The people who get a place in the hall of fame or get acknowledged specifically for attacks like XSS, rce and some common type of attacks which can be detected by scanning tools such as owasp, Nessus, vega, etc. Do they report these vulnerabilities only? Or they find something apart from what the scans cant tell?

I'm new to finding vulnerabilities and need guidance, a dedicated enthusiastic and passionate person towards information security but no direction

1 Answer 1


Scanners are useful for a quick, basic security scan of a system to give indicators of vulnerabilities, their reports should never be trusted without validation and they often over report giving false positives.

It seems your question is geared towards bug hunting programmes / bug bounty schemes and if you just submit scanner reports to these programs you are unlikely to be acknowledged. In fact many schemes ban the submission of automatically generated reports if they even allow the use of such a tool, remember they could do that themselves easily!

The people that are successful in these programs, those that receive bounties or are entered in the halls of fame use other tools and techniques to discover vulnerabilities that won't be exposed by a standard wide spectrum scanner.

  • 2
    I got this that the scanners do give false positive results too. So, for example, in scanning XYZ web application using ABC scanner which is well known in the market too and which the XYZ company might/might not have used.Now when I do a scan I find 5 results from which 3 say that XSS is possible, I try implementing few commands to check if its possible or not.For example one of my commands generate a popup or something or If a positive reply then I report it? With the proof of possible execution? Is that what you trying to say? Commented Jan 23, 2018 at 10:04
  • 2
    If you manually verify that an issue your automated scanner reports is real and poses a threat then it's fine to report that issue. These issues are generally low hanging fruit that get reported pretty quickly and there's a good chance any issue you find with a well known scanner has been reported already. Never just submit output from a tool without verifying it, generally it wastes the time of people on the receiving end. You should submit evidence, proof of concept and a description of the risk/impact. Also, remember scanning websites without the permission of the owner is illegal
    – iainpb
    Commented Jan 23, 2018 at 11:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .