Q&A with the ambassador

My path to bug hunting, strangely enough, began back in school with "griefing" in Minecraft, where I looked for ways to bypass the game's mechanics. To be serious, it all continued with participation in CTF — from HackOsint to KubanCTF, where I took prize places and reached offline stages. Over time, I discovered Bug Bounty as a way to apply these skills in the real world and receive monetary rewards. And apparently, I made the right choice!

 
What is the most memorable vulnerability you've discovered?

The most memorable one in my case was the simplest. Once I was studying disclosed reports on HackerOne and came across an interesting case. I immediately remembered a very similar functionality in one of the services I was researching. All that was needed was to repeat the steps from the report and adapt them. The vulnerability was confirmed! This case proved once again that careful study of others' experience is part of success in bug hunting.

 
On average, how much time do you spend bug hunting each month?

I regularly dedicate 10–15 hours per week to bug hunting, combined with my main job. My current goal is to enter the top three researchers on the platform.

 
Which tools do you usually use for bug hunting?

My bug hunting approach is based on manual testing using Burp Suite. This allows me to effectively identify business logic vulnerabilities that are not accessible to automated scanners. During the reconnaissance phase, I use subdomain discovery tools (subfinder) and directory fuzzing tools (dirsearch) to expand the attack surface.