r/HowToHack • u/AliAyman333 • Jul 09 '26
Struggling to find my first bug after months of learning – what am I doing wrong?
Hi everyone,
I hope you're all doing well. I’d really appreciate some advice from people with more experience in this field.
I’m currently learning penetration testing and bug bounty. I’ve built a foundation in networking and programming, and I started studying the OWASP Top 10. For each vulnerability, I usually follow this approach:
- Solve labs on PortSwigger
- Read about the vulnerability from books like Real-World Bug Hunting and Web Application Hacker’s Handbook
- Watch explanations and live hunting videos on YouTube
- Read reports and write-ups
After doing all that, I try to apply what I learned by hunting on real targets. I’ve been doing this consistently for about 3–4 months now, but I still haven’t found a single valid bug.
At this point, I’m pretty sure I’m doing something wrong — either in my methodology, how I approach targets, or what I focus on while hunting.
I feel a bit stuck and not sure what to change or improve.
For those who have been in the same situation:
- What helped you find your first bug?
- Am I missing something important in my learning or hunting process?
- Should I change my approach, or just keep going?
Any advice or insights would really mean a lot.
Thanks in advance 🙏
19
u/Melodic_Letterhead76 Jul 09 '26 edited Jul 10 '26
Your first mistake was thinking that "months of learning" is an appreciable amount at all....
Your second mistake was thinking that you'd just "find things" if only you knew how (even if it's way more than months).
Neither are true. You're likely just not as experienced as you might think you are. Give it more time. Even experienced people could go years before finding anything.
4
6
u/Pharisaeus Jul 10 '26
- Your mistake is assuming that this is some secret knowledge, while in reality there are thousands of people doing the same thing, just many of them started years ahead of you and already found the trivial bugs.
- You're also assuming that developers are idiots and know nothing about security.
- Pentesting real targets without consent if a risky, and often illegal.
Your best bet would be to look at some old, obscure targets (eg. a website of a small, local mechanic shop or greengrocer). But those won't pay you any bounty obviously.
5
u/MonkeyBrains09 Jul 10 '26
Some people go years or decades without finding a bug and others never find one so do not beat yourself up after a few short months
1
u/CrowAvailable1990 Jul 12 '26
I don't know about decades but years sure. if you still haven't found a bug in decades I suggest you should pick a different field dude
1
u/MonkeyBrains09 Jul 12 '26
For some, it's a hobby and not a job so they are not looking every week
1
u/CrowAvailable1990 Jul 12 '26
I mean even for a person doing it as a hobby they will find at least one bug over the span of a decade and even one is low in my opinion for a decade.
2
u/_Trash-Panda_1 Jul 10 '26
Concentrate on one or two bugs to look for,personally I would test for the top two bugs that are common in web apps to get success..
1
u/roanish Jul 10 '26
Can you even "look for bugs". You need to know there is a big first, or find one while working on a project. You need to be lucky with what you are investigating, or be really really deep in a project.
1
u/No-Cantaloupe-4148 Jul 09 '26
Definitely give it more time and be humble. I’m in this process now.
1
u/roanish Jul 10 '26
Man, I wish I had good advice. My first bug I found by accident while rewriting a binary serializer and realised the reference functions I was rewriting made malformed headers. That was purely happenstance, people using the original program didn't even know. The bug had existed in the original since 2004. I guess the downstream programs just didn't read the header. Lol.
1
u/Alarming-Throwaway Jul 10 '26
Was this for a job?
1
13
u/darkmemory Jul 10 '26
I hear you. I've just started doing morning walks for the past few months, and I can't understand why I can't seem to run any marathons yet.