From pwn to bug bounty

I’m a pwn player. Memory corruption pays in CTFs, but in bug bounty the money is in logic and access flaws, not crashes. Here’s the translation:

pwn instinctbug-bounty equivalent
Find a missing checkBroken Access Control (IDOR/BOLA)
Control a pointerControl an object ID in a URL/body
Leak an addressLeak data via insecure direct object ref
Get a shellReach cloud metadata via SSRF

The #1 paid bug: Broken Access Control

You see /api/order/123. Try /api/order/124. If you get someone else’s order, that’s a report. It’s the same thrill as finding a missing null check — but the payout is cash, not points.

Start here

  1. PortSwigger Web Security Academy — Access Control + Auth + SSRF labs.
  2. Recon: amass + httpx + subfinder + gau.
  3. Hunt /api, /account, /admin on in-scope programs only.

Rule

Never scan outside a program’s scope. That’s illegal and gets you banned.