Ethical Hacker Ka Freelance Journey: Bug Bounty Se ₹1.2 Lakh Mila

Ek report submit ki thi 2 baje raat ko. Subah uthke dekha: "Duplicate, already reported 6 hours before you."

6 ghante. Bas 6 ghante pehle kisi aur ne wahi bug dhoond liya tha. Us din laga chhod doon ye sab.

Nahi chhoda. Aur ab, roughly 14 mahine baad, total ₹1,19,430 aa chuke hain alag alag bug bounty programs se. Round number nahi hai jaanbujh ke. Yahi asli figure hai jo maine apni spreadsheet mein track kiya hai.

---

Shuru kaise hua

College ke last saal mein placements nahi ho rahe the. Coding average thi, DSA weak, interviews mein nervous ho jaata tha. Ek din YouTube pe ek video dekhi kisi security researcher ki jisne ek bade e-commerce app mein bug dhoonda tha aur $500 mila tha.

Socha, try karte hain. Kho kya raha hai.

HackerOne pe account banaya. Bugcrowd pe bhi. Dono free hain, koi paisa nahi lagta join karne mein. Bas ek profile, thoda background information, aur ready.

Pehle hafte mein maine socha main genius hoon. Doosre hafte pata chala mujhe kuch nahi aata.

---

Wo 5 mahine jab kuch nahi mila

Ye part koi nahi batata. Har "bug bounty se lakhon kamaye" wali video seedha success pe jump kar jaati hai.

Maine roughly 40 reports submit ki in shuruaati 5 mahino mein. Zyadatar "Informative" mark hue, matlab bug hai par itna minor ki koi payment nahi. Kuch "Duplicate" the, jaise wo raat wala incident. Aur do reports toh seedhe "Not Applicable" ho gaye kyunki maine scope ache se nahi padha tha.

Ek company ne mujhe unke "Hall of Fame" page pe daal diya. Naam likha hua tha wahan. Paisa? Zero. Us waqt funny nahi laga tha, ab sochta hoon toh thoda haste bhi hai.

Frustration real thi. Ek raat toh laptop band karke socha ye mera cheez nahi hai. Par agle din phir laptop khola. Pata nahi kyun.

---

Pehla paisa: ₹3,821

Pehla actual bounty mila ek chhoti startup se, unke password reset flow mein ek IDOR bug tha (Insecure Direct Object Reference, matlab agar aap URL mein ek number change karte ho toh doosre user ka data dikh jaata hai).

Maine sirf itna kiya: apna account banaya, password reset request bheji, aur URL mein apna user ID dikha wahan. ID ko 1 number badla. Doosre account ka reset token aa gaya screen pe.

Report submit ki. 4 din mein reply aaya: "Valid. Medium severity. Bounty: $46."

$46 us waqt ₹3,821 bana tha (exchange rate thoda upar-neeche hota rehta hai). Chhota amount tha. Par wo feeling alag thi, pehli baar laga ki main sach mein kuch kar raha hoon, sirf videos nahi dekh raha.

---

Jo bug ne asli farak dala

Baaki bounties chhoti-chhoti aati rahi: ₹1,500 yahan, ₹6,000 wahan. Par asli badlaav aaya jab maine ek fintech company ke mobile app mein similar IDOR dhoonda, is baar transaction history endpoint mein.

Matlab: agar aap sahi tarike se request modify karte, toh kisi bhi user ki transaction history dikh sakti thi. Sensitive data. High severity bug.

Ye report submit karne ke baad 11 din tak koi reply nahi aaya. Har din check karta tha status. Phir ek din email aaya: "Confirmed. Critical. Bounty processing."

$650. Roughly ₹54,000 us waqt ke rate pe. Akele is ek bug ne meri total earning ko lagbhag double kar diya.

Waise, honestly, ye bug bahut complex nahi tha. Simple sa parameter tampering tha. Isse ye pata chala ki bug bounty mein hamesha "sabse smart" bug nahi jeetta. Jo pehle dhoondta hai aur properly report karta hai, wahi jeetta hai.

---

Ab actual routine kya hai

Har hafte 4-5 ghante deta hoon nayi programs explore karne mein. YesWeHack pe bhi account hai ab, wahan European companies zyada hain.

Ek pattern samajh aaya: naye launch hue programs mein competition kam hota hai pehle 48 ghanton mein. Purane, popular programs (jinke bare mein sab jaante hain) mein hazaron researchers already test kar chuke hote hain, toh wahan kuch naya dhoondna bahut mushkil hai.

Toh main specifically naye programs ka notification on rakhta hoon aur jaise hi koi launch hota hai, pehle 2 din mein focus karta hoon.

---

Jo galat samjha tha maine shuru mein

Socha tha bug bounty matlab "hack karo, paisa lo." Asal mein zyada time documentation padhne mein jaata hai: scope kya hai, kaunse features test allowed hain, konsi cheez out-of-bounds hai.

Aur patience chahiye. Bahut zyada. Kabhi kabhi ek program mein 3 hafte laga ke bhi kuch nahi milta.

Income bhi bilkul unpredictable hai. Ek mahine ₹34,000 aaye, agle 2 mahine kuch bhi nahi. Isiliye main ise abhi bhi side income hi maanta hoon, primary nahi. Excel se niche freelancing jaisi skills bhi mere paas hain backup ke taur pe kyunki bug bounty ka koi guarantee nahi hai.

---

Kal raat phir ek report submit ki hai. IDOR jaisa hi lagta hai ek naye fintech app mein, par abhi confirm nahi hai. Reply ka wait kar raha hoon. Shayad "duplicate" aaye, shayad kuch aur. Yahi cheez hai jo abhi tak interesting lagti hai, kabhi pata nahi chalta agla email mein kya hoga.