How this seasoned bug bounty hunter combines Burp Suite and Hacker One to uncover high-impact vulnerabilities

Summary: A bug bounty hunter who started hacking at 16 by experimenting with Wi-Fi networks and phishing now uses Burp Suite alongside HackerOne to find vulnerabilities, and one of his most notable wins was a $38,000 bounty uncovered with Burp's HTTP Request Smuggler extension. HackerOne has launched a Hacker Milestone Rewards Program that replaces its former reputation-only model with achievement-based rewards for valid vulnerabilities, including free Burp Suite Professional licenses.
Bottom line: A single HTTP request smuggling finding paid this researcher $38,000, and HackerOne's shift to paying for valid results rather than reputation alone means more hunters will be pointed at the same classes of flaw in production applications.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026