Penetration Testing and Bug-Bounty Hunting

If you look at the programs you get invited on, there are hundreds of people looking at them at the same time, all doing the same. For example, I was invited to a duplicated XSS bug report for a private VDP (no money) that the customer didn't bother to fix because it had little impact, and in only a couple of months I got messages showing that a dozen more people had reported the same bug and been added to it to show it was a dupe. And, again, that is for a private program that doesn't pay any money, just imagine the amount of competition you get in public programs like Verizon.

...

Life's short. If you aren't enjoying it, stop. Just spend some time catching up on hacking updates and such. If you find yourself missing it, come back.

...

I've been at it for almost a year and the two reports I made were both duplicates. So I can certainly see the "is it worth it" mentality. It's discouraging at times, but the thing I keep seeing everywhere is to give it time. Like others mentioned I have a day job and so that makes it easier. Are you enjoying it as a hobby? if so, great, keep having fun and I'm sure the bounties will come. If you're not enjoying it, take a break. I've found sometimes a break re-energizes me

> Recently, I've been participating in bug bounty programs
> full-time and have been pondering a more legitimate/stable career
> in security as a result. I've reported 18 valid vulnerabilities
> in the past two and a half months, and have made a little less
> than $10,000 (I'm seriously not trying to brag or anything,
> I just want to paint an accurate picture of my situation).
> During this time one of those bugs was actually a vulnerability
> in an F5 Networks product which I also responsibly disclosed
> to them and got a CVE for. Hunting for bugs is basically my
> full-time job right now.
>
> The big caveat I think, though, is that I don't have a degree/certs.
> I've never taken classes for anything related to computers. I also
> have never worked professionally in any infosec/programming field
> (I've worked as a fry-cook for my only real job). I do know how to
> program, though, as I have released 6 or 7 iOS apps through my own
> company. But, they're all pretty simple, and not very impressive.
>
> My question is, can I use this experience to start a career in security?
> If so, how? I would really like to get out of doing bug bounties sooner
> rather than later, as they are simply not a reliable source of income.
> Even though I've had some great successes, this month I could find
> nothing or just get a bunch of duplicates, and make $0. However, I feel
> not having a formal education and no certs will really hamper my
> chances of getting employed anywhere. Is this true? Have any of
> you been someone who only had bug bounty experience and got a job
> in the field? I'm willing to learn anything that is necessary to
> get there, because I finally feel like I've found the field I want
> to be in for the rest
> of my career.

IMO, this definitely counts as experience! Unfortunately, I would not say this is a magic bullet since it's very common for employers to want some type of degree. Depending on the organization, this might be a deal breaker. But I do know plenty of people that have badass roles without any degree.

I would still encourage you to apply for jobs that look appsec-related or interesting to you, though. Don't stress too hard about not meeting all the requirements listed on a listing.

...

I can't really speak for other employers, but I look at experience first. Last guy I hired doesn't have a degree.

...

I personally LOVE seeing bounty experience (with successful payouts), as to me it indicates a variety of things, such as:

• You're willing to put your own time into doing the work
• You are finding bugs worth money to someone
• You have experience looking at real applications

I'd start applying. Consulting shops are more likely to take you on IME, as you're still quasi-green, and they can likely get you ramped up pretty quickly on one thing or another. How comfortable are you with things like the OWASP top 10? What type of job are you wanting to go after?

...

Why don't you spend a few months getting your Network+ and Sec+? You obviously have the aptitude and drive for demanding technical work. Certs like those are not absolutely necessary but it sends a signal to potential employers that you know some basics.

I'd say those two certs plus the bug bounties would definitely be enough for some SOC director or Software Development manager to give you a shot. Once you get some actual experience, those bug bounties would serve as a big differentiator between you and people that just had the certs or some college classes.

...

I'm a hiring manager and have moved into a position where the team is small and lean and we perform a myriad of tasks from technical to business development.

I would prefer a candidate with a degree as it tells me they were forced to write at one point, they've had to take classes they were not exactly thrilled with in their degree plan, and more importantly they stayed the course for a set amount of time.

In lieu of a degree I would prefer an overabundance of experience and proven performance along with the ability to speak intelligently to peers, clients and within other business units. There is no time for the brilliant a**hole, the spotlight ranger that lives on their own island, or the socially inept that clams up whenever they have to brief.

Since you are new, gain experience any way you can. Learn adversarial tradecraft to round out your skillset. Spend time building your callback infrastructure and test it. As you gain more experience and can move into roles, get your degree in something so you can bypass HR filters and do what you really want.