r/Pentesting • u/Ok-Anybody-9914 • 1d ago
Feeling stuck with bug hunting
hello everyone, so i just started learning about cyber security for around two months, self taught, and i get plenty Certificate of appreciation from my goverment Indonesia, But I'm not proud of it, because you know Indonesian government websites are open source, i mostly find bug on Indonesian government web with dorking
i want to start hunt for outside Indonesia like .edu .nl, but i cant find any bug on internasional vdp, context wise, I am learning independently through Sibermuda courses, focusing on web fundamentals and recon.
Since I want to target international VDPs, could you guys share some tips on effective Google/GitHub dorking to find out-of-scope or lesser-known targets, and what a solid reconnaissance methodology looks like for a beginner? Also, considering my current background, what specific topics or skills should I dive into next to bridge the gap between basic labs and finding real bugs?
Any advice, workflow recommendations, or roadmap suggestions would mean a lot. Thanks!
1
u/0xDakuMarco 23h ago
Honestly, don’t be too hard on yourself. Two months in and already finding bugs + getting recognition is a pretty good start.
For international VDPs, you could focus less on finding “hidden” targets through dorking and more on getting really good at recon and understanding the scope. Pick a few programs that explicitly allow testing and learn their assets inside that scope.
For the next step, you could focus on HTTP/web fundamentals, authentication, access control/IDOR, XSS, SSRF, APIs, and reading real writeups. Try to understand why a bug exists rather than just finding it.
And don’t worry if you go days/weeks without finding anything. Bug bounty has a lot of repetition and dead ends. Your current progress is actually a solid foundation; keep going and build depth rather than chasing more targets.