Ethical Hacking for Beginners: How I Landed My First Bug Bounty in 90 Days

Ethical Hacking for Beginners: How I Landed My First Bug Bounty in 90 Days

On day 94 of my ethical hacking learning journey, I received an email I had not quite convinced myself would come: "Thank you for your submission. We have validated and resolved your report. Your reward of $150 has been processed."

One hundred and fifty dollars is not a life-changing amount of money. But that report — a reflected cross-site scripting vulnerability in a medium-sized SaaS application's search parameter — represented something the money could not fully capture: proof that I could find real vulnerabilities in real systems. Not in lab environments built to be vulnerable. In production software used by actual people.

I want to tell you exactly how I got there in 90 days, because most of the content about bug bounty for beginners is either unrealistically optimistic (promises of $10,000 first reports) or vague to the point of uselessness ("learn web application security"). I will cover the exact learning resources I used, the tools I spent time with, the methodology I followed, and the honest mistakes I made along the way.

One critical point before we go further: ethical hacking means operating within authorized scopes. Everything I practiced was either in lab environments I owned, on deliberately vulnerable platforms designed for practice, or within the published scope of bug bounty programs that explicitly invite security research. Never test systems you do not own or have explicit written authorization to test.

For the full cybersecurity career picture, see our cybersecurity career guide and the cybersecurity resources hub.

What Ethical Hacking Actually Involves

Before tools and techniques, let me give you an honest picture of what ethical hacking practice looks like day to day for a beginner.

The romanticized version involves sitting at a keyboard, running some commands, and immediately compromising systems in dramatic ways. The reality is mostly reading: reading documentation, reading error messages, reading source code, reading security research papers and blog posts to understand how specific vulnerability classes work.

Ethical hacking requires understanding systems deeply enough to find the gaps between how they are designed to work and how they actually behave under unusual conditions. That gap is where vulnerabilities live. Finding it requires patience, systematic thinking, and the ability to stay curious when the first fifty things you try do not work.

The hands-on skill builds faster than most beginners expect once you find the right practice platforms. The methodology builds more slowly because it requires developing intuition about what to look for and where.

The Essential Ethical Hacking Toolkit

You do not need expensive tools to start. Here is the toolkit I built during my first 90 days and what each tool actually does:

Ethical Hacking Tools Table

My day-to-day tools were Burp Suite and a browser. Roughly 80% of bug bounty work for web applications flows through Burp Suite — intercepting requests, modifying parameters, replaying requests with altered inputs. If you only have time to learn one tool deeply, make it Burp Suite for web security.

Bug Bounty Platforms: Where to Start

Bug bounty platforms host programs where companies invite security researchers to find vulnerabilities in exchange for recognition and financial rewards. They provide the legal framework — the scope, rules of engagement, and payment mechanism — that makes authorized testing possible for independent researchers.

Bug Bounty Platform Comparison

My recommendation for beginners: start with HackerOne. Create your profile, complete the free hacker education content in the platform, and begin with programs that explicitly welcome new researchers. Look for programs that mention "all severity levels welcome" or that have broad scope including wildcard domains. Programs with very narrow scope or that only pay for critical vulnerabilities are discouraging for beginners.

The 90-Day Learning Roadmap

Here is the exact 90-day plan I followed. I was spending 2-3 hours per day on learning and practice.

90-Day Learning Roadmap

The single most important resource in my first 90 days was PortSwigger Web Academy (portswigger.net/web-security). It is completely free, built by the creators of Burp Suite, and provides hands-on labs for every major web vulnerability class. There is no better structured web security curriculum available at any price point.

Methodology: How I Actually Found the XSS

I want to give you a concrete example of the thought process behind finding a real vulnerability, because methodology is harder to teach than tools.

The XSS I found was in a SaaS application's site-wide search feature. My process:

Step 1: Understand the application. I spent an hour clicking through every feature, creating accounts at different permission levels, understanding what data flows where, and mapping the application's functionality.

Step 2: Identify input points. Every place the application accepts user input and reflects it back into the page is a potential XSS vector. Search boxes, URL parameters, form fields, profile fields, comments.

Step 3: Test the search parameter. I typed <script>alert(1)</script> into the search box and watched what came back. The application appeared to sanitize this — no alert popped. But in Burp Suite, I could see the response included my input in the page HTML.

Step 4: Investigate the sanitization. The application was removing <script> tags but not all JavaScript contexts. I tried an image tag with an event handler: <img src=x onerror=alert(1)>. That also got filtered.

Step 5: Try encoding variations. URL encoding, HTML encoding, double encoding, Unicode encoding. The one that worked was an HTML entity encoding variation on the event handler: <img src=x onerror&#61;alert&#40;1&#41;>. The sanitizer was not fully decoding before filtering, which left this path open.

Step 6: Write a clear report. A clearly written proof-of-concept with exact reproduction steps, screenshots, and an explanation of the impact is what separates a valid accepted report from a rejected one. Many beginners find bugs and write poor reports that get triaged as "informational" or "out of scope" — the report quality matters as much as the finding.

Honest Assessment: What I Got Wrong

I want to be honest about what did not work in my first 90 days, because reading about it may save you the same time.

I spent too long on infrastructure tools before web security. I set up Kali Linux, spent two weeks learning Nmap and Metasploit in depth, and then realized that 90% of accessible bug bounty programs are web applications. Network penetration testing tools like Metasploit are essential for internal network testing and CTF challenges, but they have limited direct application to bug bounty web programs. I should have gone straight to Burp Suite and PortSwigger Web Academy.

I tried programs that were too advanced too early. HackerOne's most prestigious programs — major tech companies, defense contractors, financial institutions — are intensely competitive. Thousands of researchers with years of experience are continuously testing these targets. As a beginner, you will find nothing there. Start with programs that have broad scope, low competition, and explicitly welcome new researchers.

I submitted too quickly before verifying scope. My first two submissions were marked "out of scope" — the specific subdomain I tested was excluded in the program's scope definition. Read the scope carefully before testing anything. A detailed scope violation can get your account restricted on some platforms.

For more on building skills in this area and related security disciplines, explore our learning courses and free notes library, and check out the full range of tech career and cybersecurity resources.

Frequently Asked Questions

What is ethical hacking and is it legal?

Ethical hacking is authorized security testing with written permission from the system owner, or within a published bug bounty program scope. It is entirely legal within those constraints and illegal without authorization. Bug bounty programs provide the legal framework for independent researchers to practice on real targets.

What tools do I need to start ethical hacking?

The essential free toolkit: Kali Linux (or Parrot OS), Burp Suite Community Edition, Nmap, and Wireshark. For web security specifically, Burp Suite is your primary tool. All of these are free — do not invest in paid tools until you have outgrown the free tiers.

How much can I earn from bug bounties?

Entry-level bugs earn $50-$500. Medium-severity vulnerabilities pay $500-$5,000. Critical vulnerabilities can pay $20,000+. Most beginners earn nothing for the first few months. Treat early bug bounty as skill development with occasional income rather than a primary income source.

Do I need programming skills for ethical hacking?

Not strictly as a prerequisite, but Python and basic JavaScript knowledge accelerate your learning significantly. You can start with no coding background, but you will hit limits when you need to understand exploits or write custom payloads. Learn Python basics in parallel with security fundamentals.

What is the difference between a penetration tester and a bug bounty hunter?

Penetration testers work under formal contracts for defined clients, produce formal reports, and receive fixed compensation. Bug bounty hunters work independently, choose their targets from public programs, and earn per valid report — no guaranteed income. Bug bounty is the better entry path for self-learners because the scope is publicly defined and feedback from triagers teaches you what real security teams care about.

Conclusion

My $150 first bug bounty took 94 days to earn. It required more reading, more failed tests, and more rejected preliminary reports than I expected. But the skills built along the way compounded faster than I would have believed at the start.

Ethical hacking for beginners in 2025 has better learning resources than any previous era of the field. PortSwigger Web Academy is genuinely world-class free content. HackerOne and Bugcrowd give you legal access to real production systems. The community on Twitter, Discord servers, and Reddit is accessible and generally generous with advice.

The path I have described works: web fundamentals, OWASP Top 10, Burp Suite proficiency, recon methodology, beginner-friendly programs, clear report writing. Give it 90 days of consistent daily effort before evaluating whether you are making progress. Most people who quit do so in the first month, before the methodology starts to crystallize.

Your first valid report changes how you see every piece of software you use. It is worth the work.

External resources:

• PortSwigger Web Security Academy — the best free web application security learning platform available
• OWASP Web Security Testing Guide — comprehensive methodology reference used by professional penetration testers worldwide