Everything earlier in this course gave you capabilities — how to [recon a target](/#/), find [SQL injection](/#/), abuse [access control](/#/), and [write a report](/#/). Bug bounty hunting is the operating model that ties those capabilities into one repeatable loop you can run against real, scoped programs and get paid for valid, unique findings.
It is not a new vulnerability class. It is the discipline of applying the bugs you already know efficiently and legally against real-world targets — and of competing with every other hunter to be the first to report a clear, in-scope, high-impact finding.
How a bounty program differs from a scoped penetration test:
- Continuous, not time-boxed — the program stays open; you test when you choose.
- Scope-bounded by a public policy, not a private contract — the policy lists what you may and may not touch.
- Pay-per-valid-unique-bug — you earn only for an in-scope, reproducible, impactful finding that is not already known.
- You compete with everyone — the first valid report of a bug wins; the rest are duplicates.
That economics is why scope-reading, deduplication, and report quality — not just finding bugs — are the core skills.
Authorised targets only. A bug-bounty program is a standing authorisation, but only for the assets and actions its policy explicitly permits. Testing anything outside scope is unauthorised access, no matter how good the bug. Read the program policy before sending a single request, and revisit [Hacking Ethics and Authorization](/#/) if you are unsure. This is a methodology lesson — practise it against a program you are authorised to test (HackerOne / Bugcrowd / Intigriti) or a self-hosted lab as a dry run; the practical work uses that authorised target rather than a bundled course target.
In this lesson you will:
- See how bounty hunting differs from a scoped pentest, and learn the bounty loop.
- Practise reading a program policy and separating in-scope from out-of-scope assets.
- Learn why most reports are closed as duplicate / informative / out of scope — and how to avoid each.
- Take away the rule that staying in scope is what keeps your testing legal under safe harbour.
Click Continue when you are ready.