Questions tagged [bug-bounty]

Related to design, workings and operation of bug bounty programs. Do not use for questions about finding and exploiting bugs in general, or questions that are not explicitly about vulnerability reward programs.

Filter by
Sorted by
Tagged with
82
votes
5answers
20k views

How to proceed with a white-hat hacker claiming a vulnerability?

I am a security member of a small company which recently got contacted by someone claiming to be a Hackenproof member. They were reporting on our website being indexed by googlebot (metadata, thin ...
36
votes
4answers
7k views

Why is social engineering often excluded from bug bounties?

I noticed a lot of companies do not have social engineering as in-scope of bug bounties/responsible disclosure guidelines, even though it is often used in real-world attacks. I understand that for ...
16
votes
3answers
2k views

Which companies facilitate payment in return for vulnerability disclosure?

If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from ...
13
votes
2answers
433 views

How to deal with responsible disclosure “catch and kill”

My coworkers and I discovered a significant security issue in a popular cybersecurity tool, which shall go unnamed here for reasons that will become obvious. We reported the issue to the tool's ...
8
votes
3answers
1k views

How to work effectively to win bug-bounties?

I really want to prove myself (to my parents) by winning a proper bug bounty How should I best prepare for this and go about actually finding bugs? Edit So can anyone give some web sites which ...
8
votes
1answer
255 views

Bug bounties - Shoud I report 0days in third-party components?

Assuming that: Vulnerabilities in third party components are not explicitly excluded in the scope of the program. The issue is reproducible in the specific target. Should I report the issue to the ...
6
votes
2answers
1k views

Why do several bug bounties ignore user enumeration?

While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
6
votes
1answer
576 views

What are some options for a small company on a budget to maintain a bug bounty program? [closed]

I work for a B2B SaaS startup that doesn't have a lot of money (we're 6 people, 2 developers, have about 6 months of runway, and $25K monthly revenue, < 50 customers). Common advice that I've seen ...
5
votes
1answer
425 views

What is this user trying to do?

I work with a company that creates marketing software, we recently created a forum so we could talk with users who need support. I'm the main admin on this forum and a user, let's call them person1 ...
5
votes
1answer
6k views

XSS in a jpeg file

I saw today this report: https://hackerone.com/reports/191380. There, the hacker uploaded a file with JavaScript in it, which he could successfully trigger that code. But I do not understand two ...
5
votes
1answer
282 views

Is it bad practice to remove a resolved report from Open Bug Bounty archive? [closed]

An XSS vulnerability report was made via Open Bug Bounty, which was fixed, confirmed and a reward was made. The reporter has marked the issue was resolved. They have further offered to remove the ...
4
votes
1answer
2k views

Function of %5c.. in a path traversal

I've recently come across this blog post of a bug bounty hunter. Apparently, a path traversal vulnerability was discovered, which looked like this: http://help.example.com/@app/skin/views/%5c../%5c....
3
votes
2answers
4k views

What does Zerodium do with their bought exploits and bugs? [closed]

I came across the cybersecurity company Zerodium. They offer bigger bounties than most of the companies calling for bug hunters: Because of the bigger bug bounties, bug hunters sell their found ...
3
votes
3answers
218 views

How should we implement responsible discovery program internally only for our organization employees?

We experienced a very interesting phenomenon in the last 6 months and that is that some employees found and reported to our security teams few very crucial security issues. We were thinking about ...
3
votes
1answer
116 views

How to fairly pay out bug bounties without going over budget?

I work for a small company and for our webapp, we want to offer bug bounties for vulnerabilities reported with monetary rewards based on criticality. Problem is we only have a limited overall budget ...
3
votes
0answers
79 views

Bug in pay by phone screen accepts credit card information [duplicate]

I recently noticed some strange behavior in a pay-as you go mobile hotspot service when I was adding money to my account via phone. I forgot my pin so I guessed. I was wrong. I guessed again, and it ...
3
votes
0answers
171 views

Is possible attack vector? [closed]

So I was bored and decided to get into some bug bounty hunting. I went on a website that has a bug bounty program and this website is for downloading apps. I went to the enter a gift card code field ...
2
votes
2answers
222 views

Contacting customers of vulnerable software, is it wrong?

Say you're a security researcher who finds vulnerabilities and reports them to vendors to try and receive a bug bounty. If the vendor is not willing to pay any bounty for any vulnerability, you simply ...
2
votes
1answer
52 views

Platform Identification In Bug Bounty

What is the importance of identifying our target's web platform? I have recently watched the video 'DEF CON 23 - Jason Haddix - How to Shot Web: Web and mobile hacking in 2015' from youtube and he ...
2
votes
1answer
56 views

Stuck in a tricky situation, not able to exploit misconfigured CORS

I found that this application has not properly configured CORS, an attacker can send requests from any origin and allow credentials header is also true. The idea was to extract CSRF token and then ...
2
votes
1answer
83 views

CSRF Testing. Validation Error 422. Locale Required

So I'm testing this site for coursework and I think it might be vulnerable CSRF however when I try to make a post request I get a validation error which says "locale" is required despite me specifying ...
2
votes
0answers
105 views

Ethical Hacking/Bug Bounty programs: Best way to get started professionally? [closed]

I am self-employed (degree in computer science) and I have been fighting a serious illness for the past several years (and still am) which makes it pretty much impossible to take on client projects as ...
1
vote
2answers
170 views

Password reset link vs Temporary password

Which is harder to exploit: Password reset link with tokens/timestamps/code/ticket etc Or, temporary password sent on user mail using which login can be done and password can be changed. Any ...
1
vote
3answers
384 views

Receiving a response that is PGP encrypted

I work as a software engineer, yet with limited experience in cryptography. I have a practical issue, not so much a technical question, related to a PGP-encrypted mail exchange I've had. Lately, I ...
1
vote
1answer
690 views

Cross site styling vulnerability? [duplicate]

I stumbled across a "vulnerability" that allows me to include an arbitrary css stylesheet in a website. I understand that this is potentially a tool for csrf or stealing url parameters. But on its ...
1
vote
1answer
92 views

Probing Unsubscribe Link Vulnerabilities [closed]

I'm interested in testing the security of 'Unsubscribe' links embedded in emails sent to customers by large companies. I'm targeting companies participating in a certain bug bounty program, and my ...
1
vote
1answer
452 views

Attacker can check external IP from a SSRF vuln?

I'm testing for SSRF vulnerabilities so my question is; can I check external IP (from another computer on the network) from a SSRF vulnerability?
1
vote
1answer
387 views

Worst-case scenario OPEN URL REDIRECTION and why google not covering it in bug bounty

OPEN URL REDIRECTION as per in my opinion can be proved very dangerous by crafting attacks such as phishing. But it seems like google thinks it as a very low level bug and does not provide any ...
1
vote
0answers
42 views

Report security vulnerability [duplicate]

I need to understand how to report a security vulnerability on a web application, given the website owners have no such bug bounty programs. Brief information on target: The website is built to ...
1
vote
1answer
2k views

Sql injection bypass against KONA(akmai) WAF

I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible. Parameter: query (GET) Type: boolean-based ...
0
votes
2answers
405 views

How do I sell critical vulnerability info to private company? [closed]

Here is the story. There is a private company, that has some software product that is used by thousands of its customers. After spending few sleepless nights on reverse engineering that product, I ...
0
votes
1answer
172 views

Trying to learn bug-bounties, how do I use the practice sites like hackthissite and hacmebank?

Do I just attack those sites while they're live, or is there a way to download the site to attack offline? The reason I'm curious is because if those sites are vulnerable and being used for practice ...
0
votes
1answer
35 views

Is there a term for vulnerabilities the need 'help' from target vs vulnerabilities that can be exploited with no actions from the target?

I'm making a guideline for a bug bounty program and want to distinguish between bugs that require some kind of action on the target's behalf (eg clicking a suspicious link), vs vulnerabilities that ...
0
votes
1answer
64 views

It's possible to trigger a XSS in url context without this following caracter ' : '?

I try to bypass a XSS filter to trigger a XSS in url context. But the problem this following char is blacklist ' :' The site allow the user to use some basic html balise like h1, h2, h3, p, a, u, etc ...
0
votes
1answer
33 views

windows 10 showing me that bWAPP contains a reverse shell

i have downloaded bwapp from official site and windows 10 defender showing me that it contains a reverse shell ( i know these things are there for practice ) but in earlier days it is not showing that....
0
votes
1answer
41 views

XSS on reflecting parameter

A website reflects the parameter I send, but the user input is accepted in the form of string. Hence whatever I search is reflected as <meta property="og:title" content="hello _userinput_ to xyz" ...
0
votes
1answer
131 views

What do i call this vulnerability Technically?

There is a site which hosts coding competitions for coding and placements. They issue certificates for winning the coding exam or at least get into the finale round. I did not participated in that ...
0
votes
1answer
143 views

secp256k1 GPG key?

Given that secp256k1 is used to underpin the entire Bitcoin network (worth $174B as of today) -- it appears to offer demonstrably better security than other EC curves as no one has yet taken the ...
0
votes
1answer
593 views

Is Session Fixation a tough one to resolve?

Just found session fixation vulnerability in couple of tech giants. Giving the steps I have done: 1. Login to your account in a browser (Browser 1). 2. Extract cookie using cookie extractor. 3. ...
0
votes
0answers
38 views

Can you classify the following exploit [closed]

If you go to the Apple bounty website you will see there are different bounty categories: iCloud: Unauthorized access to iCloud account data on Apple Servers $100,000 Device attack via physical ...
0
votes
0answers
33 views

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based)

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based) Hello, i try to bypass a CSRF protection Referer-Based. I know the basic knowledge to bypass ...
0
votes
1answer
67 views

SSRF Through Image Url

I am currently studying regarding SSRF. I noticed that an injection vector where SSRF might be present is always parameters that is related to url (Importing image using URL, others). I have ...
0
votes
0answers
49 views

How was this mXSS on Google Search carried out?

I was reading about bug bounties that have been reported in the past and this one caught my eye as it seemed interesting. Mutation XSS in Google Search According to what I could understand, this is ...
0
votes
0answers
116 views

Is SerializationException sign of Serialization/Deserialization vulnerability?

I am doing a bug bounty. I intercepted the POST request to the inscription in the target website. I modified the first name and last name POST params to inject bad char (in order to SQL inject) but ...
0
votes
0answers
55 views

how to bypass URL encoding on XSS [duplicate]

I typed following script on the search input on the website alert() but website converted this script into &lt;script&gt;alert()&lt;/script&gt; in HTML content, is there any possible ...
0
votes
0answers
26 views

Bug bounties - Reported a bug to a company nothing as been done [duplicate]

I've discovered a bug in an order page from big American company in April 2017. I've reported the bug to said company and they haven't done a thing, I email them from time to time but the bug is ...
-1
votes
1answer
42 views

Sack team_id leaking in source code [closed]

I found slack team_id in vdp source code, is it a sensitive token if yes how can I use it for a PoC?
-2
votes
2answers
185 views

is passive mixed content actually exploitable?

i see everywhere posts of people saying mixed content like images could lead to an attacker replacing the images beeing loaded from http to https, however i couldn't exploit this after hours testing ...
-5
votes
4answers
486 views

Should companies use Crowd Source Audit Platform for Manual Penetration Test?

As a CIO, CISO, CTO or Sys Admin, would you use a crowd sourced platform for penetration tests in order to improve your security issues? LE: So most of you guys downgrade, and said it's wrong to have ...