Bug Bounty + CVE Hunting

12-month roadmap to enter bug bounty from zero, top 10 paid vulns in 2025, first CVE in open-source, ProjectDiscovery recon stack and report disqualifiers.

Bug Bounty + CVE Hunting

HackerOne paid $81M in 12 months (Jul 2024-Jun 2025), +13% YoY. AI vulnerabilities grew +210% YoY; prompt injection +540%. If you have a programming background (PHP, JS, Python), bug bounty is the parallel path to OSCP that monetizes from month one and builds a publicly auditable portfolio.

Reality check: ~5% of hunters monetize meaningfully. First-year income runs from $0 to$3K for most. But building a public portfolio (CVEs, Halls of Fame, disclosed reports) changes your CV permanently — worth the effort even without immediate monetization.

Bug bounty market state 2026

Top 5 platforms

#	Platform	Best for
1	HackerOne	Global leader, biggest volume of programs and bounties
2	Bugcrowd	33.7% mindshare (rising); more private programs, fast payouts
3	Intigriti	Most recommended for beginners 2026. Cleaner onboarding. NVIDIA enterprise there since 2025
4	YesWeHack	50,000+ hunters, strong in Europe/Francophone, free “Dojo” training
5	Synack	Closed — invitation only after track record on HackerOne/Bugcrowd. Not an entry point

Program types

• VDP — No payment, only “swag”/recognition. Practice legally and build CV.
• Public program — Anyone reports; high competition, average payout.
• Private program — Invitation based on reputation; less competition, better pay.

2025 real numbers

• 85,000 valid reports on HackerOne in 2025 (+7%).
• Top 100 hunters all-time: $31.8M cumulative.
• AI vulnerabilities +210% YoY, prompt injection +540%.
• 1,121 programs with AI in scope (+270%).
• IDOR +29%, IAC +18%, while XSS and SQLi decline.
• 70% of hunters use AI (Caido, ChatGPT, Claude) in 2025 workflow.

Sources: BleepingComputer — HackerOne $81M, HackerOne 2025 HPSR.

---

12-month roadmap (2026)

Months 1-2 — PortSwigger Web Security Academy

portswigger.net/web-security/learning-paths — 190+ labs, free. Pace: 7 labs/day = 1 month.

Recommended order:

1. Server-side: SQLi → Authentication → Path traversal → Command injection → Business logic → Information disclosure.
2. SSRF (heavy focus: pays very well — see §5).
3. Client-side: XSS → CSRF → CORS → Clickjacking.
4. Advanced: Access control / IDOR → JWT → OAuth/SAML → GraphQL → Race conditions → Prototype pollution → HTTP request smuggling.
5. Run “Mystery labs” weekly to simulate real hunting.

Months 3-4 — Free VDPs (10 with exact URL)

#	Program	Scope
1	U.S. Department of Defense	Largest in the world, swag + Hall of Fame
2	NASA VDP	Public assets
3	GitLab	Pays + has open-source VDP
4	Mozilla	Web bounty + client bounty
5	CISA federal civilian agencies	Multi-agency US
6	Department of Justice	US federal
7	GSA Login.gov	VDP on HackerOne
8	Department of Commerce	US federal
9	HHS.gov	US federal
10	WiCyS VDP	Training-oriented

Curated repo (200+ programs): github.com/projectdiscovery/public-bugbounty-programs.

Months 5-6 — Small programs ($50-$500)

Patchstack (WordPress plugins), Hostinger, Spanish/European programs on Intigriti. Filter for low minimum bounty.

Months 7-12 — Serious programs

Shopify, paid GitLab, Uber. Apply to private as HackerOne reputation rises (>500 reputation opens invitations).

---

Top 10 paid vulnerabilities 2024-2025

Based on HackerOne HPSR 2025 + disclosed reports:

#	Type	Typical P1 bounty	2025 notes
1	SSRF with cloud creds	$5K-$50K	Still top. High payouts when reaching IMDS metadata
2	IDOR / Improper Access Control	$1K-$15K	+29% YoY in valid reports. Clear trend
3	OAuth/SAML/SSO misconfig	$3K-$25K	Full account takeover = P1
4	Business logic privilege escalation	$2K-$20K	Hard to triage, pays great if impact demonstrated
5	Prototype pollution → RCE	$1K-$10K (web), $20K+ (RCE chain)	js-yaml, lodash still active
6	JWT confusion / alg:none	$500-$5K	Usually P2-P3
7	Subdomain takeover	$200-$3K	Low individual bounty, high volume, ideal for beginners
8	GraphQL introspection + abuse	$500-$10K	Exposed mutations → IDOR/auth bypass
9	Race conditions (TOCTOU, balance dup)	$500-$15K	Kettle’s 2024 “single packet attack” reactivated category
10	Open redirect → SSO chain	$500-$5K	Only pays if chained to token theft or ATO

Severity → bounty (HackerOne platform mean)

Severity	Typical bounty
P1 Critical	$5K-$50K+ (top programs $100K+)
P2 High	$1K-$10K
P3 Medium	$250-$2K
P4 Low	$50-$500

Bugcrowd uses its own VRT instead of CVSS: Bugcrowd VRT.

Public disclosed reports (training): github.com/reddelexc/hackerone-reports.

---

Modern reconnaissance 2026

ProjectDiscovery stack (de facto)

subfinder -d target.com -all | \
  dnsx -silent | \
  httpx -tech-detect -title -status-code | \
  nuclei -t cves/ -severity critical,high

Tool	Purpose
subfinder	Passive, +30 sources
amass enum -passive	Complementary, finds different things
httpx	Live + tech fingerprint
nuclei	Community templates, focus -tags takeover,exposure,cve
dnsx	Mass resolution
katana	Modern crawler (succeeds hakrawler)

GitHub recon

Tillson Galloway “GitHub Recon Checklist 2025”:

• trufflehog — verifies the secret is still live (better than gitleaks for real bug bounty). Supports S3, Docker, Slack.
• gitleaks — faster for sweeping.
• “Oops commits” — Sharon Brizinov made $25K in 2025 scanning dangling commits in GitHub Archive.
• Useful dorks: org:target "api_key", org:target filename:.env, "target.com" password.

Historical

• gau + waybackurls for archived URLs.
• unfurl to extract unique params.

JS analysis

• LinkFinder — extracts endpoints/params from JS bundles.
• JSluice (TomNomNom) — better successor: extracts secrets/URLs by usage, not just regex.
• SecretFinder — complements.

Subdomain takeover / dangling DNS

SentinelOne reported >1,250 instances in clients in 2024-2025. nuclei subdomain-takeover/ templates cover GitHub Pages, Heroku, Vercel, S3, Shopify. Maintained list: github.com/EdOverflow/can-i-take-over-xyz.

---

Your first CVE in open-source

Project selection

• Stars 100-5,000 (serious enough, not audited to death).
• Last commit <6 months (maintained).
• No strong SECURITY.md, no prior CVEs: indicates nobody has audited.
• Language you master (PHP, JS, Python all fit).
• Filter by: package with >10K downloads/week on npm/PyPI = greater reported impact.

Typical “first-CVE” bug classes 2025

Class	2025 examples	Pattern
Prototype pollution in npm	lodash CVE-2025-13465, js-yaml CVE-2025-64718, csvtojson CVE-2025-57350	_.set/_.merge, recursive Object.assign without sanitizing __proto__/constructor/prototype
Path traversal in parsers	Zip, tar, config files	../ in processed names without path.normalize() + validation
SSRF in webhooks	Endpoints accepting user URL	Without scheme/domain allowlist
Deserialization	PHP unserialize, Python pickle, Java	User-controlled input
GitHub Actions pwn requests	CVE-2025-61671 (Microsoft Symphony, CVSS 9.3), CVE-2025-47928 (Spotipy)	pull_request_target + checkout of untrusted PR

Key tools:

• Gato-X (offensive, Actions audit)
• poutine (defensive)

CNA process

Route	When	Timing
GitHub Security Advisory	Projects on GitHub	CVE in 1-3 weeks
MITRE webform (cveform.mitre.org)	Project not on GitHub or already with CNA	3-6 weeks
Product’s own CNA	Microsoft, Apache, GitLab, npm	Variable

If the product has its own CNA you must go through them. MITRE/GitHub reject duplicates.

Standard disclosure timeline:

• 90 days (Project Zero).
• +30 days extension if patch in preparation.
• CERT-EU/Northwave use 90+30 policy.

---

Supply chain pentesting

Technique	2026 status
Typosquatting	PyPI removes hundreds monthly. Reportable as vuln on the legitimate maintainer if you reproduce damage
Repo-jacking	36,983 vulnerable repos found; ~3% success on GitHub. Look for dependencies pointing to non-existent usernames
Dependency confusion	Still works in 2026 if victim doesn’t pin registry. WARNING: legal gray zone — only in programs with explicit scope
GitHub Actions pwn requests	Hot category 2025-2026. CVE-2025-30066 (tj-actions/changed-files, 23K affected repos, CVSS 8.6)

Sources: Checkmarx — repo-jacking, Wiz — tj-actions changed-files supply chain.

---

Writing an accepted report

Validated HackerOne structure

1. Title — [Vuln type] in [endpoint] allows [impact]. Example: “Reflected XSS in /search?q= allows session theft”.
2. Summary — 2-3 sentences: what, where, what attacker achieves.
3. Steps to reproduce — numbered, copy-paste cURL/Burp request, screenshots per step.
4. Proof of concept — GIF/video ≤2min. Hosted on HackerOne (not external).
5. Impact — concrete scenario: “Attacker can [X] resulting in [Y loss]”. Calculated CVSS.
6. Suggested mitigation — optional, adds points.

Instant “Informative” / “N/A” triggers

⚠️ Instant disqualifiers

These findings are near-guaranteed rejections unless you bring chain or demonstrated impact:

• Logout CSRF (universally rejected).
• Missing security headers without impact demo.
• Self-XSS without pivot.
• Open redirect without chain.
• Vulns in explicitly excluded scope (READ the policy).
• Pure tabnabbing without chain.
• Banner grabbing / version disclosure standalone.
• DoS without program accept-risk.

Appealing severity

Don’t argue tone — bring data. Demonstrate broader exploitation scenario, chain with another vuln, calculate CVSS with justified vector. Request reassignment citing similar cases from the program’s own policy.

---

Disputes, fraud, horror stories 2024-2026

Case	Year	Lesson
Apple-$50K silent patch	2024	Researcher reported a vuln meeting public criteria; Apple silently patched without paying and banned the Apple ID after the post. Apple raised RCE max to $2M in Oct 2025 to silence criticism
HackerOne ghosted $8.5K	Jan 2026	Documented in The Register: payout stuck on the platform itself
IBB suspended	Mar 2025	HackerOne paused new submissions to Internet Bug Bounty due to backlog. If you plan to live off OS CVEs via IBB, watch this
Microsoft 2025	—	$17M paid, “In Scope by Default” model for critical vulns in any product. Disputes rare

Bug collisions (duplicates)

• Universal policy: first-come, first-served, decided by report timestamp.
• Protection: report immediately, save screenshots with metadata, don’t share POC privately before reporting.
• If marked dup but you bring novel variant, request partial bounty with technical argument.

Personal legal protection

• Never test outside scope.
• Save all communication.
• For OS CVEs: use private GitHub Security Advisory first (90-day window), never public post before fix without agreement.
• Consider dedicated VPN and separate account for hunting work.

---

Persistent resources

• HackerOne Hacker101
• PortSwigger Academy
• Methodology repo (amrelsagaei 2025)
• Curated disclosed reports
• Public programs list
• GitLab vuln DB (npm/PyPI by category)
• NahamSec recon talks
• STÖK videos

---

Related resources

• Professional web recon — Passive, fingerprinting, type confusion.
• Tactical glossary — IDOR, SSRF, JWT, Mass Assignment.
• Cloud Pentest — Cloud vectors paying top bounties.
• LLM Security — Category +540% YoY in HackerOne 2025.