The people who get a place in the hall of fame or get acknowledged specifically for attacks like XSS, rce and some common type of attacks which can be detected by scanning tools such as owasp, Nessus, vega, etc. Do they report these vulnerabilities only? Or they find something apart from what the scans cant tell?

I'm new to finding vulnerabilities and need guidance, a dedicated enthusiastic and passionate person towards information security but no direction


Scanners are useful for a quick, basic security scan of a system to give indicators of vulnerabilities, their reports should never be trusted without validation and they often over report giving false positives.

It seems your question is geared towards bug hunting programmes / bug bounty schemes and if you just submit scanner reports to these programs you are unlikely to be acknowledged. In fact many schemes ban the submission of automatically generated reports if they even allow the use of such a tool, remember they could do that themselves easily!

The people that are successful in these programs, those that receive bounties or are entered in the halls of fame use other tools and techniques to discover vulnerabilities that won't be exposed by a standard wide spectrum scanner.

  • 2
    I got this that the scanners do give false positive results too. So, for example, in scanning XYZ web application using ABC scanner which is well known in the market too and which the XYZ company might/might not have used.Now when I do a scan I find 5 results from which 3 say that XSS is possible, I try implementing few commands to check if its possible or not.For example one of my commands generate a popup or something or If a positive reply then I report it? With the proof of possible execution? Is that what you trying to say? – Bruteforce Jan 23 '18 at 10:04
  • 2
    If you manually verify that an issue your automated scanner reports is real and poses a threat then it's fine to report that issue. These issues are generally low hanging fruit that get reported pretty quickly and there's a good chance any issue you find with a well known scanner has been reported already. Never just submit output from a tool without verifying it, generally it wastes the time of people on the receiving end. You should submit evidence, proof of concept and a description of the risk/impact. Also, remember scanning websites without the permission of the owner is illegal – iainpb Jan 23 '18 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.