Sizing a Bug Bounty VPS in 2026: Real Prices, Tools and Limits

A bug bounty VPS has one job: keep your recon loop running. In 2026 that loop usually goes passive subdomain discovery, HTTP probing, a crawl, a Nuclei pass, and then Burp on whichever hosts look interesting. You don't need a $50 server to run it. Here's how to size one, what to put on it and where the money actually goes.

What the pricing really looks like

The "$10 to $25" range is real with some providers and fiction with others.

Hetzner's price list from June 2026 lists the CX33, which has 4 shared vCPU and 8 GB of RAM, at $9.99 monthly for German or Finnish datacenters, not counting VAT. One step up, the CX43 (8 vCPU, 16 GB) costs $18.49, and the smaller CX23 (2 vCPU, 4 GB) costs $6.49. All three figures come from Hetzner's price adjustment notice dated 15 June 2026. Contabo is in the same ballpark. Its Cloud VPS 4 offers 4 vCPU and 8 GB for around €5.50 a month under a fair-use traffic policy, a price VPSBenchmarks still showed in early September 2026.

Compare that with the same 4 vCPU and 8 GB shape elsewhere. DigitalOcean asks $48 for it, and Vultr's regular Cloud Compute plan asks $40. Those two sticker prices are why many people assume recon hosting is expensive. It is, if you stay with the big US brands. It isn't if you pick EU shared-CPU plans, where Hetzner already bundles 20 TB of outbound traffic.

Prices move, so check the live console before paying. Hetzner also bills the primary IPv4 address as a separate line, which lifts the invoice a few dollars above the instance price, and VAT depends on where your account is registered.

Why you want one at all

Think of a hunting VPS as a computer that keeps working while your laptop sleeps. Recon jobs can run for hours, and your home IP shouldn't be the origin of 40,000 httpx probes. The server also gives you a clean Linux install you can wreck, rebuild and snapshot.

It doesn't replace Burp on your own desk, and it doesn't grant permission to test anything. Scan only hosts that the program has named in writing. If the policy bans automated scanners on production, running Nuclei from a $10 server still breaks that policy.

Three sizes, three price bands

Budget, roughly $5 to $10 a month. Two vCPU, 4 GB of RAM, 40 to 50 GB of SSD, and about 1 TB of transfer if the provider is stingy (Hetzner's EU locations give far more). A CX23-class machine fits here. It's enough for Subfinder, DNSx, a polite httpx pass and light Nuclei work against a short host list. It starts swapping if Katana runs headless while Nuclei fires a wide set of templates on the same night.

Recommended, roughly $10 to $25 a month. Four vCPU, 8 GB of RAM and 80 to 120 GB of SSD. Metered US clouds give 2 to 4 TB of transfer, while Hetzner's Falkenstein, Nuremberg and Helsinki sites include 20 TB. If you only buy one box, this is the one. It runs the whole ProjectDiscovery toolchain without the OOM killer stepping in every evening.

Heavy, roughly $25 to $50 and up. Eight or more vCPU, 16 GB or more of RAM and 150 GB or more of SSD. It makes sense when the scope is a big public program, when several tmux panes run port scans at the same time, or when you keep months of crawl output on disk. Hetzner's CX43 comes in under $20 in the EU, while DigitalOcean's 8 vCPU and 16 GB Basic Droplet is $96, which is a quick way to overspend before you even have a method.

Most people should stop at the middle size. Scale up when htop stays red for hours, not because someone online said "enterprise recon."

The toolchain on the box

Here's the usual stack, from base system to manual testing:

VPS
 ↓
Docker + tmux
 ↓
Subfinder + DNSx
 ↓
httpx + Naabu
 ↓
Katana + GAU
 ↓
ffuf + Nuclei
 ↓
Burp Suite on the hosts that survived

Every tool below links to its official repo or product page. Install current builds, and don't paste a 2022 install script and expect its flags to still work.

• Containers and sessions. Docker isolates each tool's dependencies, so you can throw away a Nuclei image carrying fresh templates instead of untangling a half-updated Go path. tmux lets a job survive a dropped SSH connection, and detach and reattach is the one habit worth learning first.
• Finding names. Subfinder pulls subdomains from passive sources, and several of those sources need API keys. See the ProjectDiscovery install docs for setup. DNSx then resolves the results and strips wildcard answers, which keeps tens of thousands of dead names away from your port scanner.
• Probing. httpx shows which names respond over HTTP, what status codes they give, and frequently the technology stack behind them. Naabu, from the same family, handles port scanning, but only use it where the rules allow ports to be scanned. Many web-only programs forbid it.
• Discovering paths. Katana crawls live hosts, and its headless mode is memory-hungry, which explains why 4 GB feels cramped. GAU instead gathers URLs the internet already knows about, from AlienVault OTX, the Wayback Machine and Common Crawl. It's archive research and not a live crawl, so verify that each path is in scope today. ffuf fuzzes content. It's quick even at defaults, so remove -t and use -rate when the target is delicate or the rules want you quiet. The rate and performance wiki page covers it briefly.
• Vulnerability checks. Nuclei executes YAML templates from the nuclei-templates repository. Aim the complete template set at an enormous host list and a 4 GB machine falls over, so narrow by severity first and read the program's rules before touching production.
• Manual work. Burp Suite remains the hands-on step. Community Edition costs nothing, while Professional is the paid tier. The server can gather URLs and live hosts, but a request worth replaying belongs in Burp on a computer you're sitting at.

The ProjectDiscovery open source page shows the same kind of pipe. One typical form follows, and it should only ever be pointed at a domain you're authorized to test:

subfinder -d example.com -silent \
  | dnsx -silent \
  | httpx -silent \
  | nuclei -silent -severity high,critical

Treat that one-liner as a starting filter, not a pentest and not a finding. Whatever Nuclei prints still needs a person to confirm it, check scope and write a report a developer can act on.

Where the money goes

On Hetzner in the EU, after the 15 June 2026 adjustment, instance prices in USD before VAT are:

• CX23, 2 vCPU and 4 GB: $6.49 a month
• CX33, 4 vCPU and 8 GB: $9.99 a month
• CX43, 8 vCPU and 16 GB: $18.49 a month

The older CX22, CX32 and CX42 generation had 40, 80 and 160 GB of disk, and the current line keeps that layout. Traffic at the EU locations is in the 20 TB class, so a shopping list that insists on "1 TB bandwidth" is the wrong constraint if you end up in Falkenstein.

DigitalOcean's current Basic Droplet table reads:

• 2 vCPU and 4 GB: $24, with 80 GiB of disk and 4 TB of transfer
• 4 vCPU and 8 GB: $48, with 160 GiB of disk and 5 TB of transfer
• 8 vCPU and 16 GB: $96, with 320 GiB of disk and 6 TB of transfer

Vultr's regular Cloud Compute asks $20 for 2 vCPU and 4 GB, and $40 for 4 vCPU and 8 GB.

So the "$10 to $25" recommendation means Hetzner or Contabo-class hardware, not just any four-core cloud VM. If DigitalOcean is your only account, the same spec turns into a $48 habit. Student pack credits and vendor trial balances come and go, so treat them as a short runway rather than a lasting $5 lab.

Where disk and memory go

Subfinder output is tiny, and httpx JSON for a few thousand hosts stays small. Katana and GAU are the real storage problem, since a year of archived URLs for a busy target is a huge pile of lines. Nuclei with -jsonl across a broad template set comes next. 80 GB is comfortable for one hunter working a handful of programs. 40 GB fills up as soon as you start keeping raw crawls "just in case."

Memory pressure comes from headless Katana, Chromium-based screenshot tools and Nuclei concurrency all stacked on one machine. A 4 GB machine copes when stages run one after another. The first size that lets httpx and a crawl share two tmux panes, without a free -h check every ten minutes, is 8 GB.

CPU pressure comes from Naabu and ffuf. Shared vCPU plans, such as Hetzner CX, Contabo Cloud VPS and DigitalOcean Basic, feel bursty. That's fine for recon, but a poor fit if you expect a linear speedup from "8 vCPU" on a noisy neighbor.

Practical setup notes

This isn't a full install guide, but a few habits matter:

• Start from Ubuntu LTS or Debian. Create a non-root user, allow SSH keys only, and run fail2ban or something similar on port 22, or move SSH to another port. A VPS that turns into someone else's scanner is a bigger problem than a slow Nuclei run.
• Install Go and then fetch the ProjectDiscovery tools using the commands in their current docs. PDTM is an option if one installer for everything appeals to you. Skip any old "bug bounty VPS script" gist from 2023.
• Keep wordlists and output in a separate directory that you can rsync off the box. A snapshot is cheaper than rebuilding after a bad rm.
• Use Burp Collaborator or any callback listener only if the program permits out-of-band testing. A few policies count surprise callbacks against the tester.

When to spend more

Move up when a single authorized scope calls for crawls in parallel, when swap gets used every night, or when the disk reaches 80 percent because every JSONL file was kept. Don't upgrade because a course thumbnail showed a 32 GB rack.

Sometimes two small machines beat one large one. Use one host for noisy scans and keep another clean for manual work and reporting. Two CX23 instances can still cost less than a single DigitalOcean 8 GB droplet.

The part that isn't infrastructure

A $10 VPS doesn't find IDORs. A written scope, a note-taking habit and hours spent on the application do. Nuclei will keep printing CVEs the program already closed as informative, and ffuf will keep turning up the same 403. All the server takes away is an excuse, namely a laptop battery dying halfway through the subdomain list.

Use month one for methodology, wordlists and policy reading. Rent the mid-range plan now and step up only when the workload forces you to.

Which plan are you on today, and what ate it up first? Maybe it was Nuclei running too many requests at once, Katana in headless mode, or a disk full of crawl files nobody opened.