Infosec twitter people aren't the ones doing bug bounties. A lot of them are blue team cybersecurity, doing network engineering and IT, or do penetration testing for networks which is a different wheelhouse. Some of them might be reporting exploits to Zerodium/ZDI/other exploit brokers, but they keep a low profile and it is very different from "bug bounties".

It's 95th percentile for a lead developer in the UK... and probably everywhere outside some areas in the US.

This was admittedly a few years ago. No idea if that's still accurate.

Not really, no.

Sure, the top 20 hackers on H1 do make a very decent living (you can listen to the story of Dawgy-G on Darknet Diaries ep60 about that). But realistically, if you are that good at it you can get paid much more doing a 'real' infosec job.

Bug bounty hunting platforms like H1 do give you the freedom to work whenever you want, wherever you want on your own terms. Basically gig economy.

Personally I do bounty hunting every now and then because I enjoy the learning experience from it. But looking at the time it takes me to discover a bug and writing a detailed report only to receive a couple hundred USD for it, it really isn't worth my time in a professional sense.

I'd say I make about 25USD/hour from it. Of course this is highly dependent on your skills. And it is also highly dependent on where you live whether 25 USD/hour is actually enough to make a living.

Sometimes you can get lucky and stumble upon a valuable bug and make a couple of grand for only an hour worth of work, but most of research you'll do will yield you knowledge, not money.

I'm pretty sure a reasonable number are doing quite well for themselves after currency conversions. It would be quite challenging to replace a typical Bay Area security architecture salary with bug bounties, though. Few people are equipped to find and claim $10k+ bounties twice a month, every month.

Any suggestions where to start? I'm several years out of the scene and would love to be reacquainted.

Then there's hackthebox https://www.hackthebox.eu/ I haven't used this yet.

Mostly I just grab stuff off of twitter/reddit, I don't really know who to recommend right now, I kind of just followed a ton of relatively random open source infosec people organically, but none really scream "has guide for diving in or is a great intro person" off the top of my head.. (maybe @troyhunt), https://www.reddit.com/r/netsecstudents/

Hopefully someone else can chime in because I'd like to know more as well.

On the YouTube side for people who are a bit more casual like me, John Hammond and Live Overflow both seem pretty good for beginners.

John has a bunch popping up on my feed where he runs through a CTF or hacking room and steps through his process, like this SQLite timing attack (https://www.youtube.com/watch?v=DYLDG_2Vs3E) which I found interesting since I knew the concept but hadn't seen it in action before.

Live Overflow also explains things pretty clearly and has covered a variety of topics like using Ghidra, hacking an intentionally hackable MMO, or recreating patched XSS flaws.

I think it's really good to pick a niche first and stick to it, reverse engineering code looks fun but I'm not sure how commercial that skill is compared to busting open web apps.

If you want something to poke and prod at there's also Damn Vulnerable Web Application (DVWA) at http://www.dvwa.co.uk/

Hack the Box Try Hack Me Pentester Lab Hacker101 Portswigger Web Security Academy Linux Academy Bugcrowd University Hacksplaining Cybrary Malware Unicorn bugbountyguide.com CTFtime root-me.org MalwareTech Nahamsec The Cyber Mentor

There's a strong power law distribution - the top folks make a lot of money (say, > $500k/yr) and then it quickly drops off from there.

Unless you’re talking about private exploit sales, which is totally different.

As of that date, 6 people made over $1M total since it launched (not per year). So maybe 1 or 2 have hit 500k in a year? Some of those names have been doing it for over 6 years.

According to a previous report, only 0.3% have made over $5k in their lifetime on the platform.

https://duo.com/decipher/taking-hype-out-of-bug-bounty-progr...

And I'd hope we are only one of their many clients. We might be an outsider though, my company does very well to address the bugs that are brought to us fairly. We understand the need to encourage the top 100 researchers on the platform an incentive to look over our stack. That's where the value is.

We do get a lot of spammy notifications too which sucks but it's part and parcel with the issue mentioned here. We leverage BugCrowd to help filter the chaff from the precious metals. :)