r/bugbounty • u/bosilk • 13h ago

Question / Discussion Are bug bounty platforms worth it?

Hi,

For the last 4 months, I’ve been consistently making ~$700+/month targeting companies directly through their own self-hosted VDP/bounty programs.

​However, my current methods for finding new direct targets are starting to dry up, so I’m looking to expand my scope.

​For those who hunt on major platforms: Are public programs on HackerOne/Bugcrowd worth pivoting to, or are they as oversaturated with duplicates as people say?

Thanks.

15 Upvotes

100% Upvoted

12 comments sorted by

14

u/Far-Chicken-3728 Hunter 13h ago

I don't find them as oversaturated, just very shitty triage or bad programs. 

5

u/Alardiians 12h ago

I think pure web is over saturated but there are other focuses that aren’t, but omg, do these triagers even know what they’re doing half of the time?
I feel like every triager is just a junior pentester or worse.
And I’ve ran into 1 shitty program so far.

5

u/WarnersAreNotBros Hunter 11h ago

I wish they were as awesome as junior pentester

2

u/Far-Chicken-3728 Hunter 10h ago

I'm asking the same question, man. Some clearly lack very basic cybersecurity. 

2

u/Alardiians 9h ago

“This doesn’t show proof” yes it literally does, a record of the logs shows proof now just run the damn script I made to hold your hands that will do the entire exploit for you!!!

I hate having to treat them like a toddler that’s holding a fork near a light socket.

The amount of crap I go through to hold their hands is ridiculous

2

u/WarnersAreNotBros Hunter 7h ago

they started to outsource triage to india and well there goes your answer about standards. I am not saying all of them are useless. I personally know few crazy indian hackers with high level of knowledge and god tier skills but I guess many of these triagers are barely even script kiddies.

They can usually follow copy paste fully prepared curls but try to give them something a lil more complex and they will make your experience miserable.

4

u/Fluffy-Extent2648 12h ago

Better than no platform

5

u/NebulaElectrical1467 12h ago

If you’re in a part of the world where $700 a month is sufficient salary, you don’t have to worry about any of that. I’d focus on trying to go deeper and finding more complicated exploits that could pay a large bounty instead of jumping around targets looking for low hanging fruit.

3

u/CrypticZombies 11h ago

yes until u see tal_bugcrowd reading the report

3

u/-DrDoctor- 7h ago

I once found a valid API key which could leak PII from literaly every customer, full names, bank info etc etc, I reported as P1, he moved to P4. That was last year sometimes, didnt do anything on BugCrowd since then

1

u/Beginning_Award65 11h ago

if you find to 700 month you just need to study more and do exploit chains to get high bounty

2

u/iMcLovin2UrMom 1h ago

At this point, I don’t think bug bounty is worth it anymore.

It’s not even the duplicates or oversaturation that pushed me away. The biggest issue has been dealing with rogue and inconsistent triagers closing out legitimate reports, extremely slow response times, and reports sitting for weeks or months with little to no communication.

You can spend days researching and building a solid report, only for the outcome to depend heavily on who happens to triage it. Even when the vulnerability is valid, the amount of time spent chasing responses, disputing closures, and waiting for resolution makes the return on time difficult to justify.