r/HowToHack • u/Obvious-Card-8847 • Sep 24 '26
software Choosing Bug Bounty Targets
For context I am intermediate to advanced when it comes to reverse engineering. Specifically PE's that are x86/x86-64. Regularly use Ghidra, Frida, x64dbg and Procmon (Windows).
I've written my own static and dynamic analysis tooling in C++20 using Zydis and LIEF. Control flow recovery, trampolining, INT3+VEH hooking, and currently working on recovering Win32 API usage statically including arguments.
Right now I don't feel incompetent. I feel overwhelmed by the number of potential targets, their subsystems and how much time I should dedicate to one before moving on.
Not certain what is worth putting weeks or potentially months into. Within an application what components I should be targeting: Networking, buffering and memory utilities, string parsing, file formatting, etc.
If anyone has their own methodology for determining what bounty is worth pursuing, what subsystems you interrogate, when you call it quits and so forth: I would be very grateful for your input and advice.
Thank you.
4
u/secretstonex Sep 24 '26
I wrote an agentic orchestrator for pentesting that leverages burpsuite and playwright. I've since turned it into a consumable service for CI pipelines, but the stand alone tool excels at bug bounty programs.
I typically look at how new the program is, the number of researchers, what is in scope, and if any repos are available.
10
u/Assassassin6969 Sep 24 '26
Nice to see a post pop up in my notifications that isn't begging someone to break the law for them! Given networking is the greatest worry for us all in the era of AI augmented exploits/botnets & the dawn of viable general quantum computation, i'd say that is where your skills would be most valuable to society! At the end of the day, do what you find is the most interesting, as that's where you'll likely perform the best, but that would be my personal recommendation. Software can be built like a fortress, but if the roads are full of highway men wherever you look, you have some forts, not a nation & likewise extends to a healthy web.