Bug Bounty

What Is Bug Bounty & How It Works

🧩 What Is Bug Bounty? (Beginner-Friendly Explanation)

Bug Bounty is a legal and ethical program where companies pay hackers to find and report security vulnerabilities in their websites, apps, APIs, and cloud systems.

You are basically helping companies stay safe —

and they reward you with money, swag, fame, and recognition.

In simple words:

You hack → You report → You get paid.

Bug Bounty is the perfect path for:

• Students

• Self-taught hackers

• Web security learners

• Ethical hackers

• Anyone who loves breaking things ethically

And the best part?

👉 You don’t need a degree

👉 You don’t need experience

👉 You only need skill + patience

💡 How Does Bug Bounty Work? (Simple 4-Step Flow)

1️⃣ Choose a Bug Bounty Platform

HackerOne, Bugcrowd, Intigriti, Synack, or private programs.

2️⃣ Read the Program Scope

Understand what’s allowed, what’s out of scope, and what NOT to touch.

3️⃣ Hunt for Bugs

Perform recon → test endpoints → find vulnerabilities.

4️⃣ Report the Bug Professionally

Submit a well-written report with steps, proof, and impact.

If valid → You get rewarded.

Simple, clean, legal, profitable.

💥 Why Bug Bounty Is So Popular Today

Because companies need security more than ever.

Every day new vulnerabilities are discovered, and organizations rely on ethical hackers to find weaknesses before real attackers do.

Bug Bounty gives you:

• Real-world hacking experience

• Practical skills employers value

• A strong portfolio

• Potential income

• Freedom to learn at your pace

This is why bug bounty has become a massive opportunity for beginners in cybersecurity.

🔥 Learn Bug Bounty the Bugitrix Way

At Bugitrix, we believe bug bounty is one of the fastest, most practical ways to enter cybersecurity.

We teach you with:

✔ Realistic examples

✔ Recon-first mindset

✔ Modern tools & techniques

✔ Practical exploitation methods

✔ Simplified beginner-to-advanced structure

Our goal?

To turn you into a smart, efficient, and ethical bug hunter.

📥 Download Your Free “Bug Bounty – Beginner to Advanced” PDF

To make learning even easier, we created a complete Bug Bounty PDF guide that covers:

• Recon techniques

• Practical web hacking payloads

• Beginner → Advanced bugs

• Real-world examples

• Checklist for your first bounty

• Tools & automation tips

👉 Free for now!

👉 Beginner friendly

👉 Practical hacking techniques inside

Perfect for sharpening your skills while you follow this page.

Understanding Scope, Rules & Safe Hunting

🧠 Why Scope & Rules Matter in Bug Bounty

Before you touch a target, before you run a single scan, you must understand the scope and program rules.

Why?

Because in bug bounty:

✔ Staying ethical = Staying safe

✔ Staying in scope = Staying legal

✔ Following rules = Getting rewarded

❌ Ignoring rules = Getting banned instantly

This step teaches you the mindset of a responsible, professional bug hunter.

📜 What Is Scope? (Your Legal Hacking Playground)

Every bug bounty program clearly defines what you can and cannot hack.

❗ Your job is simple:

👉 Only test assets listed IN-SCOPE

👉 Avoid everything OUT-OF-SCOPE

In-Scope Examples:

• app.company.com

• api.company.com/v2/*

• Specific mobile app versions

• Cloud assets listed explicitly

Out-of-Scope Examples:

• Employees’ personal accounts

• Internal networks

• 3rd-party content

• Social media profiles

• Physical attacks

• DDoS, brute-force, spam

Breaking scope = instant ban, no payout.

⚠️ Safe Hunting Rules (Every Hacker Must Follow)

1️⃣ No DDoS or Service Disruption

Bug bounty is about finding vulnerabilities —

NOT crashing servers.

2️⃣ No Brute-Force Attacks

Unless the program explicitly allows it.

3️⃣ Do Not Access Real User Data

If you accidentally view something

→ Stop immediately

→ Report responsibly

4️⃣ Do Not Share Findings Publicly

Unless the program marks the report as “public”.

5️⃣ No Social Engineering

No calling employees.

No phishing.

No pretending to be support.

6️⃣ Always Use Test Accounts

Never hack real user accounts.

These rules protect both you and the company.

🔍 How to Read a Program Properly

Before you start hunting, always check:

Smart reading → smart hunting.

💡 Example: Good vs Bad Hunting

✔ Good Hunter:

• Reads scope carefully

• Tests only allowed domains

• Uses test accounts

• Reports ethically

❌ Bad Hunter:

• Runs random scans on everything

• Attacks out-of-scope systems

• Tries DDoS or brute force

• Steals real data

Good hunters get rewards.

Bad hunters get banned.

🔥 The Bugitrix Way – Stay Safe, Stay Ethical

At Bugitrix, we train you to become a professional bug hunter, not a reckless one.

Our approach follows:

• Scope discipline

• Ethical testing

• Responsible disclosure

• Respect for the rules

• Real-world hacker mindset

If you haven’t yet —

📥 Download the free “Beginner to Advanced Bug Bounty PDF”

It contains a full section on safe testing methods + legal rules every hunter must know.

Setting Up Your Hacker Environment (Tools + Platforms)

🧠 Why Setting Up a Hacker Environment Matters

Before you start finding bugs, you need the right setup —

tools, browsers, extensions, OS, and bug bounty platforms.

A good environment makes you:

✔ faster

✔ more efficient

✔ more accurate

✔ more professional

Think of this step as building your hacker workspace.

🖥️ 1. Choose Your OS (Recommended: Linux)

Most bug bounty hunters use Kali Linux, Parrot OS, or Ubuntu because they come with powerful tools.

🔥 Best Choices:

• Kali Linux → Pentesting-focused

• Parrot Security OS → Lightweight + secure

• Ubuntu → Clean + customizable

Windows works too, but Linux gives a more native hacking vibe and supports most tools.

🧩 2. Install Core Bug Bounty Tools

You don’t need 100 tools —

just the right ones.

🔥 Essential Tools for Beginners:

• Burp Suite → Intercept, modify, exploit HTTP traffic

• Subfinder → Find hidden subdomains

• Nmap → Scan ports & services

• FFUF → Directory & parameter fuzzing

• Amass → Deep recon mapping

• WhatWeb → Technology fingerprinting

• Naabu → Fast port scanner

These tools open the doors to recon, scanning, and exploitation.

🌍 3. Setup Browser for Hacking (Extensions)

Use Firefox or Brave for bug bounty.

Both support developer tools & extensions hackers love.

🔥 Must-Have Browser Extensions:

• Wappalyzer → Identify tech stack

• Cookie-Editor → Edit sessions & tokens

• Hack-Tools → Quick payloads

• Proxy Switcher → Toggle Burp proxy

• JSON Viewer → Better API responses

A good browser = faster testing.

📡 4. Create Accounts on Bug Bounty Platforms

To start hunting legally, join real bug bounty platforms.

🔥 Best Platforms for Beginners:

• HackerOne

• Bugcrowd

• Intigriti

• YesWeHack

• OpenBugBounty

• HackerOne CTF (Hacktivity) for free practice

These platforms give you real targets to hack ethically.

🧪 5. Practice on Safe Labs

Before hitting real companies, train your skills on labs.

🔥 Best Practice Sites:

• PortSwigger Web Security Academy

• TryHackMe (Web Hacking Paths)

• HackTheBox (Bug bounty boxes)

• DVWA (Damn Vulnerable Web App)

• bWAPP, Mutillidae, Juice Shop

Practicing first = fewer mistakes on real programs.

📥 6. Download Your Free Bug Bounty PDF (Highly Recommended)

Your next step → master the tools & techniques inside the free BugiTrix PDF.

The PDF includes:

• Complete tool setup

• Recon automation scripts

• Beginner → advanced payloads

• Checklist for real hunting

• POC writing templates

• Web + API bug examples

You can download it now — free for a limited time — and upgrade your hacker environment instantly.

🔥 BugiTrix Note

Environment setup is where 90% of beginners struggle.

We built our PDF & content to guide you step-by-step so you avoid confusion and focus on real hacking.

Reconnaissance for Bug Bounty (Domains, APIs, Assets)

🔍 Why Recon Is the Heart of Bug Bounty

In bug bounty, the hacker who performs the BEST recon finds the BEST bugs.

Simple rule:

More attack surface = More vulnerabilities = More rewards

Beginners look at the main domain.

Hackers look at everything behind it.

Recon helps you discover:

✔ Hidden subdomains

✔ Unprotected APIs

✔ Forgotten admin panels

✔ Old staging servers

✔ Debug endpoints

✔ Cloud assets

✔ Open ports

✔ Sensitive files

This is where real bug bounty magic begins.

🌍 1. Subdomain Enumeration (Hidden Entry Points)

Companies own dozens or hundreds of subdomains, many forgotten or misconfigured.

🔥 Tools to Use:

• Subfinder

• Amass

• AssetFinder

• Chaos dataset

Example (Subfinder):

subfinder -d target.com -o subs.txt

Why this matters:

Often, the biggest bugs are found on:

• dev.

• test.

• staging.

• internal.

• api.

These become your prime hunting targets.

📡 2. Asset Discovery (What Does the Company Really Own?)

Once you find subdomains, track extra assets like:

• S3 buckets

• Cloud storage

• CDN endpoints

• Email servers

• Mobile endpoints

• API v1/v2/v3 versions

• Forgotten web servers

🔥 Tools:

• Nmap

• DNSX

• HTTPX

• CloudEnum

Example (HTTPX):

httpx -l subs.txt -o alive.txt

This reveals all alive subdomains & technologies.

🧭 3. Directory & File Enumeration

Recon doesn’t stop at domains —

you must find hidden directories & files too.

🔥 Tools:

• FFUF

• Dirsearch

• Gobuster

Example (FFUF):

ffuf -u https://target.com/FUZZ -w wordlist.txt

What this finds:

• /admin

• /backup

• /config

• /old

• /api

• /uploads

• /testing

One hidden file can lead to a big bounty.

🔌 4. API Recon (Where Modern Bugs Live)

Today, most vulnerabilities come from APIs, not websites.

API recon includes:

• Finding endpoints

• Testing tokens

• Checking parameters

• Fuzzing objects

• Looking for BOLA/IDOR

🔥 Tools:

• Burp Suite

• Postman

• JWT.io

• Kiterunner

Example (API Enumeration with Kiterunner):

kr scan https://api.target.com -w routes-large.kite

APIs = perfect targets for logic bugs and authorization flaws.

🧠 5. Technology Fingerprinting

Knowing what tech a site uses helps you find weaknesses faster.

Example:

If the website uses WordPress → Try plugin exploits

If backend uses Laravel → Look for debug mode

If server uses Apache → Check for version exploits

🔥 Tools:

• Wappalyzer

• WhatWeb

• BuiltWith

🧩 6. Recon Automation (Hunt Like a Pro)

Most hunters use scripts to automate recon so they can focus on testing.

Useful automation tasks:

• Daily scans

• Subdomain refresh

• Ports & service enumeration

• URL collection

• JS file scraping

You will learn these inside the Bugitrix Bug Bounty PDF (Free for now) — includes ready-made recon scripts.

🔥 The Bugitrix Way – Recon First, Attack Later

At Bugitrix, we make recon your strongest skill.

Why?

Because most hunters fail to find bugs due to weak recon, not weak hacking.

Our approach ensures you:

✔ Build large attack surfaces

✔ Discover juicy endpoints

✔ Find hidden vulnerabilities

✔ Hunt smarter, not harder

And yes — the free PDF contains a full recon checklist + practical workflows..

Finding Common Vulnerabilities (XSS, IDOR, CSRF, SSRF, RCE)

🔥 Welcome to the Real Bug Hunting Zone

This is where beginners turn into real bug bounty hunters.

Once recon is complete, your next mission is to find actual vulnerabilities that companies reward.

These are the most common & highest value bugs found in bug bounty programs — and the ones you MUST master to earn your first payouts.

Let’s break them down in a clean, simple & hacker-friendly way. 👇

1️⃣ XSS (Cross-Site Scripting) – Run JavaScript Anywhere 😈

XSS happens when a website fails to sanitize user input, allowing an attacker to inject JavaScript.

🔥 Example Payload:

"><script>alert(1)</script>

💥 Impact:

• Steal cookies

• Deface pages

• Create fake login forms

• Redirect users

• Hijack accounts

XSS is perfect for beginners because it is common, fun, and easy to test.

2️⃣ IDOR (Insecure Direct Object Reference) – Unauthorized Access 🔓

IDOR = one of the highest paying bug types in modern bug bounty.

It occurs when users can access data by simply changing an ID.

🔥 Example:

/user?id=104  → change → /user?id=105

💥 Impact:

• View other users’ data

• Modify private info

• Download sensitive files

• Access admin-only endpoints

IDOR is everywhere — especially in APIs.

3️⃣ CSRF (Cross-Site Request Forgery) – Force Actions Without Permission 🎯

CSRF tricks a victim into performing an action without realizing it.

🔥 Example:

If a user is logged in, this HTML could transfer money:

<img src="https://bank.com/transfer?amount=5000&to=hacker">

💥 Impact:

• Change email/password

• Make purchases

• Update account settings

• Post content

CSRF is deadly when combined with weak cookies or missing tokens.

4️⃣ SSRF (Server-Side Request Forgery) – Hack From the Inside 🕳️

SSRF allows you to make the server send requests to internal services.

🔥 Example Payload:

http://localhost/admin

💥 Impact:

• Access internal dashboards

• Read cloud metadata

• Hit internal APIs

• Full cloud takeover (AWS, GCP, Azure)

SSRF = high severity + high payout.

5️⃣ SQL Injection (SQLi) – Database Control 💾💣

SQLi happens when unfiltered input reaches a database query.

🔥 Payload:

' OR 1=1 --

💥 Impact:

• Full database dump

• Login bypass

• Delete/modify data

• Server-side execution (advanced cases)

Not as common now… but when you find it → BIG payout.

6️⃣ RCE (Remote Code Execution) – Full Server Takeover 💀

RCE is the holy grail of bug bounty.

Happens when input reaches system commands or unsafe functions.

🔥 Payload:

; whoami

💥 Impact:

• Full server access

• Deploy backdoors

• Read all files

• Total compromise

Critical, rare, and extremely valuable.

📌 Quick Bug Summary Table

🔥 The Bugitrix Way – Learn Bugs the Right Way

At Bugitrix, we train bug hunters with:

✔ Practical payloads

✔ Real-world examples

✔ Exploitation mindset

✔ Recon + exploitation workflow

✔ Beginner → advanced pathways

And don’t forget —

📥 Download the free Bug Bounty Beginner-to-Advanced PDF

It contains step-by-step examples for all these vulnerabilities and more.

Advanced Bug Hunting Techniques (Logic Bugs, Chaining, Automation)

🧠 Welcome to Advanced Bug Hunting

Now you move beyond basic bugs.

This is where real bug bounty hunters separate themselves from beginners.

Advanced techniques help you discover:

✔ High-value bugs

✔ Logic flaws

✔ Multi-step vulnerabilities

✔ Automation-powered findings

✔ Rare but rewarding chains

If you want serious bounties — these techniques matter.

1️⃣ Logic Bugs – Break the System, Not the Code 🧩

Logic bugs happen when the application behaves in a way developers didn’t expect.

Unlike XSS or SQLi, these bugs don’t rely on payloads —

they rely on your brain.

🔥 Examples:

• Bypassing payment logic

• Claiming someone else’s coupon

• Changing price values

• Completing steps out of order

• Skipping a verification stage

• Editing cart values

💥 Why they pay well:

Because automated scanners can’t detect logic bugs.

Only smart humans can.

This is where bug bounty legends make thousands.

2️⃣ Parameter Tampering – Changing What the Website Expects 🔧

Many websites trust user-side values.

Attackers simply modify parameters to cause unintended actions.

🔥 Examples:

• Changing role=user → role=admin

• Modifying payment amount

• Changing product IDs

• Editing internal flags (example: is_premium=true)

Bug bounty hunters use Burp Suite to intercept and tweak these values.

3️⃣ Chaining Vulnerabilities – Turning Small Bugs Into Big Ones 🔗

Sometimes one bug is not enough.

But two small bugs chained together = critical severity.

🔥 Example Chains:

• SSRF → access cloud metadata → full takeover

• XSS → steal session → escalate to admin

• Misconfig → info leak → SQLi

• IDOR → data leak → privilege escalation

Companies pay extremely well when a chain results in major impact.

4️⃣ Race Conditions – Breaking the Timing of the System 🏃‍♂️⚡

A race condition happens when you send multiple requests at the same time and confuse the backend.

🔥 Example Targets:

• Payment systems

• OTP verification

• Inventory updates

• Redeemable coupons

• Point systems

Tools like Turbo Intruder (inside Burp) help you exploit this.

5️⃣ Advanced Recon Automation – Hunt Faster, Find More 🧨

Smart hunters automate repetitive tasks using tools & scripts.

You can automate:

• Subdomain refresh

• Directory fuzzing

• Port scanning

• JS file scraping

• Endpoint extraction

• Screenshotting every target

• Deep API enumeration

This gives you 10x more attack surface.

Automation templates & scripts are included inside the

📥 Free Bug Bounty Beginner-to-Advanced PDF by Bugitrix.

6️⃣ Deep API Testing – Modern Bug Hunter’s Goldmine 🔌

Most companies rely heavily on APIs.

This is where the highest-paid bugs usually live.

🔥 What to test:

• BOLA (IDOR in APIs)

• Rate-limit bypass

• Parameter fuzzing

• Token manipulation

• Role escalation

• Mass assignment

• Hidden API versions (/v1/, /v2/, /beta/)

APIs = fewer hunters + more bugs + higher payouts.

🔥 The Bugitrix Way – Hack Smarter, Not Harder

At Bugitrix, your advanced bug hunting journey focuses on:

✔ Real-world attack logic

✔ High-value bug identification

✔ Smart recon + smart exploitation

✔ Utilizing automation tools

✔ Professional bug chains

✔ Practical techniques used by top hunters

And remember —

📥 Download your free Bugitrix Bug Bounty PDF

It contains:

• Automation scripts

• Logic bug examples

• Real-world case studies

• Burp Suite workflows

• Vulnerability chaining blueprint

Reporting Like a Pro (POC, Steps, Impact, Severity)

🧠 Why Reporting Matters More Than You Think

In bug bounty, finding the bug is only 50% of the job.

The other 50% is how well you report it.

A strong report can:

✔ Increase your payout

✔ Reduce chances of duplicate

✔ Impress triagers

✔ Build your reputation

✔ Get faster rewards

A weak report can:

❌ Get marked as “Not Enough Information”

❌ Be misunderstood

❌ Be downgraded in severity

❌ Lead to no bounty

Reporting is an essential hacker skill — and we do it Bugitrix style: clean, clear, impactful.

1️⃣ Start With a Strong Title (Clear & Precise)

Your title should tell the triager EXACTLY what’s happening.

🔥 Good Titles:

• “IDOR in /api/user allows access to other users’ PII”

• “XSS in search parameter leads to session theft”

• “SSRF in image upload fetches internal metadata”

❌ Bad Titles:

• “Bug found”

• “Website vulnerable”

• “Check this issue”

Clarity wins.

2️⃣ Provide Step-by-Step Reproduction (Simple & Traceable)

Triagers love clean steps.

🔥 Example Format:

1. Visit: https://target.com/account?id=101

2. Change id=101 → id=102

3. Observe other user data

That’s it.

No storytelling. No fluff. Just clean steps.

3️⃣ Add a Proof of Concept (POC)

Your POC proves the bug is real.

You can include:

• Screenshots

• Burp Suite requests

• Video demo

• Payload used

• Impact explanation

Example Request:

GET /api/user?id=102 HTTP/1.1
Host: target.com
Cookie: session=abc123

POC = instant validation.

4️⃣ Highlight the Real Impact (Make It Matter)

Companies care about impact, not payloads.

Explain what an attacker can actually do.

🔥 Example Impact Statements:

• “An attacker can take over ANY user account.”

• “Sensitive personal info is exposed.”

• “Payment data can be modified.”

• “Internal services can be accessed via SSRF.”

• “Full database extraction is possible through SQLi.”

The more clearly you show risk →

the higher the chance of increased severity.

5️⃣ Assign Severity (Use Standard Models)

Use either:

• CVSS

• Platform severity guidelines (HackerOne, Bugcrowd, Intigriti)

Example:

Severity: High (IDOR + PII exposure)

CVSS: 7.5

Even if your severity is slightly off, a justified estimate shows professionalism.

6️⃣ Add Your Recommendation (Optional but Professional)

Triagers appreciate a quick fix suggestion.

Example:

• “Use server-side validation for user_id.”

• “Implement SameSite cookies to prevent CSRF.”

• “Sanitize output before rendering user input.”

Shows you understand both hacking AND defense.

📥 Pro Reporting Templates in the Bugitrix PDF

Inside the free Bug Bounty Beginner-to-Advanced PDF, you get:

• Full Bug Report Template

• POC Screenshot Examples

• Severity Explanation Models

• Notes for Triager-Friendly Writing

• Ready-to-use Report Structure

Perfect for beginners & intermediate hunters.

🔥 The Bugitrix Philosophy

A professional report =

✔ Faster triage

✔ Higher success rate

✔ More trust

✔ More bounties

This is why reporting is taught as a skill — not an afterthought.

Growing as a Hunter (Platforms, Rewards, Continuous Learning)

🔥 Bug Bounty Is Not a One-Time Skill — It’s a Journey

Most beginners quit too early.

Real bug bounty hunters grow over time — by learning, practicing, failing, improving, and staying consistent.

This step shows you how to grow into a long-term, successful, money-earning hacker.

Let’s level you up 👇

1️⃣ Join Multiple Bug Bounty Platforms (Expand Your Hunting Ground)

Don’t limit yourself to just one platform.

🔥 Best Platforms for Growth:

• HackerOne → Largest community, big companies

• Bugcrowd → Great beginner-friendly programs

• Intigriti → High-paying EU programs

• YesWeHack → Many public + private programs

• OpenBugBounty → Easy start for beginners

• Federacy, Yogosha, Synack (advanced hunters)

More platforms =

more targets → more opportunities → more payouts.

2️⃣ Follow High-Value Programs (Learn Where the Money Is)

Some programs are SUPER competitive, while others are easier.

🔥 Beginner-Friendly:

• E-commerce apps

• Blogs & CMS-based platforms

• Startups with simple apps

🔥 High-Reward (Advanced):

• Banks

• Cloud platforms

• Fintech apps

• SaaS giants

• API-heavy applications

Choose the right programs based on your skill level.

3️⃣ Study Public Write-Ups (Learn How Real Bugs Are Found)

This is one of the most underrated ways to grow.

Read reports from:

• HackerOne Hacktivity

• Medium (Bug bounty writeups)

• Reddit r/bugbounty

• GitHub exploit repos

Every write-up teaches:

✔ New payload

✔ New bypass

✔ New recon trick

✔ New mindset

Top hackers read more reports than they write.

4️⃣ Build Personal Wordlists, Scripts & Tools

As you grow, you’ll start creating your own hacking resources.

Examples:

• Custom FFUF wordlists

• Param miner wordlist

• API endpoint patterns

• Recon automation scripts

• Burp Suite macros & extensions

Personal tooling =

your competitive edge.

5️⃣ Practice Non-Stop (Labs → Real Targets)

Bug bounty is SKILL, not luck.

And skills grow with repetition.

🔥 Practice on:

• TryHackMe

• HackTheBox

• PortSwigger Academy

• DVWA

• Juice Shop

• buglabs (JS challenges)

Train here → apply on real targets → earn rewards.

6️⃣ Track Your Progress (Professional Hacker Habit)

Create a small habit:

After every session, write down:

• What bug you attempted

• What method you used

• What didn’t work

• What worked

• What new idea came to mind

Over time, this creates your own hacker playbook.

7️⃣ Network With Other Hunters (Grow Faster Together)

Follow hunters on:

• Twitter/X

• Discord communities

• Reddit

• Bug bounty forums

Ask questions, share findings, and stay updated with new techniques.

Bug bounty grows faster in community, not alone.

🔥 8️⃣ Download the Bugitrix Free Bug Bounty PDF (Grow Even Faster)

Before you move deeper into bug hunting…

Grab the Free Beginner-to-Advanced Bug Bounty PDF by Bugitrix:

Inside you’ll get:

• Advanced recon workflows

• Reporting templates

• Automation scripts

• Logic bug examples

• Real-world bug case studies

• API hacking tips

• Payload collections

It’s free for now — and built exactly for your growth journey.

🚀 The Bugitrix Growth Philosophy

To become a successful bug bounty hunter:

✔ Learn the basics

✔ Master recon

✔ Understand vulnerabilities

✔ Practice consistently

✔ Build your toolkit

✔ Network with other hackers

✔ Study reports

✔ Keep improving

Bug bounty is not about hacking fast —

it’s about hacking smart and hacking long-term.