You need to hear this if you are new/want to start bug hunting

Hello everyone,

It's me Mohsin khan. You maybe know me as tabaahi_.

I hope you are doing well. Today I want to talk about what will make you a better bug hunter & how to ask the right questions. Mental health maybe.

What mistakes do beginners make:

1. They think bug hunting is easy money
2. They think Experience / Pro bug hunters have secret methodology
3. They think completing one paid bug hunting course will make them better hacker
4. They think one day someone will DM them about their best bug hunting approach and just by learning this they will make money.
5. They think one day they will become million-dollar hackers without grinding

What bug hunting Exactly is :

1. Bug hunting is not easy money. Programs don’t care how many hours you work until you find the valid bug.
2. Secret methodology: Don’t ask anyone in the DM/comment box about secret methodology. There is no secret or if there is anything, No one will share with you. Even if someone tells you how they find XYZ bug, You will not be going to find it. Because you don’t have years of experience. Accept it.
3. First of all, if you pay for bug hunting courses, You will never be going to be a great hacker. I have 100s of examples who pay for courses and still don’t know shit. If you don’t know how to use google you will never be going to be a great hacker. Means never. Everything is free. If you want to pay for the course? Buy Agarri_FR “Burp suite mastery course”. It’s worth it. Most bug hunters <100 Rank on bugcrowd / hackerone completed Agarri_FR course. Pay for pentesterlab Pro. Nothing else. Everything is free.
4. No one will share anything. Accept it. As soon as possible.

Ask the right questions :

The first impression is the last impression. In my 2+ years of full-time bug hunting, I talk to lots of bug hunters. If you ask the right questions they will reply for sure. Imagine talking to hackerone all-time top 20 (Yahoo Elite) bug hunter for 2 hours. I did it. Can’t name bug my friends know whom I am talking about. Let me tell you how you will do it

1. Let's say you want to talk to naffy? (Naffy I am sorry brother). He will not be going to reply to your secret methodology dm right? Pick few programs where he hacks yahoo, PayPal, Google, apple maybe. Try to find Open redirection and DM him.

Hi
I saw one of your tweet. You said you need Open redirection on XYZ programs to exploit SSRF. I have one. Would you like to collab?

You can apply it to anyone. Find low-hanging bug. DM to top 10 bug hunters of that program. and ask them if you need it to chain something. They will reply for sure. Also, you will learn something new from them. I did it multiple times.

The dark side of bug hunting, You should know:

1. You will love/hate to do it.
2. No interaction with humans lol. It's true sometimes you spend days/week exploiting something and at that moment you don’t want anything else.
3. Frustration, Health issues (If you are not taking care of that), burnout, Procrastination.
4. No one care how much time you spend until you find the valid bug. Let's say you spend 1 month 10hr/day and you only find 1 P4. They will pay $50–200. They don’t care about your 300 hours of hunting.
5. Sometimes programs don’t pay for months. Not responsive. I have more than 10 triaged for months no reply yet.
6. You find it critical and they close their program. Or they pay $250 for P1 because they are out of money. Yes, it happen multiple times.
7. Don’t do it full time if you don’t have 1–2yrs of money for living.

So what to expect and what to do

1. Health is wealth. Focus on your health first. You can follow Pomodoro technique. 45-minute work 25-minute break (walk). Exercise daily.
2. Don’t think much about bounty. Think about the process. If you don’t enjoy the process, You will never satisfied with the result (bounty).
3. If you are new focus more on learning, Making friends.
4. Don’t think about how much xzy is making. he is making $10k because he needs 10k maybe you only need $500. So don’t think much about it.
5. Don’t compare yourself with anyone. You are one in 400 trillion.
6. Reward yourself every day. Set 3 tasks for the day and when you complete them reward yourself with something. Some like to watch a movie, some love to play games, and Do what every you want.

let me know on twitter . If You like this. Also let me know if I made any mistakes while writing. And sorry for my bad English again. Take care!

Have a great day!