Choosing Targets

Bug bounty hunting is finding and responsibly reporting security vulnerabilities in systems whose owners invite testing, in exchange for recognition or money. It is legal, authorized hacking.

• Programs define what is in scope and what is rewarded
• Platforms like HackerOne, Bugcrowd, and Intigriti host them
• Companies also run independent programs

Choosing the right target is the difference between earning bounties and wasting time.

The scope defines exactly which assets you may test. Testing anything outside scope is unauthorized, ineffective, and can get you banned or prosecuted.

• In scope — the domains, apps, and APIs you may attack
• Out of scope — assets you must leave alone
• Excluded vulns — issue types the program will not reward

Read the scope before doing anything else.

Every program has a policy page. Treat it as a contract. Key sections to study:

• In-scope and out-of-scope asset lists
• Reward ranges by severity
• Rules of engagement (rate limits, no automated scanning, etc.)
• Safe-harbor statement protecting good-faith research

Misreading the policy is the most common rookie mistake.

Scope breadth shapes your strategy.

• Wildcard scope like *.example.com covers every subdomain, huge surface, great for recon-heavy hunters
• Single-asset scope like app.example.com is narrow, rewards deep manual testing

Wildcards favour automation and breadth; single assets favour patience and depth.

Two main program types exist:

• VDP (Vulnerability Disclosure Program) — accepts reports but pays only reputation/thanks
• Bug Bounty (BBP) — pays cash bounties

VDPs are great for beginners building reputation; paid programs are the goal once you have skills. Some hunters use VDPs to practice on real targets risk-free.

Programs are public or invite-only.

• Public — anyone can participate; heavy competition, low-hanging fruit already gone
• Private — invitation based on reputation and signal; far less competition

Building a track record on public programs earns invites to lucrative private ones where the surface is fresher.

Match the target to your strengths and patience:

• Strong at web app logic? Pick complex SaaS apps
• Love automation? Pick wide wildcard scopes
• Mobile skills? Pick programs with apps in scope

Also consider maturity: a brand-new program likely has easy bugs, while a mature one needs creativity to find what others missed.

Platforms track your signal (valid-to-invalid report ratio) and reputation points. These gate private invites and can affect bounty multipliers.

• Submitting noise (false positives) hurts signal
• Quality, valid reports raise reputation

Protect your signal: only report bugs you have confirmed and can demonstrate impact for.

Bounties scale with severity, usually mapped to CVSS-like tiers. A typical table:

• Critical (RCE, auth bypass) — highest payouts
• High (SQLi, SSRF, account takeover)
• Medium (stored XSS, IDOR)
• Low (open redirect, minor info leak)

Target the asset types that map to high-impact bugs you are good at finding.

Serious hunters keep notes per program: scope changes, assets tested, leads to revisit. Scope is not static, new assets get added and old bugs reappear.

A simple tracking file keeps you organized and prevents re-testing the same thing.

The bounty invitation is your only authorization. Never exceed it.

• Test only in-scope assets
• Respect rate limits and avoid disruptive testing
• Never access, modify, or exfiltrate other users' data beyond proving impact
• Do not disclose publicly before the program allows it

Safe-harbor protections apply only to good-faith, in-scope testing.

You join a new program with the scope *.example.com. What kind of scope is this, and what strategy suits it?

You learned how to pick bug bounty targets wisely.

• Scope is a contract, read it before testing anything
• Wildcard scopes favour recon and breadth; single assets favour depth
• Distinguish VDP (no pay) from paid bounty programs
• Public programs build reputation that unlocks fresher private ones
• Protect your signal by reporting only confirmed, impactful bugs

Next we scale up reconnaissance to find more attack surface.