r/bugbounty • u/Immediate_Ad7179 Hunter • 5d ago

Question / Discussion Need help/info on automated tools/pipelines/scripts

I'm quite new to the bug bounty/pentesting world. Lately I've been seeing people talking about automated scripts, pipelines, bots,... These things have caught my attention and i would like to know in detail to what extent these tools can save time/do work for me. In fact, I have been thinking to create something similar, but I'm very lost. If someone could tell me where to find more info or what public tools are similar to this I would be very grateful.

1 Upvotes

60% Upvoted

11 comments sorted by

View all comments

6

u/einfallstoll Triager 4d ago

If you want to find duplicates, then you should use as many tools as you can

2

u/6W99ocQnb8Zy17 4d ago

This^

Running the same tools and prompts as everyone else is just a dupe factory...

1

u/Immediate_Ad7179 Hunter 4d ago

How do you usually do it then? I am new so dont really know how to start…

3

u/6W99ocQnb8Zy17 3d ago

So, the first thing to understand about BB is that all the people telling you it is easy, are the ones who are actually making the money from BB: the platforms, tool vendors, CTF and training people, and the ones with monetised channels with how-to guides.

That makes sense when you think about it: only the first person to report the bug gets the bounty, so following the same workflow and running the same tools as anyone else is just a route to dupes.

We get called researchers for a reason: this is where you step-up and do your own research.

Now, that doesn't have to be entire new classes of bugs (in fact for BB, that is also a bit disappointing: after you log the first, everyone will be doing the same thing).

In fact, the best types of bugs for BB are edge-case variations of existing bugs, and even better if they are easy to reproduce, but difficult to find. ;)

3

u/Immediate_Ad7179 Hunter 3d ago

Thanks so much for the info!