Pentester.
I started with CTF but quickly realized that the real thrill is finding bugs in real projects on Bug Bounty and getting paid for it. Athlete!
t.me/rolegiv_BugBounty
Q&A with the ambassador
How did you get into bug hunting?
My path to bug hunting, strangely enough, began back in school with "griefing" in Minecraft, where I looked for ways to bypass the game's mechanics. To be serious, it all continued with participation in CTF — from HackOsint to KubanCTF, where I took prize places and reached offline stages. Over time, I discovered Bug Bounty as a way to apply these skills in the real world and receive monetary rewards. And apparently, I made the right choice!
What is the most memorable vulnerability you've discovered?
The most memorable one in my case was the simplest. Once I was studying disclosed reports on HackerOne and came across an interesting case. I immediately remembered a very similar functionality in one of the services I was researching. All that was needed was to repeat the steps from the report and adapt them. The vulnerability was confirmed! This case proved once again that careful study of others' experience is part of success in bug hunting.
On average, how much time do you spend bug hunting each month?
I regularly dedicate 10–15 hours per week to bug hunting, combined with my main job. My current goal is to enter the top three researchers on the platform.
Which tools do you usually use for bug hunting?
My bug hunting approach is based on manual testing using Burp Suite. This allows me to effectively identify business logic vulnerabilities that are not accessible to automated scanners. During the reconnaissance phase, I use subdomain discovery tools (subfinder) and directory fuzzing tools (dirsearch) to expand the attack surface.
Advice for beginners in bug hunting
The main advice is to spend as much time as possible practicing. It does not matter where you start: solving beginner CTFs, watching walkthroughs on YouTube, reading disclosed reports, or trying to find your first vulnerability in programs. The important thing is to immerse yourself in the process. Over time, you will develop your own work structure, and finding bugs will become significantly easier!
