I just started but I'm trying to get into the bug bounty / hunting field. I spent 40 bucks on a web application hacking book so I'm currently in the negative.