Target selection & prioritisation
When it applies
You have more scope than time. Whether picking a bug-bounty program or ordering assets inside one
authorized engagement, the choice of where to look usually matters more than how hard you look.
Why it works
Vulnerabilities cluster where code is new, complex, or neglected, and payout/impact clusters where
the asset is important. Spending your first hours choosing well beats grinding a hardened, picked-over
target — most reports come from a minority of assets.
Method
- Size the attack surface: prefer programs/assets with lots of subdomains, APIs, and
functionality over a single static site — more surface, more bugs.
- Favour freshness: newly added scope, a recent acquisition, a just-launched feature, or a
product the crowd hasn't saturated. Watch changelogs and scope-change feeds.
- Match your strengths: pick tech you know (a stack, a language, a vuln class) — depth compounds.
- Weigh the economics (bounty): payout table, response/triage speed, resolution rate, and how
crowded the program is. A fast, fair program at medium bounty often beats a slow flagship.
- Prioritise assets inside scope: rank by likely impact (auth, payments, admin, PII) × likely
softness (obscure subdomain, legacy app, thin JS) and start at the top.
- Timebox and re-evaluate: if an asset yields nothing after a set budget, rotate — don't sink.
Gotchas
- Big brand ≠ easy: flagship domains are the most hunted. The soft spots are usually the
forgotten subdomains and new features, not
www.
- Confirm the asset is actually in scope before investing (load
tradecraft-scope-roe).
- Don't chase payout alone — a program that never triages wastes more time than a lower bounty.
Verify success
You can state, in one line each, why you picked this program/asset and what the highest-value
surface is — and you're working that surface, not a random one.
References
Bug-bounty program statistics/leaderboards; disclosed-report patterns; the tradecraft-attack-scenarios skill.
1---2name: tradecraft-target-selection3description: Choose where to spend effort for the best return — which program, which asset, which surface. Load at the start of bug-bounty work or when a scope is broad and time is limited, on "which program", "where should I hunt", "prioritize these targets". Signals: a big scope list, many in-scope domains, a new program, limited time.4---56# Target selection & prioritisation78## When it applies9You have more scope than time. Whether picking a bug-bounty program or ordering assets inside one10authorized engagement, the choice of *where to look* usually matters more than how hard you look.1112## Why it works13Vulnerabilities cluster where code is new, complex, or neglected, and payout/impact clusters where14the asset is important. Spending your first hours choosing well beats grinding a hardened, picked-over15target — most reports come from a minority of assets.1617## Method181. **Size the attack surface**: prefer programs/assets with lots of subdomains, APIs, and19 functionality over a single static site — more surface, more bugs.202. **Favour freshness**: newly added scope, a recent acquisition, a just-launched feature, or a21 product the crowd hasn't saturated. Watch changelogs and scope-change feeds.223. **Match your strengths**: pick tech you know (a stack, a language, a vuln class) — depth compounds.234. **Weigh the economics** (bounty): payout table, response/triage speed, resolution rate, and how24 crowded the program is. A fast, fair program at medium bounty often beats a slow flagship.255. **Prioritise assets inside scope**: rank by likely impact (auth, payments, admin, PII) × likely26 softness (obscure subdomain, legacy app, thin JS) and start at the top.276. **Timebox and re-evaluate**: if an asset yields nothing after a set budget, rotate — don't sink.2829## Gotchas30- Big brand ≠ easy: flagship domains are the most hunted. The soft spots are usually the31 forgotten subdomains and new features, not `www`.32- Confirm the asset is actually **in scope** before investing (load `tradecraft-scope-roe`).33- Don't chase payout alone — a program that never triages wastes more time than a lower bounty.3435## Verify success36You can state, in one line each, why you picked this program/asset and what the highest-value37surface is — and you're working that surface, not a random one.3839## References40Bug-bounty program statistics/leaderboards; disclosed-report patterns; the `tradecraft-attack-scenarios` skill.
NoorQureshi