Finding your first bug: bounty hunting tips from the Burp Suite community
Summary: PortSwigger gathered bug bounty advice from its community, citing HackerOne's 2020 report that the hacker community nearly doubled to more than 600,000 people. The community's tips centered on narrowing focus to a specific vulnerability type, starting with simple bugs, and learning content discovery, while Director of Research James Kettle described his first paid bug as a stored XSS in YouTube before finding a batch of bugs in Blogger over several months.
Key Takeaway: With more than 600,000 people now in the hacker community, the entry-level bounty pool is crowded, and Kettle's own path - a flukey first find followed by a long dry spell until he understood one target's design inside out - shows the payoff comes from depth on a single target rather than breadth.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026