r/BugBountyNoobs

Hello Hunters,

I have been doing bug bounty for while but now I am feeling like I am learning nothing new. All I am doing is same thing everytime I am doing bug bounty also most of my work is done by AI (For anyone curious I am using openrouter API configured my agent in Hermes) I am thinking to leave the bug bounty and now focus on learning other things like AD, windows server I know basics of things but want to master in it. I want to go in offensive security thats my clear goal.

I need advice what should I do ? Should I leave bug bounty ?

Hey r/Pntesting ,

I'm a pentester who got tired of spending more time writing reports

than actually hacking. So I built PentReport.

Here's what it actually does:

- Add your findings with CVSS scores and evidence screenshots

- AI generates full write-ups (description, business impact,

remediation) — clean prose, no markdown garbage

- Export professional PDF and DOCX in one click

- Deliver to clients via a secure portal instead of emailing PDFs

- Findings library so you never write the same SQLi finding twice

It's live at pentreport.com and completely free during beta.

A few things I want to be upfront about:

- No scanner import yet (Burp/Nessus) — that's on the roadmap

- Your data is never used to train AI models, ever

- SOC 2 compliant infrastructure, AES-256 at rest, TLS in transit

- Full data deletion — delete your account, everything gets wiped

- You can read exactly what sub-processors we use on the site

Doing a small closed beta — DM me if you want an invite code.

Looking for pentesters who write real reports and will tell me

what's broken.

pentreport.com

For those who actively hunt bugs, I'm trying to understand whether Burp Pro is actually necessary.

I'm currently learning web security and considering using:

Burp Community — PortSwigger Academy/basic Burp work

Caido — primary manual HTTP testing

OWASP ZAP — scanning/automation

CLI tools — fuzzing/recon/specialized tasks

For people who have actually hunted with these tools:

What Burp Pro feature do you find genuinely difficult to replace?

I'm especially interested in things like Scanner, Intruder, Collaborator/OAST, HTTP/2 testing, Turbo Intruder, and extensions.

I'm not asking which tool is "best." I'm trying to understand whether the practical advantages of Burp Pro justify paying for it, or whether a combination of free/cheaper tools is sufficient for most bug-bounty work.

While creating a test account on the target, I used a phone number from a service called "receive-smss" because the platform doesn't support phone numbers from my country.

After entering the OTP, the platform displayed a username along with a "Get OTP on your email" prompt.

The email address was masked, showing only the first letter and the domain extension but in this specific case, it was easily guessable for me.

I checked the program scope, and it explicitly lists "Username/email enumeration" under out-of-scope issues.

Since I haven't found a valid bug yet and this is the first time I've stumbled upon something like this, I'm really unsure and worried about whether I should report it or not.

Hi everyone,
I’m looking for French/French-speaking people, or even English-speaking people who are patient enough to communicate with someone whose English is still beginner level 😅, who are currently learning HTB CWES, web pentesting, or bug bounty hunting.
I’m currently progressing through CWES and practicing with PortSwigger. My goal is to improve my methodology, understand web vulnerabilities more deeply, and start hunting more seriously on real bug bounty programs.
I’m mainly looking for 1 or 2 motivated people to exchange regularly, discuss CWES concepts, methodology, labs, and potentially hunt together.
My English is definitely not perfect, but I’m very motivated, willing to learn, and ready to put in the work.
I’m not looking for someone to give me answers. I’m looking for people who want to learn, exchange, and progress together.
If you’re interested, feel free to DM me.

Nowadays people are finding bugs with AI, even with 0 knowledge, and getting paid.

So what’s the difference between someone using AI with no knowledge and someone who actually knows cybersecurity?

Both find bugs. Both get paid.

So what really makes the difference?

I'm 17 and exploring a startup idea in PQC/cybersecurity. I am still in the research stage and want to avoid spending months building something that already exists.

My original concept was a platform that would detect quantum-vulnerable cryptography, generate a Cryptographic Bill of Materials (CBOM), assess PQC risk and return a Quantum-Health Score (QHS), provide security-lead dashboards, and eventually support crypto-agility and migration.

After spending some time researching this field, I saw that around 10-12 exceptionally established companies have already done this. So I do not want to build another scanner or compete head-on with enterprise platforms. I am trying to find a specific painful workflow: for example, issues around legacy systems, third-party dependencies, compatibility testing, migration ownership, reporting, and deployment constraints.

Since I cannot do calls, I am planning to getting feedback through Reddit discussions, outreach emails/messages to researchers and practitioners.

My questions are:

1. Is this the right time to stop competitor research and begin customer/problem discovery?
2. How should I find an initial niche in a complex B2B market like cybersecurity?
3. Is written outreach enough to start validating a problem if calls are not possible?

I'm trying to learn the right process before I start building, and I would appreciate honest feedback, especially from people who have validated B2B, developer-tool, or cybersecurity ideas.

Thank you!

Hi , i learning penetration testing now , and learnt some vulnerabilities theoretically but when try to put my knowledge in a real target i feel that i learnt nothing

Hi , i am taking now a recon course and i also learn how to test manual but i need to start in bug bounty, but many people recommend for beginners to start with manual testing but i don't know why , can someone explain to me

https://preview.redd.it/zms0h5ovizhh1.png?width=526&format=png&auto=webp&s=7f11abe5a7a6d9d3de3f16e411b46adbf1af4b06

Skilled 💙🔥

[removed]