# Bounty Target Finder > Use when find and prioritize high-paying bug bounty programs. Use when discovering new targets, comparing bounty payouts, filtering programs by scope, or building a target pipeline for continuous hunting. - Skill: `oyi77/bounty-target-finder` (Agent Skill) - Install (CLI): `npx skillmds add oyi77/bounty-target-finder` - Raw SKILL.md: https://api.skillmd.com/api/skills/oyi77/bounty-target-finder/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - License: Apache-2.0 - Author: oyi77 (https://skillmd.com/u/oyi77) - Updated: 2026-09-08 - Page: https://skillmd.com/skills/oyi77/bounty-target-finder --- # Bounty Target Finder ## Overview Find, filter, and prioritize bug bounty programs that maximize payout per hour hunted. This skill surfaces high-value in-scope targets, ranks them by expected value (payout probability × bounty range), and builds a continuous hunting pipeline so you never waste time on low-reward or over-saturated programs. ## When to Use - Starting a new bug bounty hunting cycle - Looking for fresh targets with less competition - Comparing payouts across platforms - Building a continuous hunting pipeline - Finding programs that match your skill set ## When NOT to Use - When you lack proper authorization for testing - For production systems without change management - When the task requires legal or compliance expertise beyond technical scope - When you need to hunt *right now* instead of planning — just pick the first target from your existing list ## Money-Making Overview **Buyer persona:** Full-time and part-time bug bounty hunters who want to maximize payout per hour. These are security researchers, pentesters, and hackers who treat bounty hunting as a primary or secondary income stream. **What they'll pay for:** Prioritized target lists that surface high-payout, low-competition programs. Time saved on recon = more time finding bugs = more bounties collected. **Pricing tiers (service model):** | Tier | Price | Deliverable | Timeline | |------|-------|-------------|----------| | **Starter** | $50 | Top 10 targets from one platform (HackerOne or Bugcrowd), ranked by max bounty, with in-scope scope summary | 1 day | | **Pro** | $200 | Top 30 targets across 3 platforms, ranked by estimated payout/hour, includes competition analysis (recent submissions count), scope detail, and technology stack | 3 days | | **Elite** | $500 | Top 100 targets with full pipeline, weekly refresh, custom filters (skill match, tech stack, P1/P2 historical bounty data), Slack/Telegram alerts when new high-value programs appear | Ongoing weekly | **First-dollar timeline:** Deliver Starter within 1 day. First payment clears within 48 hours of delivery. Pro clients typically convert from Starter, so every output is a sales document. ## First Action in 60 Minutes Run this script to scrape HackerOne and Bugcrowd for programs with the highest max bounties and in-scope web/API targets: ```bash #!/bin/bash # bounty-sweep.sh — Find high-paying programs in ~10 minutes # Usage: bash bounty-sweep.sh mkdir -p bounty_targets # --- HackerOne Hacktivity (public programs with disclosed reports) --- echo "[*] Fetching HackerOne programs..." curl -s "https://hackerone.com/programs/search?query=type:hackerone&sort=popularity&page[size]=100" \ -H "Accept: application/json" \ -o bounty_targets/h1_raw.json # --- Bugcrowd programs --- echo "[*] Fetching Bugcrowd programs..." curl -s "https://bugcrowd.com/programs.json?sort[]=promoted&page=1" \ -H "Accept: application/json" \ -o bounty_targets/bc_raw.json # --- Filter and rank by max bounty --- python3 << 'PYEOF' import json, sys programs = [] # Parse HackerOne try: h1 = json.load(open("bounty_targets/h1_raw.json")) for p in h1.get("data", []): attrs = p.get("attributes", {}) name = attrs.get("name", "N/A") max_bounty = attrs.get("maximum_bounty", 0) or 0 min_bounty = attrs.get("minimum_bounty", 0) or 0 offers_bounties = attrs.get("offers_bounties", False) if offers_bounties and max_bounty >= 500: programs.append({ "platform": "HackerOne", "name": name, "url": f"https://hackerone.com/{attrs.get('handle', name)}", "max_bounty": max_bounty, "min_bounty": min_bounty, "score": max_bounty * (1 if max_bounty <= 5000 else 0.8) # diminishing returns on massive bounties }) except Exception as e: print(f"[!] H1 parse error: {e}") # Parse Bugcrowd try: bc = json.load(open("bounty_targets/bc_raw.json")) for p in bc: max_b = 0 if p.get("max_payout"): max_b = int(p["max_payout"].replace(",", "").replace("$", "")) name = p.get("name", p.get("title", "N/A")) if max_b >= 500: programs.append({ "platform": "Bugcrowd", "name": name, "url": f"https://bugcrowd.com/{p.get('slug', name)}", "max_bounty": max_b, "min_bounty": 0, "score": max_b * (1 if max_b <= 5000 else 0.8) }) except Exception as e: print(f"[!] BC parse error: {e}") # Rank programs.sort(key=lambda x: x["score"], reverse=True) print(f"{'Platform':<12} {'Program':<40} {'Max Bounty':<12} {'Score':<8}") print("="*72) for p in programs[:20]: print(f"{p['platform']:<12} {p['name'][:39]:<40} ${p['max_bounty']:<9,} {p['score']:<8.0f}") # Save with open("bounty_targets/ranked_targets.json", "w") as f: json.dump(programs[:20], f, indent=2) print("\n[+] Saved top 20 to bounty_targets/ranked_targets.json") PYEOF ``` **What to do next:** Open `bounty_targets/ranked_targets.json`, pick the top 3-5 programs. For each, visit the program page, note the exact in-scope targets, and start recon (subdomain enumeration, technology fingerprinting). Track time: target selection should take ≤30 minutes total. ## Deliverable Format When delivering a target list to a client, use this invoice-ready template: ``` ╔══════════════════════════════════════════════════════════════╗ ║ PRIORITIZED BOUNTY TARGET REPORT ║ ║ [Client Name] — [Date] ║ ╚══════════════════════════════════════════════════════════════╝ TOP 10 TARGETS (ranked by estimated payout/hour) RANK │ PLATFORM │ PROGRAM │ MAX BOUNTY │ COMPETITION │ EST. PAYOUT/HR ─────┼───────────┼──────────────────────┼────────────┼─────────────┼─────────────── 1 │ HackerOne │ example-program │ $5,000 │ Low (3/wk) │ $250-500 2 │ Bugcrowd │ another-target │ $3,500 │ Med (8/wk) │ $150-300 ... TARGET PROFILES (detail for top 3) 1. example-program (HackerOne) URL: https://hackerone.com/example-program Max Bounty: $5,000 | Min Bounty: $300 Scope: *.example.com, api.example.com (API, Web) Out of Scope: *.staging.example.com, *.dev.example.com Tech Stack: React, Node.js, AWS Competition: Low (3 disclosed reports in last 30 days) Notes: Recently expanded scope — first-mover advantage LABOR SUMMARY Research & ranking: 1.5 hours Total fee: $200 (Pro tier) PAYMENT: USDC / Bank Transfer / PayPal (net 15) ``` ## Workflow 1. **Scrape Platforms** — Pull programs from HackerOne, Bugcrowd, Intigriti, Synack 2. **Filter by Payout** — Keep only programs with max bounty ≥ $500 (minimum viable target) 3. **Assess Competition** — Check disclosure activity / recent submissions to gauge saturation 4. **Match to Skills** — Prefer targets matching your expertise (web, mobile, API, infra) 5. **Prioritize & Rank** — Score by: payout × (1 − competition_factor) × skill_match 6. **Output Report** — Deliver ranked list with payout estimates and scope summaries ## Anti-Rationalization Table | Rationalization | Reality | |---|---| | "I'll wait until I'm a better hacker before submitting" | You improve by submitting, not by studying. Send your best finding now. | | "That program has too many hunters already" | Most hunters only test the first 3 endpoints. Find the hidden ones. | | "The payout is too low for my time" | A $500 finding in 2 hours is $250/hr. That beats most consulting rates. | | "I need to find a critical, not a low-hanging medium" | Three mediums paying $500 each is $1,500. Ship what you find. | | "I'll take a full day to do proper recon first" | 60-minute light recon is enough to find your first vulnerability. Start shallow. |