They look for weak spots in companies’ online armor. For most, it’s a side job