The original Winter Soldier Lego was a promo item in 2015 that came in an individual polybag. The only way to find him is on Lego resale websites or even ebay (if he’s under $10 most likely he’s fake.)
For Civil War Lego Bucky you can either buy the giant Super Hero Airport Battle OR Black Panther Pursuit (which I bought.)
UNLESS you just want a Bucky minifig (which I did buy to make Shirtless Lego Bucky) in which case you can Ebay. However Ebay has a prolific number of fakes (my rule is if the price is too good to be true then it probably is) and they can sometimes charge more than they should.
I use http://www.bricklink.com/v2/main.page to buy a lot of my Lego. There is less risk of fake Legos but pay attention to what the shipping costs are and what country each shop is based in. I try to keep all my purchases to one shop so that I get combined shipping as there aren’t many based in my country.