Re:$100M in bounties paid via HackerOne to ethical hackers
by albntomat0 on Wednesday May 27, 2020 @07:13PM
(#23331325)
I've gone with a similar approach, kinda treating it like a CTF. I work on unique targets, with the goal of learning something along the way, which has worked well thus far.
Not really, no.
Sure, the top 20 hackers on H1 do make a very decent living (you can listen to the story of Dawgy-G on Darknet Diaries ep60 about that). But realistically, if you are that good at it you can get paid much more doing a 'real' infosec job.
Bug bounty hunting platforms like H1 do give you the freedom to work whenever you want, wherever you want on your own terms. Basically gig economy.
Personally I do bounty hunting every now and then because I enjoy the learning experience from it. But looking at the time it takes me to discover a bug and writing a detailed report only to receive a couple hundred USD for it, it really isn't worth my time in a professional sense.
I'd say I make about 25USD/hour from it. Of course this is highly dependent on your skills. And it is also highly dependent on where you live whether 25 USD/hour is actually enough to make a living.
Sometimes you can get lucky and stumble upon a valuable bug and make a couple of grand for only an hour worth of work, but most of research you'll do will yield you knowledge, not money.