Tell us a bit about yourself: what does your life look like now?

I have just received the biggest gift from life: my daughter born in march this year, so my life has changed a lot during the last period. I'm working as a pentester, and in the nights I'm doing bugbounty and security research as a hobby.

How many hours do you spend on bug hunting every week?

It's really hard to say an exact number of hours, but if I have to I would say at least 10 hours a week. There are ups and downs as well, and that's the main point I like in bb that I'm not forced to do. This opportunity always fits your calendar.

First steps in bug hunting

How did you get into bug bounty hunting?

It was back in 2008, when I first heard about this, and it was totally addicted with the fact that people earn awesome amount of money with just hacking softwares.

I started working as a security advisor in 2015, and the bugbounty opportunity appeared in my life in 2019 again, after a night-out with my collegues. We were talking about it, and I decided that I want to be a part of it.

Hacker insight

Don't worry about wasting your time, because there is no such in this area that called wasting. Every step you take is part of a learning curve. Give yourself the time to develop yourself in the area you are interested, and once you will have all the reward for your efforts. So my main recommendation is : PATIENCE

Do you have any tips for our audience on what you do when you approach a new target?

When I'm approaching a new target, I always try to use the software as a classic end-user. When I have the basic understanding of the application, I will build my attack scenarios and will go for the technical details. Also the other more important part is enumeration. You always have to be sure, what you are testing, and what's the structure of the target.

About the testing methodology

Do you follow a pre-defined methodology or do you prefer to change your methods regularly?

It depends on. If you want to find really unique bugs, you have to "break" the classic methodologies, and go on your own path. If an application seems to be on a low security maturity level, I always use predefined methodologies.

Do you have any favorite tool or favorite wordlist to test with?

My favourite tool is BurpSuite, and all the plugins written by the community. There are lot of awesome people around the world, who provide you insane plugins, making your work much more easier. Regarding the wordlists, I'm always changing them, and using the most accurate against the target. OFC, rockyou is classic :)

Favorite bug classes

Do you have any favorite vulnerabilities to focus on during testing?

I would say business logic errors are my favourite. I have over 200 reports of this category, and I'm really into it. The reason behind this is simply: automatic tools and scanners can't spot such bugs.

Certifications and Achievements

Do you have any security certificates? How important do you think certifications are nowadays?

I'm always confused with such questions. I'm rather the guy telling everyone that if you are good in your field, you don't really need certs. From the other hand, the business is not working in that way, so if you want to work, you need something. I have OSCP, OSWP, and now I'm going for CRTP, but these are kinda boring.

What would you consider your most impressive achievement? What bounty are you most proud of?

I had a CVSS 9.1 bug at Etsy. This was an awesome bug, and was really severe.

Future of bug bounty

Can bug bounty hunting be a full-time job?

For sure, it can be, but I wouldn't do it as a full-time job, because the flexibility would be lost.

What is the role of automation in security testing?

I'm not really into it, but if you have a limited period of time for testing a lot of targets, you have to use scanners.

What are your expectations of bug bounty platforms?

Quick response times, good programs, no huge limitations, professional analysts, awesome rewards, swags and reputation system. I think if you have these, you will have a huge number of users.

What is your impression of HACKRATE?

I have just started using hackrate this year more actively, but during this short period of time, I'm totally satisfied.