Progress in bug bounty does not come in linear line, but wave.

By
Progress in bug bounty is not an upward line but a wave. In my 2 years of full-time hunting. I always try to increase my monthly income. I did increase it a few times. What funny is that, I wouldn't see any sign of my income will increase, even 1 week before the increment. It was always a sudden spike. Getting my first bug was the same experience. I didn't see any sign of it coming, until I got an email say "ProgramX rewarded you $xxx".

I believe that is a big reason why many people give up bug bounty. They put a lot of effort in and still see no result. It is too uncertain. Working 9/5 job is more comfortable mentally, we know we will get some fixed amount of money weekly or monthly, the result is guaranteed.

Putting effort into bug bounty still builds up the result though. We just don't see it until it is fully formed. For some people, it's in 1 month, some others get it in 6 months or longer.

That's why many people like playing video games. Progress is visible anytime. You know exactly how many creeps you need to kill to up 1 level. Even if you are level 100, and have to kill ten thousands to level up. Many people still do it, because they can track their progresses. So people don't really avoid hard work, they uncertain hard work, which makes them mentally uncomfortable.

Many things also have progress in wave. This is a universal rule. You are a professional gamer, you train everyday but seems to reach a plateau. You study hard, but can't seem to increase your exam grades. You work hard to run your cafe shop, but can't get new customers. You work hard on your light novel, but only get a few hundred views. In all these situations, If you keep putting attention on your work and keep doing it, you will see result soon. But makes sure to put attention on your work, do it with care. If you do a heartless job, you won't see any result even in 5 years.

The "Do what you love" slogan is just a way to bypass this universal rule. I don't like this slogan, because it will limit us to put a good work at what we love while having an excuse to do a bad work in what we don't love. But there are many situations in life that we have to do things we don't love first. For example, you love hunting bug, but dislike writing report.

In summary, if you decide to work on something, put zestful effort into your work while don't care about the result, it will be a by-product of your work.

Comments

  1. AnonymousMarch 15, 2024 at 8:17 AM

    Thanks trieulieuf9 for sharing bug hunter's mental like this. Respect <3

    ReplyDelete

Post a Comment

Comments are very welcome. I read all comments!

Popular posts from this blog

Beginner Tutorial - How to learn the Technical Skill and Hacker Mindset That Are Required to Find Your First Bug Bounty.

By
In 2023, there are so many bug bounty resources for beginners, much more than before. I believe this is a bad thing for beginners, because now, they have to deal with so much unnecessary distractions just from choosing and sticking to a learning path alone. The over-abundance of free resources also fuels procrastination, we usually see people jumping from one learning path to another, without actually touch a real target. In this article, I will show you how much learning is enough. So you can get out of your learning rabbit holes and start hunting on a real target. By the way, this article aims to help you find bugs in IDOR, Information Disclosure, Business Logics, Broken Access Control. It may not help you to find injections bugs or misconfiguration bugs. Because I don't know how hunt them myself. # Technical Skill If you can solve Practitioner labs in PortSwigger with relatively ease, you have enough technical skill to hunt bugs: - https://portswigger.net/web-security/logic-flaw
Read more

The power of focus

By
A quote in the movie John Wick 1: John Wick is the main of focus, commitment and sheer will Out of all the good traits, the movie writer chooses only 3 traits to describe how bad ass John Wick is. That shows how powerful focus is. I believe he also gets his excellence skills thank to these 3 traits. Focus, commitment and sheer will are pretty similar to each others, they show that the man can stick to something for a long period of time, without switching goal, despite inconvenient challenges. If we apply this to bug bounty, it means, we make a goal, and stick to it, despite all self-doubts. For example, Losef is a beginner, who tries to find his first bug, he sets a goal to hunt on a program for 7 days. In day 1, he feels overwhelmed by how much details his target has. In day 2, he tests features one by one, but finds nothing, he feels down. In day 3, he feels that you have hit a steel wall, which he cannot even imagine how to get pass it. In day 4, he notices the program stats, which
Read more

How to succeed in bug bounty as a non-talented bug hunter

By
Image
When I started bug bounty hunting about 4 years ago. I looked up information about top bug bounty hunter and wondered how are they hunting bugs and grow their H1 reputation so fast. 1 year later, when I found my 1st, 10th, 20th bugs. I still had this question. Because although I had found some bugs, it took me a few days to find one. Recently, as I get more mature in bug bounty. I start to develop a deep understanding for a program. I see many attack surfaces that other people don't realize. When this program releases a new feature, I check if this feature can be abused to attack the attack surfaces A, B, C or D. Oftentimes, at least 1+ bugs are found. When I keep hunting on this program and discover a new attack surface, I check if any existing features can be abused to attack this attack surface. Oftentimes, at least 1+ bugs are found. When there is no new released feature and attack surfaces. I sometimes  wander the program, looking at already tested features and to my surprise.
Read more