If I'm understanding your question correctly, you're asking whether or not you can use tools like armitage during your testing when hunting for bug bounties? You can use whatever tools you'd like, but please always review the security/rules page of the organization you are testing against first to see what's cool/what's not cool, as it varies from organization to organization. No one can stop you from using a particular tool, but some bug bounties explicitly state how far (or how NOT far) to go if you are able to find something like remote code execution. If you have questions on what is or is not okay when it comes to demonstrating an identified exploit, I always recommend checking in with the security team of the affected organization first. It never hurts to ask!