1

I am a member in bug bounty platform. There are some programs that make their source code available to the hackers to find vulnerabilities. For example, their PHP, JS, C++, or ruby code.

I want to know

  • How Hackers sanitize these code to understand it?
  • How Hackers work to find vulnerabilities?
  • What tools they need (besides a vulnerabilities scanner)

closed as too broad by multithr3at3d, Steffen Ullrich, forest, ThoriumBR, Xander Jun 18 '18 at 21:27

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • sanitize for what? – Limit Jun 17 '18 at 1:35
  • And how does what work? The bug bounty programs or the tricks used to sanitize the code? – Limit Jun 17 '18 at 1:36
  • Sanitize the code source to understand it ,and How they work : I mean methodologie of that hackers , What does they do to try their code . – iheb hamad Jun 17 '18 at 9:17
  • Personally, I think this question is a little broad. You're asking - How do I analyse code for vulnerabilities it's not exactly as simple as that, you need to know what you're looking for you cannot just ask a question like this then all of a sudden know how code is vulnerable. It requires practice like anything else. I am flagging this for the reason listed above. – J.J Jun 18 '18 at 9:28
6

It largely depends on what it is you are trying to find bugs for. And I can tell you now that there will never be a one size fits all approach to this. Finding bugs in something like OpenSSL will be quite different than finding bugs for a public facing web application.

Since you mentioned bug bounty platform and a number of web scripting languages (maybe not so much C++), I would assume the platform is more for public facing web apps/sites than anything else.

In my experience with hacking web apps, if you have access to the source code, and even if you don't, the best place to start is with the mindset of: As an outside user, how can I make this app fail in ways that are beneficial to me.

You could start looking at what input you can and can't to send to the app. If you have access to the source code, you can kinda cheat and just go look at how the app handles user input. Perhaps the app just appends the input to a mysql query string. That would be a bug worth reporting.

Another place to look could be in how the app serves its content, a lot of web apps use misconfigured apache and nginx instances, but sometimes web apps serve themselves and people misconfigure that often too.

As far as tools go, you may be able to find some general tools for exploiting common web apps (like wordpress), but by and large you'll be writing your own tools. If the app's language and/or framework supports unit tests you could write some and execute it against a running instance of the source code.

The main takeaway from this post should be that there will never be a one size fits all approach to this. and if you want to be a hacker searching for bug bounties in web apps, your best place to start is by thinking: As an outside user, how can I make this app fail in ways that are beneficial to me.

Not the answer you're looking for? Browse other questions tagged or ask your own question.