Aug 7, 2022
How I got a $10,000 Penetration Testing Project/Job with Bug Bounty
Introduction:
My name is Junaid Khan aka JunoonBro on Twitter & LinkedIn. I am a Bug Bounty Hunter since December 2019 & most of the community members know me for my Privilege Escalations Vulnerabilities. I previously shared my write-up for How I earned $9000 with Privilege escalations and it was great to see you guys appreciating my work and my sharing with the community. This gives me the interest to share another story, Where I got a $10,000 Penetration Testing Project with the help of Bug Bounty. This write-up will help you to understand your client’s (External Bug Bounty Program) business, technical functions, and goals and will help you pinpoint the ideal approach for their security needs which can lead us to the Pentest Project or Penetration Testing Job.
External Bug Bounty Programs:
As a bug bounty hunter, I prefer to take a different path when it comes to bounty hunting. While doing Bug Bounty Hunting on Bugcrowd, I also prefer to search for those applications that do not have any formal bug bounty mechanism. I find them via Google and other resources and then approach them with a request to work on their domain.
Now here is the Key Point: How to work for them?
If you are looking for a remote job as a penetration tester or pen-test project, make sure to provide genuinely valuable findings to the company and tell them how much important you are to them via your findings.
The second thing to do is that always focus on your delivery style. Delivery is one of the most important parts which reflect your efforts towards the client. I have many friends who put tons of time into finding the issue but when it comes to reporting, they just copy and paste stuff for that. Make sure to customize your report style, give it a couple of pictures with a black outline, and mark some arrows in the report for a better understanding, tell them friendly that what you find. and how it can be impactful for the company.
Note that, Small companies don’t have a proper team for handling such issues, they will rely on you and there are chances too for rejecting XSS vulnerability because they don’t understand.
How to Approach BB Client For Penetration Testing Project or Job?
1. First find a target for yourself according to your interest in work. Make sure that the target doesn’t have a formal bug bounty mechanism and search on Crunchbase for the target funding and investment. This will give you the idea that either target has the potential or not.
2. Now email them on support or any other email which you can find on Hunter.io by giving the target URL. It will give you a list of emails specifically related to the target company. Search for the Executive emails like CEO, CTO, etc.
3. Now send them a friendly email that you are an independent security researcher and want to work on the domain for finding the security vulnerabilities. You can generate catchy and interactive email content with Copy.ai. This will generate attractive and professional content for you on specific keywords for your email.
4. Usually companies pay for the bug reports. I don’t ask for compensation or rewards, As I mentioned choose the target which has the potential. So, I usually select the target which I think has the potential to compensate for good work or efforts.
5. Now send your findings one by one with the proper delivery of the report. Make sure to report those bugs which are genuinely affecting the organization’s integrity and tell them how impactful the issue is. I am saying again that your report should stand professional and outclass. Your report will be the decision maker for your next approach which is a Monthly Job role as a Penetration Tester or Project for a particular period.
6. On another day, they compensate me for my reports and rewarded me with $150 for each. I opened the copy.ai and generated a thanks email.
7. Now it’s time to approach the target for a project or a job role in the company. It will be great if you can send one more vulnerability report with the email where you are approaching or convincing the client for a project or job role. Open the copy.ai and make a good catchy convincing email where you are asking for the job, as you can see below in the image where I am convincing my client.
8. After doing these all steps, there are chances that you will have the project or job role in the target company
Conclusion:
I aimed to tell you how I got the work with a bug bounty. You can make this process more spicy and creative. It depends on you how to see things for yourself in a productive manner. My salary increased with one more day of work last month because I genuinely provide my services and the importance of my existence for them as a Penetration Tester.
Follow Me:
