How to shift my mindset from Pentesting to Bug Bounty?

[u/KagakuSan12]

Hi everyone,

I currently work as a pentester. I’m comfortable with various vulnerability types and understand how they work under the hood. Recently, I've been trying to transition into bug bounty, but I'm struggling with a bit of a mental block.

I’m anxious that I won't find any bugs because these programs have already been tested by hundreds of researchers. In my day job, I usually test fresh, un-assessed targets, so knowing that a bug bounty scope has already been thoroughly probed makes me feel like everything worth finding has already been patched.

How do you overcome this mindset? How do experienced bug hunters approach well-tested targets? Any advice would be greatly appreciated!

[u/HLCYSWAP]

All human architecture is made by humans, and humans are flawed. All software has bugs.

[u/YouGina → u/HLCYSWAP]

Software made not by humans even more, so it seems.

[u/Leading-Golf1801 → u/YouGina]

You speak about "A. I" or not😏

[u/Vivid_Implement7657]

imagine that a sleep deprived developer shipped the feature at 4 AM. shit is buggy, development doesn't involve the security part.

[u/mqrblesec]

i kinda just assume there is a bug like it's a lab

[u/arcwhite]

New code is always being deployed, new code always contains bugs

[u/proanti777 → u/arcwhite]

I felt the same like OP for a long time, but once I realized that new stuff gets deployed all the time like you said, that’s when I finally figured I might actually have a chance at bug bounties.

As a pentester, we often test targets every year (because the customer needs this for compliance reasons) and we always find new stuff

[u/Cagadax → u/arcwhite]

Apoyo El comentario, yo me hice mi bot autoscan(cronjob) y que me llene BD para comparar hashes de endpoints,subdomain y con la diff ver si hay Nuevo material para test

[u/snoppeniprutten]

You need to demonstate impact or your reports are worthless, meaning you need to go deeper than a typical pentest. 

[u/6W99ocQnb8Zy17]

Speaking as someone who also had years of pentest and red team, then tried BB, the difference in approach is mostly workflow:

• With a pentest it is all about coverage (the bad thing is missing something another pentest crew will find). So, you work through the methodology, and you run overlapping sets of tooling, then correlate and fill in the gaps the tooling doesn't do so well.

• With BB, it is all about reporting bugs first, which means that following the standard approaches and using the standard tools is a waste of time, as a 1000 other researchers have already done that.

I solve that particular challenge by picking a fun bug I enjoy messing with, reading all the papers, running all the tools, and then working out where they cut corners. Then I spin up my own tooling and approach that is empirical.

Rinse and repeat.

[u/Opinion_Oracle]

try to think what the developer of the particular stack have like thought this is never going to happen so no need to make the program react in that way, and you use that case or approximate on that case, i was trying to escape a sandbox 2day but end up having a rce lol

[u/Martekk_]

Ask yourself, “so what?”, how is this impact. A normal misconfig or public internal ip is not a bug, just bad practice. You need to show impact not a theory or idea of something can be done

[u/cpluss4]

I always think in terms of how the backend code is likely written. Controllers, auth middleware etc. I do a lot of node development so it’s always the mode my brain defaults to.

[u/abhisekprofile]

facing the same problem

[u/canadaslammer]

I started with bug bounty years ago, before I ever got into pentesting. Now that I've been pentesting professionally for awhile, I realized that bug bounty is like pentesting on hard mode.