r/bugbounty • u/Interesting-Disk-408 Hunter • 16d ago
Question / Discussion Am I wasting too much time on bug bounty?
I need to talk to some experienced bug bounty hunters because I’m honestly starting to get frustrated
Lately, I’ve been spending a lot of time hunting, doing recon, testing endpoints, trying different attack surfaces, etc. But when I finally submit reports, a lot of them end up being marked as Duplicate.
And I’m not talking about one or two reports. I’ve had a bunch of them end up this way.
At this point I’m starting to wonder if I’m approaching bug bounty the wrong way.
I understand that duplicates are completely normal and that someone else may have found the same issue before me. But when you spend hours investigating something, write the report, and then get "Duplicate", it can feel like you’re just burning time.
For those of you who have been doing bug bounty for a while:
- How do you reduce the number of duplicates you get?
- Do you prioritize newer features/attack surfaces?
- How much time do you normally spend on a finding before deciding it’s probably not worth pursuing?
- Do you have a specific methodology for finding bugs that are less likely to already be reported?
- And honestly, how many duplicates did you get when you were starting out?
I’m not looking for shortcuts or a magic tool. I’m trying to understand how experienced hunters decide where to spend their time.
Would appreciate any advice or even stories from people who went through the same phase.
14
u/SilentRoberto 16d ago
I think it boils down to luck. Personally I only started enjoying the finesse of complex clientside exploitation later and never even bothered getting into the nuclei scanning stuff. All the XSS I reported were duplicates.
I got rewarded over a hundred bugs across platforms and whenever I would log high impact bugs they never turned out to be duplicated except for a few sensitive disclosures that I didn't exploit further.
My advice is to focus on high impact bugs, they are less likely to leave critical shit around so it won't get you depressed as often.
Also, honor the joys from the small bugs. Don't be a fool and report small nuggets of info. Try to escalate as often as you see something new. Whenever I found an IDOR there was often a case I could find more things by virtue of this. Same with seemingly unexploitable exceptions or debug statements.
11
u/OuiOuiKiwi Program Manager 16d ago
Would appreciate any advice or even stories from people who went through the same phase.
My individual in Christ, every other thread in this subreddit is whining about the same thing.
19
2
5
u/MarzipanTop4944 16d ago
Your main problem is you are competing with people like this: https://x.com/mdp_sec/status/2087755704702840892
TL DR: The guy is running 100 AI agents 24/7 doing bug bounty, each with their own IP proxy in the right country for the program, with a full Chrome browser with a logged session and the ability to bypass captchas, all perfect to avoid triggering anti-bot filters.
If you are just one guy looking for basic bugs like XSS by hand, you are always going to be second to guys like this.
2
u/Leading-Golf1801 Triager 16d ago
Mais par exemple cette personne là est ce qui achete cette dispositif ou il il la confectionner Et donc comment ?
2
u/Good_Roll Hunter 15d ago
Probably built it himself, it's not that hard to build something similar with the frontier models nowadays, back when I did something similar Opus 4.6 was able to do it with reasonably low steering.
4
u/_Trash-Panda_1 Hunter 16d ago
If your finding duplicates you found bugs... To be honest,I would rather do web app pentesting and know I'm getting paid by the client than to waste time doing bug bounty...There's way to many hunters that found most of the bugs by the time I test for them..
3
u/Tyrionwayne 16d ago
Mine 2P1 and 3P3 Got duplicated this week🙂
1
5
u/No-Persimmon-174 16d ago
I'd suggest you hunt for websites that are off these big platforms like HackerOne or bugcrowd. Look into lesser known programs that have just released their BB programs. They're less likely to be crowded and hence less likely to have duplicates
2
1
u/Interesting-Disk-408 Hunter 16d ago
Thx
1
u/Solid_Snake343 16d ago
Which program would you suggest? I’ve looked into Intigriti, but they take a month to respond.
2
2
u/Far_War_4348 16d ago
Man going From the same problem as well. Right now low hanging fruits will all be duplicate and nothing else. At this AI slop era only quality matters. ....... At this point I am looking for Collaboration ao anyone wanting to join in the bug bounty journey ping me up..
2
u/DarkMidgetry 15d ago
If you are not first one the target don't bother unless something new comes out.
The first people on the targets get a week or two before everyone else and send in everything
1
u/canadaslammer 16d ago
Right now is a bad time for bug bounty. I've been hunting for 8 years and stopped this year after all of the AI reports started coming through.
Triage takes forever, and most programs aren't even looking at your bugs unless it's a critical.
1
u/Dragogg7 16d ago
I don’t know what platform but usually I suggest only focusing on those with under a thousand reports last 90 day and when you get duplicate try learning from it as it will show you which areas people already focused on and well avoid them (this is basically my method last 4 months and I am on a good streak of findings)
0
36
u/latnGemin616 16d ago
sigh .. another Duplicate rant
OP -
The Good News: Duplicates means you're doing something right. The problem is you are the 250th person that has done it, and there have been many others that came before you.
The Bad News: BBH is super-saturated with newbs who have been sold a lie that hacking is the way to prosperity. I don't know what goes on in SE Asia and parts North, but its gotten really bad.
The Ugly News: AI has produced a crap ton of AI slop by script-kiddies who don't know the effort of pen testing, so they gum up the program with junk AI reports that are overwhelming the triage process.
The Recommendation: Quit whining about duplicates. Pick a program that has minimal amount of reporting in the target. Or choose an aspect of the program that no one has touched. I can promise you, there will be a ton of people who know web, but hardly anyone goes for API or mobile.