one SQLI might just net you 5k USD. You're getting the point right? After getting that $5000, you may relax and don't find anything for the whole year. That is what's cool about learning big vulnerabilities.