Bug Bounty Hunter Path

From "I know what XSS is" to "I'm getting paid by HackerOne"

A practical, end-to-end track on going from "I know what XSS is" to "I'm getting paid by HackerOne." Specifically optimized for someone who wants to hunt commercially — not for academic completeness. Pick a program that matches your skill curve, recon a full attack surface in ≤4 hours, triage findings against the program's payout matrix BEFORE writing reports, write reports that get paid, negotiate severity disputes, avoid the legal landmines that get hunters banned.

Lessons

• The Bounty Economy
• Reconnaissance: Subdomain Enum, JS Analysis, Asset Inventory
• Web App Methodology
• API Methodology (REST, GraphQL, WebSocket)
• Mobile Methodology: Android + iOS Quick Wins
• Report Writing That Gets Paid
• Severity Disputes, Dupes, and the Disclosure Timeline
• Capstone: Hunt a Real Program (with Safety Rails)