I'm an amateur web application security enthusiast with what I would say is an intermediate level of knowledge at this point. I'm interested in finding full time work as a web app pen tester.
Up until now I've been working mainly on vulnerable web apps hosted on VMs locally.
I'd like to start doing actual vulnerability research and try and get some CVE listed bugs to my name. I feel that lacking a degree or directly relevant work experience this basically serves as a portfolio and demonstrates proficiency.
My question is where should I start looking?
Should I aim for the high-profile sites offering bounties like the ones listed on Bugcrowd?
Or would a better approach be to audit smaller, open source projects and submit my findings to their teams?
My thought process is that bigger high profile sites will be much more heavily scrutinized so less chance of a finding interesting issues when you're not as experienced. But finding a bug there is a bigger deal.
Whereas smaller projects may not be putting much work into security to begin with so bugs may be plentiful to find but do they mean anything in terms of demonstrating proficiency & in terms of a portfolio to show to employers? (Aside from the value brought to the project by making their code more secure assuming they are receptive to your efforts).
Where did you start? Any tips on how to proceed?