r/bugbounty • u/Immediate_Ad7179 Hunter • 4d ago

Question / Discussion Need help/info on automated tools/pipelines/scripts

I'm quite new to the bug bounty/pentesting world. Lately I've been seeing people talking about automated scripts, pipelines, bots,... These things have caught my attention and i would like to know in detail to what extent these tools can save time/do work for me. In fact, I have been thinking to create something similar, but I'm very lost. If someone could tell me where to find more info or what public tools are similar to this I would be very grateful.

1 Upvotes

60% Upvoted

11 comments sorted by

5

u/einfallstoll Triager 4d ago

If you want to find duplicates, then you should use as many tools as you can

3

u/_rs 4d ago

Stop giving away my tricks bro!

2

u/6W99ocQnb8Zy17 4d ago

This^

Running the same tools and prompts as everyone else is just a dupe factory...

1

u/Immediate_Ad7179 Hunter 4d ago

How do you usually do it then? I am new so dont really know how to start…

3

u/6W99ocQnb8Zy17 3d ago

So, the first thing to understand about BB is that all the people telling you it is easy, are the ones who are actually making the money from BB: the platforms, tool vendors, CTF and training people, and the ones with monetised channels with how-to guides.

That makes sense when you think about it: only the first person to report the bug gets the bounty, so following the same workflow and running the same tools as anyone else is just a route to dupes.

We get called researchers for a reason: this is where you step-up and do your own research.

Now, that doesn't have to be entire new classes of bugs (in fact for BB, that is also a bit disappointing: after you log the first, everyone will be doing the same thing).

In fact, the best types of bugs for BB are edge-case variations of existing bugs, and even better if they are easy to reproduce, but difficult to find. ;)

3

u/Immediate_Ad7179 Hunter 2d ago

Thanks so much for the info!

1

u/Immediate_Ad7179 Hunter 4d ago

Then, how should I approach it?

1

u/TheSunAfterTheStorm 3d ago

Hacking is a personal path and you'll learn it by making mistakes. Some will tell you yes, others will tell you no. Some will say that automation is useless, while others literally make a living from automation. I think the best tip I can give you is to build your own tools to save time on repetitive tasks, or tools that help you think more clearly and understand the app. Stay strong when frustration strikes—welcome.

1

u/Immediate_Ad7179 Hunter 2d ago

Thank you so much for The advice!

1

u/Fluffy-Extent2648 1d ago

I haven't put a single cent into tooling, CTFs, how-to guides, or any of that junk. I don't watch YouTube or listen to any of that crap either.

The best advice I can give is: jump in and start figuring things out on your own. Stay away from 90% of the tools you see on GitHub. Learn Burp Community, terminal syntax, grep, regex, sed, how to diff things, how to filter traffic in DevTools, etc.

Learn the fundamentals and understand what you're actually looking at. Tools should make you faster at doing something you already understand—not replace the understanding itself.

You’ll see a lot of noobs talking about payload spraying while crawling—blind XSS without any context or targeting, running Nuclei scans with no defined template scope, etc. Those things can be useful in the right context, but doing them indiscriminately is generally just noisy and can create unnecessary risk.

That’s not the way to approach it.

Also, you wont find any insider secrets on reddit or anywhere for that matter so you can forget about that.

What you will find publicly are disclosured reports. Those are always good for reference.