Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [bug-bounty]

Related to design, workings and operation of bug bounty programs. DO NOT use for questions about specific vulnerabilities, attack methods or anything unrelated to the mechanics of vulnerability reward programs.

Filter by
Sorted by
Tagged with
1 vote
0 answers
41 views

Is it possible to exploit this supposedly boolean-based blind and time-based blind SQLi (sqlmap)?

I recently found a boolean-based blind SQLi and since I'm new to the bug bounty scene - I don't understand what impact I can extract from it. There is a website like example.com/tarif?tableId=136&...
Andrey's user avatar
  • 11
0 votes
1 answer
190 views

Is the vulnerability reporting to our website actually a scam? [closed]

An individual contacted us claiming that he discovered vulnerabilities in our website. He also showed his intention to show us detailed information about the vulnerabilities, including how to ...
sanba06c's user avatar
  • 123
0 votes
1 answer
120 views

Should bounties be paid for information exposure?

An ethical hacker found that a system I own, has an exposure of information. They were able to determine the programming language, a web framework and the exact versions of both from a stack trace by ...
Ben Johnson's user avatar
2 votes
2 answers
1k views

Anonymous unasked bounty hunter wants bounty for found issues

A bounty hunter reached out to us to give us information about a security vulnerability in our company's information systems. In our estimation, the risk of exploitation for this vulnerability is ...
SirDeg's user avatar
  • 23
0 votes
1 answer
581 views

XSS bypass in url

I have a website: https://bugbounty.com/test/"injection inside js", but " is escaped with \ and I'm trying to inject </script><script>alert() but https://bugbounty.com/test/&...
Edward Akina's user avatar
0 votes
1 answer
173 views

Facebook rejects a valid DoS'able vulnerability in WhatsApp - what should I do?

I found a vulnerability in WhatsApp which allows the attacker to temporarily lock you out of your account (which results among other things in a loss of productivity e.g. stemming from a loss of the ...
Artem S. Tashkinov's user avatar
13 votes
4 answers
6k views

Why do many companies reject expired SSL certificates as bugs in bug bounties?

I noticed that, while browsing through many bug bounty and vulnerability disclosure programs, they don't accept issues that are related to TLS/SSL, which includes expired security certificates. Why ...
user17886134's user avatar
2 votes
1 answer
2k views

How to provide public key for security.txt?

When generating a security.txt file, it is recommended to digitally sign it. However, security researchers must not assume that the information used in the Encryption field is actually the key used to ...
kolumbus's user avatar
1 vote
0 answers
383 views

How to reproduce following POC of dom based open redirection Vulnerability Flagged by burp suite scan

During scan, the burp suite flagged DOM open redirection vulnerability with the following POC. How can I reproduce it? Data is read from document.referrer and passed to xhr.send. The following value ...
Deathpoolxrs's user avatar
1 vote
1 answer
155 views

Impact of port scanning on the web domain itself

I was learning about port scanning and I understand, what, why and how. However, I do not understand why a Bug Bounty hunter or a penetration tester (strictly for web app assessment) would run a port ...
Just.a.tech's user avatar
0 votes
1 answer
114 views

Does the IDOR vulnerability have to be sensitive data?

I had a hard time convincing a bug I reported that it was a bug bounty program. It seems to be more of a discussion than a question. Scenario: Users shop on the shopping site. The categories of these ...
r1z4x's user avatar
  • 3
0 votes
1 answer
273 views

Is it possible to get xss in json body request?

I was doing a VAPT assessment in which I see some JSON body in the request which has orgid deviceid So there any possibility to get XSS in json body?
B3ingN00b's user avatar
-1 votes
1 answer
1k views

CORS attack using authentication token [closed]

I found a website which is vulnerable to cors.(https://portswigger.net/web-security/cors) GET /api/requestApiKey HTTP/1.1. Host: vulnerable-website.com. Origin: https://evil.com. AUTHENTICATION: ...
Cyber World's user avatar
0 votes
1 answer
189 views

What is the wisdom of using the ASCII function in exploit SQLi?

I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like: SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
Abdrrhmen's user avatar
1 vote
1 answer
3k views

CORS request is not sending Authorization: Bearer <value> header

When loggin in to a website, A Bearer token is generated and echoed back from the server in a JSON reponse. After this, each request sends the generated token in the Authorization: BEarer header. ...
mrrrvssmx's user avatar
1 vote
1 answer
195 views

Does .NET Framework have a bounty program?

The Microsoft .NET Bounty Program states that "Vulnerabilities in the .NET Framework, or any ASP.NET framework running on .NET Framework (Webforms or MVC)" is out of scope. Is .NET Framework ...
TN.'s user avatar
  • 153
0 votes
1 answer
146 views

Can I escalate a main domain SSTI/RCE to all the subdomains belonging to that domain?

I'm a newbie ethical hacker and bug bounty hunter. Lets, assume my target is somethingtohack.com, the thing is the company's scope defines that the main domain is out of scope, but subdomains like ...
Offensive Bug Hunter's user avatar
2 votes
0 answers
194 views

Does Windows Server ship with any sensitive images in the filesystem?

I'm working with an interesting vulnerability I found which enables local file inclusion (LFI) on a target server. In summary, there is a PDF generation API endpoint which accepts an HTML string as ...
Daniel's user avatar
  • 21
2 votes
1 answer
413 views

What to do if bug bounty program is unresponsive?

Over a year ago, I have reported a few security vulnerabilities to one of the top bug bounty programs on HackerOne. All of them have been quickly triaged as critical, but no progress was made towards ...
user avatar
1 vote
0 answers
254 views

Automating Clickjacking Attack

I found a clickjacking issue in a site and the site security team said me that i would require unusual user interaction. So I wrote a code above the iframe but I was not successful in achieving it. ...
None_None's user avatar
1 vote
1 answer
458 views

What are criteria and rules to determine bug bounty amounts? [closed]

How is the reward amount determined on different bug bounty platforms like Bugcrowd, HackerOne or Synack? As a bug bounty program owner I can maybe define some rules for the rewards. What are the ...
haba713's user avatar
  • 215
52 votes
3 answers
14k views

Could bug bounty hunting accidentally cause real damage?

If an application's code contains even minor and subtle inaccuracies, it can open up the entire database to SQL injection. In this example (see section 'Delete All Method'), the entire Users table ...
stevec's user avatar
  • 1,280
36 votes
4 answers
8k views

Why is social engineering often excluded from bug bounties?

I noticed a lot of companies do not have social engineering as in-scope of bug bounties/responsible disclosure guidelines, even though it is often used in real-world attacks. I understand that for ...
Z3r0byte's user avatar
  • 463
0 votes
1 answer
2k views

windows 10 showing me that bWAPP contains a reverse shell

i have downloaded bwapp from official site and windows 10 defender showing me that it contains a reverse shell ( i know these things are there for practice ) but in earlier days it is not showing that....
Dora's user avatar
  • 29
3 votes
1 answer
256 views

How to fairly pay out bug bounties without going over budget?

I work for a small company and for our webapp, we want to offer bug bounties for vulnerabilities reported with monetary rewards based on criticality. Problem is we only have a limited overall budget ...
Chimarr's user avatar
  • 53
0 votes
2 answers
1k views

How do I sell critical vulnerability info to private company? [closed]

Here is the story. There is a private company, that has some software product that is used by thousands of its customers. After spending few sleepless nights on reverse engineering that product, I ...
Titan's user avatar
  • 117
0 votes
1 answer
566 views

secp256k1 GPG key?

Given that secp256k1 is used to underpin the entire Bitcoin network (worth $174B as of today) -- it appears to offer demonstrably better security than other EC curves as no one has yet taken the ...
Jonathan Cross's user avatar
2 votes
1 answer
158 views

Platform Identification In Bug Bounty

What is the importance of identifying our target's web platform? I have recently watched the video 'DEF CON 23 - Jason Haddix - How to Shot Web: Web and mobile hacking in 2015' from youtube and he ...
Emanuel Beni's user avatar
-1 votes
1 answer
114 views

Sack team_id leaking in source code [closed]

I found slack team_id in vdp source code, is it a sensitive token if yes how can I use it for a PoC?
Mohd Shibli's user avatar
1 vote
0 answers
48 views

Report security vulnerability [duplicate]

I need to understand how to report a security vulnerability on a web application, given the website owners have no such bug bounty programs. Brief information on target: The website is built to ...
mykpc's user avatar
  • 21
-1 votes
2 answers
418 views

is passive mixed content actually exploitable?

i see everywhere posts of people saying mixed content like images could lead to an attacker replacing the images beeing loaded from http to https, however i couldn't exploit this after hours testing ...
Tomi Begher's user avatar
3 votes
0 answers
82 views

Bug in pay by phone screen accepts credit card information [duplicate]

I recently noticed some strange behavior in a pay-as you go mobile hotspot service when I was adding money to my account via phone. I forgot my pin so I guessed. I was wrong. I guessed again, and it ...
Sweasonable Doubt's user avatar
5 votes
1 answer
566 views

Is it bad practice to remove a resolved report from Open Bug Bounty archive? [closed]

An XSS vulnerability report was made via Open Bug Bounty, which was fixed, confirmed and a reward was made. The reporter has marked the issue was resolved. They have further offered to remove the ...
Joe's user avatar
  • 1,284
82 votes
5 answers
23k views

How to proceed with a white-hat hacker claiming a vulnerability?

I am a security member of a small company which recently got contacted by someone claiming to be a Hackenproof member. They were reporting on our website being indexed by googlebot (metadata, thin ...
Vcode's user avatar
  • 866
1 vote
1 answer
287 views

Probing Unsubscribe Link Vulnerabilities [closed]

I'm interested in testing the security of 'Unsubscribe' links embedded in emails sent to customers by large companies. I'm targeting companies participating in a certain bug bounty program, and my ...
jandek's user avatar
  • 11
0 votes
0 answers
30 views

Bug bounties - Reported a bug to a company nothing as been done [duplicate]

I've discovered a bug in an order page from big American company in April 2017. I've reported the bug to said company and they haven't done a thing, I email them from time to time but the bug is ...
R. Jay's user avatar
  • 1
13 votes
2 answers
738 views

How to deal with responsible disclosure "catch and kill"

My coworkers and I discovered a significant security issue in a popular cybersecurity tool, which shall go unnamed here for reasons that will become obvious. We reported the issue to the tool's ...
Jonathan Kamens's user avatar
5 votes
2 answers
7k views

What does Zerodium do with their bought exploits and bugs? [closed]

I came across the cybersecurity company Zerodium. They offer bigger bounties than most of the companies calling for bug hunters: Because of the bigger bug bounties, bug hunters sell their found ...
Nightscape's user avatar
0 votes
1 answer
256 views

Trying to learn bug-bounties, how do I use the practice sites like hackthissite and hacmebank?

Do I just attack those sites while they're live, or is there a way to download the site to attack offline? The reason I'm curious is because if those sites are vulnerable and being used for practice ...
Excrubulent's user avatar
3 votes
3 answers
281 views

How should we implement responsible discovery program internally only for our organization employees?

We experienced a very interesting phenomenon in the last 6 months and that is that some employees found and reported to our security teams few very crucial security issues. We were thinking about ...
Filipon's user avatar
  • 1,294
2 votes
0 answers
201 views

Ethical Hacking/Bug Bounty programs: Best way to get started professionally? [closed]

I am self-employed (degree in computer science) and I have been fighting a serious illness for the past several years (and still am) which makes it pretty much impossible to take on client projects as ...
khaos's user avatar
  • 121
2 votes
1 answer
176 views

CSRF Testing. Validation Error 422. Locale Required

So I'm testing this site for coursework and I think it might be vulnerable CSRF however when I try to make a post request I get a validation error which says "locale" is required despite me specifying ...
光量子's user avatar
1 vote
3 answers
1k views

Receiving a response that is PGP encrypted

I work as a software engineer, yet with limited experience in cryptography. I have a practical issue, not so much a technical question, related to a PGP-encrypted mail exchange I've had. Lately, I ...
user avatar
3 votes
0 answers
242 views

Is possible attack vector? [closed]

So I was bored and decided to get into some bug bounty hunting. I went on a website that has a bug bounty program and this website is for downloading apps. I went to the enter a gift card code field ...
Edward Severinsen's user avatar
8 votes
1 answer
428 views

Bug bounties - Shoud I report 0days in third-party components?

Assuming that: Vulnerabilities in third party components are not explicitly excluded in the scope of the program. The issue is reproducible in the specific target. Should I report the issue to the ...
Not Now's user avatar
  • 199
6 votes
1 answer
1k views

What are some options for a small company on a budget to maintain a bug bounty program? [closed]

I work for a B2B SaaS startup that doesn't have a lot of money (we're 6 people, 2 developers, have about 6 months of runway, and $25K monthly revenue, < 50 customers). Common advice that I've seen ...
Startup Security's user avatar
4 votes
1 answer
4k views

Function of %5c.. in a path traversal

I've recently come across this blog post of a bug bounty hunter. Apparently, a path traversal vulnerability was discovered, which looked like this: http://help.example.com/@app/skin/views/%5c../%5c....
Breakfast Serial's user avatar
1 vote
1 answer
691 views

Attacker can check external IP from a SSRF vuln?

I'm testing for SSRF vulnerabilities so my question is; can I check external IP (from another computer on the network) from a SSRF vulnerability?
Ben tester's user avatar
5 votes
1 answer
525 views

What is this user trying to do?

I work with a company that creates marketing software, we recently created a forum so we could talk with users who need support. I'm the main admin on this forum and a user, let's call them person1 ...
knocked loose's user avatar
1 vote
1 answer
1k views

Cross site styling vulnerability? [duplicate]

I stumbled across a "vulnerability" that allows me to include an arbitrary css stylesheet in a website. I understand that this is potentially a tool for csrf or stealing url parameters. But on its ...
ColBeseder's user avatar