Bug Bounty Programs and Ethical Hacking

Why Hack?

In the world of cybersecurity, “hacker” can be a villainous term. But sought-after professional defenders (a.k.a., the “good guys”) have the same skills. Ethical hacking is the process of proactively probing systems for vulnerabilities with the owner's permission. This skillset is formally recognized and validated by the Certified Ethical Hacker certification (C|EH). According to the EC Council, the Certified Ethical Hacker (C|EH) learning modules are aligned to 45 job roles in cybersecurity. In a 2024 survey, 86% of those who passed the exam said that it led to increased job opportunities.

Some ethical hackers are employed full-time as security researchers. Others participate as freelancers in bug bounty programs. Many cybersecurity students are excited to take an ethical hacker course because this is where they get into the nuts and bolts of hacking and defending. But, before you plan a whole career around becoming a bug hunter, let's analyze a critical question:

Can You Make a Living at It?

While money is the biggest incentive that drives hackers to participate in bounty programs, it's not the only reason. According to HackerOne's 8th Annual Hacker-Powered Security Report, 77% of researchers cite money as a key motivator. But learning and developing skills was a strong runner-up, followed by a desire to protect businesses and end-users. (Reference footnote 1.)

Before we look at how much money the average hacker makes in bounties, let's examine bug bounty programs - how they operate and why.

Introduction to Bug Bounty Programs

Bug bounty programs are a security approach that leverages the global hacker community to strengthen digital defenses. Before malicious hackers find and exploit bugs, companies invite ethical hackers to test and discover vulnerabilities and report them through formalized bug reporting systems. It's like crowd-sourcing your penetration testing. 

But there are formalities and rules surrounding the process. This protects ethical hackers from inadvertently doing something harmful or illegal. Some companies start their own bug bounty program (like Netscape Navigator way back in the '90s) or participate in 3rd party programs like l1ackerone, Bugcrowd, Immunefi, and Intigiti. These organizations facilitate the interactions between hackers and hackees, providing a safe framework for disclosure, validation, and reward distribution.

Bug Bounty Economy

Over the years, bug bounty prices have evolved into an economy with several factors pushing prices up and down. If bounties are too small, hackers don't feel incentivised to try. If they're too big, a single severe bug with a huge price tag could consume too much of a company's cybersecurity budget. Huge payouts pressure other companies to increase their bounties too, causing a form of inflation. 

Another factor is how much the bad guys will pay for exploits. In high-stakes arenas like cryptocurrency, the black market pays extremely high prices for exploits - paying millions for them. So crypto companies wisely offer hefty rewards to ethical hackers who will privately disclose the bugs they find. One hacker known as Satya0x received a jaw-dropping $10 million in 2022 for discovering a critical security vulnerability in the Wormhole core bridge contract on Ethereum. This hacker “could have” held the entire protocol for ransom with this exploit, and the funds in that contract could have been lost forever. Instead, they ethically reported it, and the exploit was patched on that very same day.

Satya0x stated, 

“I am proud to have played a role in mitigating a serious vulnerability and a systemic threat to the ecosystem,” said Satya0x, who praised Wormhole’s handling of “the entire bug bounty process” and Immunefi as “a knowledgeable, visible, and credibly neutral third party.”

Hacking Competitions

Skilled bug hunters often showcase their abilities in high-profile competitions that offer substantial prizes and professional recognition. The prime events are Black Hat, DEF CON, and Pwn2Own, where well-known companies submit their software and systems for testing. The bugs discovered are privately disclosed to the software vendors so they can create patches before the vulnerabilities are discovered in the wild. The awards granted range from a few hundred dollars to the whopping $1.2 million earned by the top Bugcrowd hacker last year.

The Method and Rewards

Bug hunting is far from random searching—it's a systematic process that combines technical expertise, creative thinking, and meticulous methodology. Successful bug hunters follow a structured approach similar to professional penetration testing. Many are increasing their use of automation and artificial intelligence to gather the low-hanging fruit and search for basic bugs, thereafter switching to human intelligence for sleuthing the rest.

The process starts with reconnaissance, searching for publicly available information about the target. Next, they look for the most common flaws, like SQL injection or cross-site scripting (XSS) weaknesses. Skilled hunters also look for authentication bypasses, remote execution opportunities, and avenues for lateral movement and privilege escalation. To be thorough, they must prove the exploit by developing and demonstrating a proof-of-concept (PoC). Finally, they must document the process clearly so the vendor can reproduce and fix the problem.

Of course, the bounties for simple exploits are much smaller than for complex exploits with a greater risk ranking. For example, remote code execution bugs are considered riskier to the vendor and are usually harder to exploit. Therefore, these bugs have a higher bounty. Each program or competition has its own bug bounty table where prices are intrinsically linked to a vulnerability rating taxonomy. Fixed prices are not possible to nail down; rather, a range is given. The final reward is determined by triaging the report against the framework. Two reports of the same vulnerability type can receive different rewards based on the quality of the PoC and documentation.

Essential Skills and Knowledge

Earning the C|EH or pursuing another program like Hack the Box is a good start. These represent the foundational skills needed to become a bug bounty hunter, which include:

• Understanding Defenses & Bypasses: Knowing how common defenses (Web Application Firewalls - WAFs) work and learning techniques to bypass them (e.g., obfuscating payloads).
• Network Penetration Testing: Using Nmap for scanning and learning to exploit network vulnerabilities.
• Basic Cloud Security Concepts: Cloud models IaaS, PaaS, SaaS. Key cloud attack vectors and threats. Hardening tools and methods.
• Gaining and Maintaining Access: Exploitation, backdoors, Trojans
• Linux and Command Line Mastery: Develop fluidity, speed, and strategic thinking at the command line.

The following skills are partially covered in the C|EH. But to be a professional bug hunter, these skills must be more fully developed and practiced often. Serious bug hunters take every opportunity to practice:

• SQL Injection (SQLi): Injecting database queries into user inputs.
• Cross-Site Scripting (XSS): Injecting malicious scripts into web pages viewed by others.
• Cross-Site Request Forgery (CSRF): Forcing a user's browser to execute an unwanted action on a site where they are authenticated.
• Server-Side Request Forgery (SSRF): Tricking a server into making requests to internal or third-party systems.
• Active Directory (AD) Exploitation: Credential theft, privilege escalation, lateral movement, establishing persistence, covering tracks.

Skills That Support Multiple Cybersecurity Career Paths

The value of ethical hacking skills in a cybersecurity career can't be overstated. Whether you have management goals or plan to become a consultant, compliance manager, architect, or Security Operations Center (SOC) Analyst, hacking skills will open those doors and many more. By hacking, you will develop technical proficiency with security tools, understand secure design principles, learn the attacker mindset, and become a seasoned problem solver.

Can You Make a Living at It?

New bug hunters start slow and simple. Discovering that first bug can be time-consuming, which may be discouraging. Once a bug is found, documented, submitted, and validated, it may or may not result in a payout worth mentioning. Some spend a dozen hours to earn fifty dollars, or even zero dollars. But it's a valuable investment for your resume.

In time, and with increased skill, bug hunting can become a lucrative side hustle. As hackers build credible reputations, the invitation-only programs will open up to them. Those who become experts can make hundreds of thousands of dollars, eliminating the need for a regular nine-to-five job.

The road to making a living from bug hunting is usually a long one. Meanwhile, other jobs in cybersecurity will open due to the skills being developed. Often, those employed full-time in the field continue bug hunting on the side to sharpen skills and try new things.

In the Words of One Bug Hunter

We interviewed Christopher Inzinga, a respected bounty hunter for Bugcrowd. He's an analyst by day, and a bug hunter on the side. In college, he studied Networking and Information Technology, and began bug hunting before graduation. When asked how it felt to find a bug for the first time, he said,

“I was a little bit in disbelief. I'd heard about it on some podcasts, but it sounded too good to be true - hacking and getting paid for it. But, within a few weeks, I found my first issue that paid money, and I couldn't believe it.”

Christopher was hooked from then on. His favorite platforms are Bugcrowd and HackerOne, where big companies like Tesla, Yahoo, and AT&T can be hacked - with potentially big payouts. Though just in his early 20's, Christopher enjoys a stable career in cybersecurity with flourishing growth potential, along with occasional bug bounties to spend on vacations and other splurges.

How to Get Started

Anyone studying cybersecurity can try bug bounty hunting with a few simple steps. As an example, Bugcrowd is piloting a new educational exercise model at a university in California. Students start by downloading a free copy of Caido Pro and creating a free Bugcrowd account. They practice with the “Broken Access Control” lab at TryHackMe. Then, two experts from Bugcrowd conduct a class session on ethical hacking tools, recon, and report writing. With this small amount of guidance, students begin hunting.

More to Come

If the pilot goes well and the model matures, Bugcrowd will spread the class to more colleges. As noted by Christopher Inzinga, “Capture the Flag (CTF) exercises only get you so far. For students to truly gain skill, they need to hack real environments.” That's where bug bounty programs provide opportunity and money for eager and persistent college students. 

We look forward to seeing an evolving partnership between Bugcrowd and more colleges, perhaps building a model for other bounty hunting platforms to emulate.

Article prepared by: Nichole Schmitt, Program Manager at the Cybersecurity Center of Excellence.