Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I really want to prove myself (to my parents) by winning a proper bug bounty

How should I best prepare for this and go about actually finding bugs?

Edit So can anyone give some web sites which I could read that would help me understand better how to win, and what free training materials are useful? I'm working through pentesterlab already.

I've the looked up the most common vulnerabilities from OWASP things like XSS, SQL injection, PHP inclusion, CSRF, error disclosure. I've studied each of these and understand how they occur and how to demonstrate them.

I've tried to audit many lines of source code from open source projects looking for parts that haven't properly escaped user input or other important things. I also tried to do black-box testing for things like XSS on staged sites (ones hosted separate from the in-use production server, for the purpose of testing) but nothing has really turned up. I've also read the public disclosure writeups of the bugs other people found.

I understand that part of the problem is that there are people with years of experience who will find things first. And there are also people (like researchers) with much deeper knowledge in specific areas.

But even so I think I should be able to make a positive contribution if I work hard, so I would appreciate any guidance

share|improve this question
When a company starts a bug bounty program, you can assume that they already invested lots of internal resources into finding and closing any obvious and easy to find vulnerabilities. Otherwise they would risk that such a program could become both expensive and embarrassing. In fact, bug bounty programs are often intended as a marketing campaign to show how much they trust the security of their product, not as a method to outsource their security auditing. –  Philipp Jun 4 at 23:27

1 Answer 1

The fact that you are trying to 'prove' something to someone else confuses the process.

  1. Look for bug bounty programs
  2. Look for the most error-prone service
  3. Use your knowledge to find a bug

If you try to look at the major products/services, you are aiming too high. Choose something small and overlooked.

share|improve this answer
Thanks, This is very helpful. Also I was just stating my motivation. –  emberfang Jun 4 at 23:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.