Questions tagged [bug-bounty]
Related to design, workings and operation of bug bounty programs. DO NOT use for questions about specific vulnerabilities, attack methods or anything unrelated to the mechanics of vulnerability reward programs.
55
questions
7
votes
2
answers
2k
views
Why do several bug bounties ignore user enumeration?
While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
- 5,107
1
vote
1
answer
545
views
Worst-case scenario OPEN URL REDIRECTION and why google not covering it in bug bounty
OPEN URL REDIRECTION as per in my opinion can be proved very dangerous by crafting attacks such as phishing.
But it seems like google thinks it as a very low level bug and does not provide any ...
- 105
9
votes
3
answers
1k
views
How to work effectively to win bug-bounties?
I really want to prove myself (to my parents) by winning a proper bug bounty
How should I best prepare for this and go about actually finding bugs?
Edit So can anyone give some web sites which ...
- 199
-5
votes
4
answers
532
views
Should companies use crowd source audit platforms for penetration tests? [closed]
As a CIO, CISO, CTO or Sys Admin, would you use a crowdsourced platform for penetration tests in order to improve your security issues?
Google, Facebook, PayPal and other big companies have a Bug ...
17
votes
3
answers
3k
views
Which companies facilitate payment in return for vulnerability disclosure?
If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from ...
- 423