84 votes

Could bug bounty hunting accidentally cause real damage?

Can bounty hunting cause real damage? Sure. As you pointed out, some SQL injection vectors may inadvertently cause data deletion. Similarly, a persistent XSS attack may trigger in the browser of a ...
  • 43.9k
74 votes

Is demanding a "donation" before disclosing vulnerabilities black hat behavior?

To my understanding, this is no longer in line with responsible 'white hat' behavior. Am I right in this assertion? White (and grey/black) hat are vague terms. There is no fixed universal definition. ...
  • 10.9k
65 votes
Accepted

How to proceed with a white-hat hacker claiming a vulnerability?

To answer each of your questions: 1. Basically how to proceed or even should we? I recommend proceeding. You will be able to acquire valuable information that can immediately be put towards ...
  • 2,636
61 votes

How to proceed with a white-hat hacker claiming a vulnerability?

Hackenproof appears to be a website anyone can sign up for, so saying you're a member of Hackproof is equivalent to saying you're a member of Facebook. This is not an exclusive hacker group. There'...
  • 21.5k
57 votes

Is demanding a "donation" before disclosing vulnerabilities black hat behavior?

The researcher did not create the vulnerability and has not threatened to release or exploit what he has found. If you do not wish to pay for his work then don't and your company is no worse off than ...
  • 401
49 votes

How to proceed with a white-hat hacker claiming a vulnerability?

I don't know that there are any hard-and-fast rules here. Let's treat this as game-theory: What the researcher wants Usually: Public credit for the discovery, such as a CVE or a research paper. ...
47 votes
Accepted

Is demanding a "donation" before disclosing vulnerabilities black hat behavior?

I'm a bug hunter and I have no idea why everybody here thinks it's perfectly fine of him to attack your website without permission, determine a bounty amount himself, and threaten to hold back ...
  • 43.9k
44 votes

How can an administrator secure against a 0day before patches are available?

The person who discovers a security issue often reports it to the software vendor or developer first. This gives the software vendor time to fix the issue before publication. Then, after it is fixed, ...
  • 28.7k
34 votes

How can an administrator secure against a 0day before patches are available?

When a 0day is published, how can an administrator secure his application/website between the time the 0day is published and the patch is developed ? They use temporary workarounds until a patch ...
  • 64.6k
11 votes

Is demanding a "donation" before disclosing vulnerabilities black hat behavior?

He doesn't need to disclose- but he knew coming in during the second round you don't pay. So what is his motivation? You cannot know- so he is using that gap to create pressure on you to pay. However-...
10 votes

How can an administrator secure against a 0day before patches are available?

When a zero-day is released or published, it comes with more than just a fancy name and icon. There are details about how the zero-day is used to exploit the system. Those details form the basis of ...
  • 123k
6 votes

How can an administrator secure against a 0day before patches are available?

When a 0day is published, how can a whitehat secure his application/website between the time the 0day is published and the patch is developed? Sometimes there are workarounds which fix or mitigate ...
  • 48.9k
6 votes
Accepted

Penetration Testing Methodologies

When referring to black, grey and white hat the following is the definition: White - A hacker who is hacking for profit with permission in order to test a system (This is called a penetration tester). ...
5 votes
Accepted

White hat "ethical" hacking legality

You appear to be thinking that actions have universal goodness or badness. This is not true. A white hat hacker, or a security manager, has permission to do what they do. That is the biggest and most ...
  • 123k
4 votes
Accepted

What is an 'Orange team'?

There are a number of companies that do this. Typically, the organization defines the scope of the team, clearly defines the activities, trains and supervises. I have seen it done as part of the ...
  • 123k
4 votes

Could bug bounty hunting accidentally cause real damage?

Your question appears to assume that the attacker in question is working against a production system. To Fire Quacker's point, if you break someone's production system you're just as liable as any ...
3 votes

Does black hat always equal illegal?

You are missing the point: government-backed attacks are illegal within the target's jurisdiction. "Black Hat" means intentional, unapproved harm to the target. The rest is an ethics ...
  • 123k
3 votes

How can an administrator secure against a 0day before patches are available?

Another key defense is monitoring, and knowing your system. Where are your valuable secrets, and who has access to them. If someone tries to connect to your mail server on port 80, red flag. Why is ...
  • 518
2 votes

How can an administrator secure against a 0day before patches are available?

Relatively few hacks allow the attacker to break into a system. Most are "privilege escalation" bugs that allow an attacker to have greater control over the system after they have access to it. There ...
  • 1,116
2 votes

Understanding a Burp Capture

Passwords are not encrypted inside a POST request. If any encryption is done it is either at the transport layer (i.e. HTTPS instead of HTTP) and/or there is some application specific client side ...
1 vote

Could bug bounty hunting accidentally cause real damage?

Robust systems should not only resist attacks but demonstrate viable recovery mechanisms. The cost of bugs may be less than bad design. Do you have logs? Can you use them to recover quickly? ...
  • 11
1 vote

White hat hacker asks for account to do penetration tests

As MechMK1 mentions, this is just a scam. They are not a White-Hat hacker because that is not how they operate. I did want to mention something I have heard referred to as "grey-hat hackers." These ...
  • 9,206
1 vote

How to proceed with a white-hat hacker claiming a vulnerability?

I might be worth noting they are likely pretty new to this too, there are plenty of 'pros' and if that's how you make a living, you likely have a process, but that normally involves some agreement ...
  • 230
1 vote

How can an administrator secure against a 0day before patches are available?

The problem is not only with zero-days. There are plenty of companies which still drag on 200-days patches for a multitude of reasons (some good, some bad). You have a large list of solutions, ...
  • 8,957
1 vote

What is an 'Orange team'?

There's not a lot of information out there about what specifically the scope of google's orange team is or what they've done (kind of obvious why...), but in general there are two kinds of penetration ...

Only top scored, non community-wiki answers of a minimum length are eligible