#bug-bounty

1 messages · Page 4 of 1

fast fable
#

Not really, I genuinely am not - but thanks anyway

abstract token
#

No problem at all

#

Idk I was really nervous, I am thinking of sending them a message asking them to reach the security team to inform them about a potential risk I found by accident that could lead to severe disclosure

#

@fast fable

fast fable
#

it's lovely that you are concerned, but all you can do is just alert them about it - due to the nature of them having no VDP, you can't do anything else

#

have to move on

worthy folio
#

it can also be /.well-known/security.txt

dusky solar
#

22xks

stray tapir
#

if I'm not mistaken that's what the rfc says

worthy folio
lavish hollow
#

@sacred prism please do not post random IP addresses and ask people to hack it. If this happens again you will be banned

sacred prism
void nova
#

Hi all, I am trying bug bounty but so far not getting the bug or even bounty so like to share my methodology and I am thinking to improve it from you all (newKid)

  • subdomains : sublist3r / Amass sometimes - find some subdomains any possibilities to takeover
  • Xss , but most of the site comes with xss-protection now a days so its very hard - without protection will use some wordlist on the paticular area using burp to find out but nothing comes out
  • IDOR, trying IDOR but mostly UUID now a days
  • CSRF, added as out of scope
    so any other technique or method or any type of bug easy for beginners please let me know will try other than this what can I try, thanks
lilac spindle
# void nova Hi all, I am trying bug bounty but so far not getting the bug or even bounty so ...

For subdomains, use a tool like Aquatone or Gowitness to get screenshots of the websites. IDOR can still exist with UUIDs. Create two accounts to do A/B testing, then the only problem you’ll need is how you can get another one’s UUID. XSS is lucrative, and can work in different contexts so always look at sources and sinks.

Focus on logic-based access control vulnerabilities. Is User A able to view/change/delete User B’s data?

void nova
uneven galeBOT
#

Gave +1 Rep to @lilac spindle (current: #24 - 349)

proven dune
#

Any tips to weaponize open redirect and have a high impact ?

fast fable
#

Can you redirect to a JavaScript URI?

fast fable
#

Or, a GET request that performs an action on the site when logged in

winged vessel
#

Hi guys
I have got a host header injection in a dummy website but now I want to get SSRF but what's happening is in the response content.html is being concatenated on the payload and that's why it's not working
Any suggestions here please?

robust lava
# void nova Hi all, I am trying bug bounty but so far not getting the bug or even bounty so ...

For subdomains you can try wayback machines data. Just, don't trust Status code on output from tools. Try to check the interesting subdomains manually.

For XSS, try to find where is your data reflect on page/dom.

For IDOR, don't just check for user id. There are lots of ID used on web apps, like Order ID, address ID.

And, you can try with VDPs first to find valid buga and grow your confidence.

void nova
#

Hi all, one doubt lets say I have two user A and B , I can view the info of them in an API, if I set userB's sessionId and session to userA and still I get the user'sB info on that API means it is vulnerable?
note: user A and user B are in different profiles

tired surge
#

I would have thought it would be vulnerable if user b could get users A info. user b still getting their own info when trying someone else's credentials is what we would want no? (I could be wrong, I'm new here moros )

lavish hollow
#

Depends on the info though.

void nova
uneven galeBOT
#

Gave +1 Rep to @lavish hollow (current: #6 - 1189)

void nova
fallen palm
#

this script:

<html>
     <body>
         <h2>CORS PoC</h2>
         <div id="demo">
             <button type="button" onclick="cors()">Exploit</button>
         </div>
         <script>
             function cors() {
             var xhr = new XMLHttpRequest();
             xhr.onreadystatechange = function() {
                 if (this.readyState == 4 && this.status == 200) {
                 document.getElementById("demo").innerHTML = alert(this.responseText);
                 }
             };
              xhr.open("GET",
                       "https://www.compass.com/account", true);
             xhr.withCredentials = true;
             xhr.send();
             }
         </script>
     </body>
 </html>
gray adder
#

what is the point of bug bounty (from the company perspective) when the program forbids utilizing common vulnerability types like csrf, brute forcing etc?

little meteor
#

not paying for QA

fallen palm
#

why is this not working?

image.png image.png
#

it gives back an undefined value

#

is it even vulnerable?

fast fable
#

So not really worth the hassle

modest vector
#

@fallen palm Please don't post a target link, as it is not a THM room.

fallen palm
#

sorry

void nova
# void nova Hi all, one doubt lets say I have two user A and B , I can view the info of them...

reply from hackerone:

Thanks for your report. Based on your initial description, there do not appear to be any security implications as a direct result of this behaviour.
This is expected behavior — if you have another user’s session information/token, you should be able to hijack their session.
If you disagree, please reply with additional information describing your reasoning. Including a working proof-of-concept is the best way to convey the impact of this report and will streamline our assessment of your claims.

expected behavior ? , is this true

simple jewel
#

You could make an argument that there are additional steps they can take to make the hijacking harder, but I think unless you can provide a proof of concept where you can steal some user's session token (without having it from owning the other account), they won't bother.

gray adder
#

I don't get how do people find so many vulnerabilities, I've started looking at some VDPs, and even websites that literally have no account feature (just static sites with a form to subscribe for something) have already dozens of reports submitted. How do I know if it even makes sense for me to participate in VDP? It feels like you have to really be a pro to find anything "in the wild"

lilac spindle
#

Then there’s also people who have automation set that when a new program goes public they instantly run scanners and tools to get those easy low hanging fruits.

gray adder
#

I mean - I don't even understand where these websites could have so many vulnerabilities, sometimes it is just a static website/blog with contact form and that's it

#

I get that I'm a beginner so I don't know much beside basics like SQLi, XSS, IDOR, broken access control etc, but still

#

maybe I'm missing something

lilac spindle
#

The vulns still need to be triaged, those can be just BS vulns that people submit with no real impact, so its hard to gauge if all of those are BS or legitimate.

woeful horizon
#

How do we implement CSP in Odoo 10 without unsafe inline and unsafe eval ?

fallen palm
#

Hello anyone know who does raw bug bounty on targets on yt or discord server, twich to watch and learn i want to see their methodology so if anyone knows please do let me know. 😄

gray adder
#

i guess nobody does bug bounty live since the point of bug hunting is to disclose vulnerabilities privately

tired surge
#

NahamSec on youtube does some live stuff, mainly recon id assume

#

havent watched much of his stuff as I'm no way near jumping into bug bounty yet, but he's been on my periphery

fallen palm
#

should i report a bug just if it allows brute force password attacks or do i need to crack it first?

fallen palm
unborn ice
#

Are you checking the scopes for bugbounties?

#

I'm sure there are some which don't allow bruteforcing

fallen palm
lilac spindle
fallen palm
lilac spindle
fallen palm
#

Ok

abstract token
#

hello guys

abstract token
#

are exposed sensitive files like config files, .git considered pentesting? since they are already exposed my the server!

lilac spindle
abstract token
#

no was trying to tell someone he has exposed files so he takes care

paper kiln
atomic stream
#

Hey!

#

So I am exploiting a time-based SQLi. For this I am using cluster bomb to find each character of a password string.

#

The problem is that it is getting impossible for me to find a way to let burp suite know to don't send anymore response for a already found brute forced

#

From the response time I can manually see which character is at what position but burp suite doesn't know this

#

A thing I could do is write a script but I am not confident enough

#

Can someone help please?

atomic stream
lilac spindle
atomic stream
lilac spindle
#

You iterate over this till you get something successful, then you have your character length. Now, just bruteforce the amount of characters you found. If the length is 5, just stop after 5 characters.

hybrid orchid
#

Or use a binary search and save yourself a tonne of time rather than iterating over it...

atomic stream
#

The only was to dump the contents of database is by retrieval of each character a time and check if condition for that character is true

hybrid orchid
#

Again, binary search should speed that up

surreal karma
#

Title: DOM-Based XSS (Prototype Poisoning) Vulnerability in ‘/home/search-results' Page

Description:

This report addresses a vulnerability of DOM-Based XSS (Cross-Site Scripting) attack via Prototype Poisoning. This occurs when a script takes user supplied input and passes it to a property, which has been overridden by an attacker. The attack manipulates JavaScript's prototype-based inheritance, leading to arbitrary JavaScript code execution within the user's browser.

Location:

The vulnerability was identified on the ‘https://www.target.com/home/search-results’ page.

Exploitable in both search input fields on the page.

Steps to Reproduce:

Visit the vulnerable page.
Utilize DOM Invader to inject a JavaScript canary string into the DOM, thus poisoning prototypes.
POST JavaScript payload in search query.
Evidence:

Two sinks were found to be vulnerable to this attack:

setTimeout (prototypepollutionhitCallback)
element.innerHTML (<style type=”text/css”></style>)
The page contains two search fields to query for articles on the site. Using the Prototype Poisoning technique, a canary string was used to identify potential DOM-Based XSS vulnerabilities. On page load, both of these sinks are triggered and are immediately exploitable with no further stages needed, other than modifying the canary string to execute arbitrary Javascript code.

In this case, the first XSS injection was of the function ‘alert(’DOM-based XSS successfully exploited!’) upon the setTimeout prototype pollution, to trigger an alert function within my own browser. From this point, an attacker in this position would have the opportunity to leverage this much further.

[image1.png]
I decided to reproduce on the same page, to ensure this wasn’t just an edge case or a cosmic ray :)

[image2.png]

Impact:

This vulnerability is high risk, as it allows an attacker to execute arbitrary JavaScript code in the user's browser. This can potentially lead to the theft of sensitive information, such as session cookies, and allows the attacker to perform actions on behalf of the user.

Recommended Mitigation Steps:

To mitigate this vulnerability, it is recommended to:

Validate, filter, and escape user input before using it as a source in your scripts.
Identify the sources of user input and the sinks where this input ends up.
Implement a strong Content Security Policy (CSP) to reduce the impact of any potential XSS vulnerabilities.
Regularly update and patch all systems to protect against known vulnerabilities.
Consider using frameworks that automatically escape XSS by design, such as React JS.
Ignoring such vulnerabilities may lead to serious security breaches and a loss of trust from your users.

lilac spindle
#

Looks good, you can also add in using vetted third party libraries such as DOMPurifier to handle those cases but that’s just my opinion.

One thing I’d like to point out though that while the impact is true for XSS, try to relate it with their application. Like what can you do after you steal a session? Can we do some nasty stuff with it? Etc.

#

Like for example, if its a banking app, can you transfer funds from other users to your account?

surreal karma
#

That’s great thank you for that. They’re a very large company in my country, website is bound to have high traffic count and also boasts a shop on the website. I’ll reference that too! Thanks again! pepelove1

#

So happy to get my first bounty

whole kelp
#

Hello everyone, if a target is using PHPSESSID as a cookie is it safe or is there any chance to manipulate that ?

fast fable
whole kelp
#

@fast fable sure , someone suggested to try to find the pattern this cookie is based on do you have any idea about how it's created ?

fast fable
#

Not feasibly possible, it's a hash of a range of items like the IP, timestamp etc

whole kelp
#

@fast fable oh ok, so i should focus on xss instead of trying to crack that thing

#

it's not fixed anyway when i log out and login back it changes for the same user

fast fable
#

See if you can use the old value when it changes

whole kelp
#

yeah ill try that

#

so what i noticed is that whenever you log in it changes but when you log out it doesn't

#

i logged in copied the current one changed it with older one it logged me out when i put the copeid when im logged in again is this normal behavior?

fast fable
#

Sorry, not quite sure I understand

#

Are you saying you can login with the old one?

lilac spindle
whole kelp
#

@fast fable simply i login and change the cookie , the account logs out when i set the original one i logged in with it logs me in

#

i guess it's not an issue like @lilac spindle said

acoustic ore
#

that is precicely what Mknukn said?

whole kelp
#

hello , i found an xss the waf is blocking me when i put () or `` , but it doesn't block me when i put something like this <img src=x onerror=alert(636 /> neither when i put [] is there any bypass for this ?

dreamy nest
#

what is the best bug bounty platforms for beginner?

lapis linden
fleet scroll
#

Quick question, If you are able to bypass an admin panel but all thats behind it is defunct/non working features is that still worthy of a report?

plain minnow
#

I want to ask a question? I participated in a bug bounty program and ı wrote bug bounty report and I sent a report but My report was answered negatively. I placed xss payload in report content html source code Afterwards I placed the document.cookie function in the payload and ı saw positive I encountered positive results and i reported it. my report was rejected why? Isn't this a weakness?

fading sky
plain minnow
#

It may be due to self xss

#

but in scope

next nova
#

Hey
If I found a Heroku Api Key in a JS file what can I do with it ?

dreamy nest
# next nova Hey If I found a Heroku Api Key in a JS file what can I do with it ?

Lots of my brothers asking me about what to do after finding secret keyss here you go guyssss...
use this bash script and check all api keys valid or not after that you can report 🙂

https://github.com/gwen001/keyhacks.sh

GitHub
GitHub - gwen001/keyhacks.sh: Automation of tokens/api keys testing.

Automation of tokens/api keys testing. Contribute to gwen001/keyhacks.sh development by creating an account on GitHub.

surreal karma
surreal karma
#

When I manage to find a dump of 50k+ api keys, testing single entries are a nightmare. Tbf I should just make something to do myself 😂

long dagger
#

I cant understand blind xss

#

It very complicated

#

I do understand normal xss

candid bridge
#

if im able to bypass the capcha test, would that be considered a vulnerability

wild hatch
#

(Turned off ping because im a new hacker and would rather let someone more knowledgeable ping you with the answer)

lilac spindle
#

Think of it further; what can happen if this captcha is bypassed? Is there other ratelimiting in place that will lower its impact, etc.

surreal karma
#

Using callbacks from things like xsshunter will help you find hits with blind

#

Just need a domain to point it to

#

And an smtp if you wanna be fancy

#

So imagine you have an order portal on a website. You find you can break out of an element in the input field of your payment details or delivery notes. You inject your xss payload into that. The staff who view that page with the delivery note on will get hit with the xss

#

XSSHunter will notify you of any hits

#

Really useful with Hunter as it also records the dom at the time of execution

#

Meaning you can get easy escalations to sensitive information exposure

#

Blinds are a great way to get P1’s

#

this should help you, really good video on blind - goes over everything i mentioned https://www.youtube.com/watch?v=MjtMLbRw0lI

YouTube
NahamSec
The Beginner's Guide to Blind XSS (Cross-Site Scripting)

🚩Signup for Snyk's CTF 👉🏼 snyk.co/nahamsecctf

📚 Purchase my Bug Bounty Course here 👉🏼 bugbounty.nahamsec.training

XSS Hunter:
https://github.com/mandatoryprogrammer/xsshunter

Trufflehog XSS Hunter
https://xsshunter.trufflesecurity.com/

💵 Support the Channel:
You can support the channel by becoming a member and get access exclusive content,...

▶ Play video
long dagger
#

I watched this video before You even list it

#

Nahamsec is the best in bug bounties

long dagger
uneven galeBOT
#

Gave +1 Rep to @surreal karma (current: #616 - 6)

long dagger
#

hi

#

every time i turn foxyproxy on in firefox tell me this

Capture.PNG
#

its very annoying

#

i cant intercept anything in burp suite

acoustic ore
#

You need to add burp certificate to firefox

long dagger
#

how to do it?

#

im a beginner

#

so idk anything

#

wait nvm

#

i did it

surreal karma
surreal karma
long dagger
#

im in a website that is very hard to run xss on

#

im ethical btw and its an offical hacker1 bug bounty program

surreal karma
#

Quick tip: don’t go in looking for specific vulns, you give yourself a harder job.

Map out a threat model for your target, the vulns will come to you once you get an idea of the lay of the land that you’re targeting

#

Ask yourself, what is the target, what information will they have, what information is important/sensitive, then find out how they handle user interaction, how is data stored & received, where is it stored n received etc

#

Work your way in with your scopes set

#

Enumeration is key, find secrets, improper access control, leaked information, api endpoints etc

long dagger
#

i can now inject xss code in password query

acoustic ore
#

Also maybe dont send session info here

unborn ice
#

@long dagger if you're doing an active bug bounty, that's fine, but please don't share any URL's etc.

long dagger
long dagger
waxen crypt
#

hi guys im currently trying some vdp and i found a JWT that possible revels information about the user

#

do i submitt the report for this or no? and is not that cookie is alot of them

next nova
#

If when I inject an XSS payload "><img src=x onerror=alert(document.domain)>{{7*7}}' it tells me 500 Internal server error can I do something with this ?

long dagger
#

Im not very professional im bug bounty

#

So try to google it

cunning heart
#

here is a quick bug

#

in one of google Easter eggs named google doodle there is a NPC in one of there doodles when you talk to a spsaific NPC then go to some trophy thing and interact you get that what the NPC says and

#

then...

#

YOU GET THAT HINT THAT TAT NPC GAVE YOU (i had some grammer mistakes on this part)

cunning heart
#

here is another glitch (not a bug): i create glitche in the terminal to create my own terminal features

candid bridge
#

I found a vulnerability that allows me to leak other users first names using their email address. The first names of the other users is inaccessible from the site. Is this enough to report?

#

I justify it like this:
Can lead to Phishing and Other further Attacks:
Attackers can utilize the leaked names of users to send more convincing phishing attacks to their email address
While the immediate impact might seem minimal, this vulnerability could potentially be combined with other vulnerabilities or data sources to do further damage
Privacy Breach:
First names are considered personal information and their unauthorized disclosure violates user privacy
Reputational Damage:
Any breach of privacy damages the reputation of the affected organization. Users expect their personal information to be handled securely

still jasper
#

Yea, i would say it’s worth reporting as it will come under unauthorised disclosure

fallen palm
#

Zord:
q = GqlQuery("SELECT * FROM ArtistFan WHERE artistid = :artistid ORDER BY " + sortby + " OFFSET " + str(offset),artistid = artistid)

BadQueryError: Parse Error: Invalid ORDER BY Property at symbol '

Found this error through a GET request. Any idea how it can be exploited

brisk shuttle
#

can someone help me with this xss </TITLE><SCRIPT>alert("XSS");</SCRIPT> whenever I put this the website accepts it but it doesn't show an alert

fast fable
#

have you whipped out inspect element to make sure its actually being embedded

brisk shuttle
brisk shuttle
fast fable
#

Double click it

#

It's probably just being treated as text

brisk shuttle
#

I did it didn't open @fast fable

fast fable
#

Can you show a ss

brisk shuttle
#

yea

#

everytime I put the payload it returns this

xss_.png
#

@fast fable

#

I got it

#

I have a question

#

@fast fable

fast fable
#

Just ask

brisk shuttle
#

k

brisk shuttle
fast fable
brisk shuttle
#

no I mean like if the payload I put isn't anywhere to be found in the inspect element does that mean it isn't a rxss

fast fable
#

Sure

austere rapids
#

Hi

#

I have a issue

#

What are sites of hunters you are in ?

deft hedge
#

Does anybody have a recommended template for submitting bug bounties for android or in general for bug bounties?

austere rapids
deft hedge
austere rapids
#

on domain apk android

fast fable
#

@austere rapids Enough, please just start learning on tryhackme before attempting bug bounty

sharp grotto
#

what is the best platform or course to learn bugbounty cert doesnt matter for me as much as gaining the actual skill to start hunting on platforms like bugcrowd and hackerone

acoustic ore
sharp grotto
uneven galeBOT
#

Gave +1 Rep to @acoustic ore (current: #833 - 4)

south bluff
# sharp grotto thank you

I'd also recommend HTB Academy's bug bounty path. It's not free, but it is very good information. THM also has a web exploitation path I think

sharp grotto
south bluff
#

yeah, they have a good one for bug bounty too

austere rapids
rotund sequoia
acoustic ore
rotund sequoia
uneven galeBOT
#

Gave +1 Rep to @acoustic ore (current: #709 - 5)

rotund sequoia
#

im going along for OSCP and CCBH

#

i will give it an eye

acoustic ore
rotund sequoia
#

so yeah

#

i can give this course a try meanwhile i do eJPT

#

anyway is this even better than CBBH?

sharp grotto
rotund sequoia
cedar patrol
#

Hello, I am new in this bug bounty field. I have submitted two reports on hacker1 but they weren't valid. I have taken many courses on practical bug bounties. but I am stuck after the recon part. What should I do?

austere rapids
spice lily
#

what type of bugs are you reporting

#

after recon, identify all functionalities, think what attack is possible on that functionality and test it, do it until all functionality is tested

cedar patrol
cedar patrol
stuck spear
#

Guys, I am doing bug bounty on a domain and this is a sample request I intercepted using burp, I think this request takes a query parameters and then on the backend makes another request by adding the query parameters from the original request to another request:

Request: GET /abc-service/abc/profile/getOrganization?empId=499000%20%20+&1=2
Here, the thing is, 499000 is the empId but if I add a whitespace or addition operator or ampersand (&) in the query parameter's value then it gets accepted and response is shown, but if I provide anything else it results in an error, first there might be a chance of SQLi but it returns error on other character..
How can I move forward from here?

south bluff
unborn ice
#

Providing

fringe lantern
#

Hi, is there any certification I can take as a bug bounty beginner?

manic kestrel
surreal karma
next nova
#

Hey if my Burpsuite is detecting Cross-origin ressource sharing : arbitrary origin trusted does anyone of you know how to exploit it ?

acoustic ore
#

:Dd look into the new room. this is not necesarely a security issue

rotund sequoia
#

question for bug bounty hunters , do you always use burpsuite?

unborn ice
#

Not always.

Owasp ZAP is a adequate alternative.

rotund sequoia
uneven galeBOT
#

Gave +1 Rep to @unborn ice (current: #1 - 2187)

fast fable
hollow thistle
#

would you guys put your real name and linkedin profile in a big company hall of fame page, as a reward for a reported bug?

fast fable
#

Good clout

#

You could ask if you are able to use your aliases instead

rotund sequoia
fast fable
#

No

hollow thistle
unborn ice
#

IIRC Frostbite is in the Microsoft Hall of fame as his discord handle.

May be wrong, can't find them to ping.

hollow thistle
unborn ice
hollow thistle
#

So you think you'd avoid using real name?

unborn ice
#

Depends on your opsec.

fast fable
#

@hollow thistle I'd probably put my aliases in and then mention it in my CV

fast fable
hollow thistle
unborn ice
fast fable
#

Any specifics?

cedar patrol
#

Hey umm a doubt, what if I report that a website is working with much lower version. for example there is a website which is using jquery of version 3.3 which have couple of vulnerabilities. As a rectification for that vulnerability it should be upgraded to version 3.5.

What will happen if I submit this as a bug?

lilac spindle
#

but usually theres not much impact afaik, theres a lot of niche bugs i think on that version but not much to be worried about

cedar patrol
hollow thistle
still jasper
cedar patrol
#

Okk. Thanks for the input..

austere rapids
#

Hi everyone, I had a doubt, when exploring my targets the subdomains that I have to look for are those that are in scope, but why do some hunters use subdomains in gobuster, subdomainfinder, dirsearch etc mmm???, shouldn't I just look for what are in scope???

lilac spindle
austere rapids
austere rapids
lilac spindle
austere rapids
uneven galeBOT
#

Gave +1 Rep to @lilac spindle (current: #22 - 366)

dreamy nest
dreamy nest
cedar patrol
cedar patrol
dreamy nest
#

the problem of nmap is that slow, there is other tool like naabu do same nmap but in fast way

manic kestrel
cedar patrol
cedar patrol
manic kestrel
#

Okay

hybrid orchid
#

That's rhetorical. It's because you're impatient and want results quickly, but haven't considered the possible implications of hitting your target with a lot of traffic quickly.

#

There's a reason that nmap is still the standard in industry despite faster options being available -- it's because denial of service attacks are nearly always out of scope (both for pen tests and bug bounty), and if the target isn't properly protected then you are significantly more likely to bring it down by hitting it hard.
Also significantly more likely to cause an incident in their SOC which is a waste of a lot of people's time.

#

i.e. it's reckless, stupid, and shows a dangerous lack of experience of testing in a real world context.

hybrid orchid
cedar patrol
shrewd ocean
#

The order may depend on what you have found. You can either continue or keep enumerating.

#

So no biggie

hybrid orchid
cedar patrol
#

trying every methodology.. all the orders

shrewd ocean
#

For web, I'd start with Google dorking and then look for subdomains. Then perhaps directory searching.

#

Before fuzzing, you can look at the web archive. More effortless and less noisy

cedar patrol
#

fuzzing is mainly for directory search right? or it helps in much more !!

shrewd ocean
#

Yeah and for subdomain. Don't forget to limit it tho

austere rapids
shrewd ocean
forest talon
#

Any good try hack me pages to improve on google dorking?

unborn ice
dreamy nest
hybrid orchid
#

So, impatience reeking of recklessness. Wonderful.

Setting a rate limit for it is good, but at that point you're removing the "benefit" of using a faster tool lmao.

tiny sail
#

hello

#

need a help like i have a admin panel here i type admin:admin it said nice catch try harder with some gif . Kindly help me

unborn ice
tiny sail
unborn ice
tiny sail
#

like this

unborn ice
tiny sail
unborn ice
tiny sail
#

basically a challenge given by college

tiny sail
tame sirenBOT
#
<#651923438524432404>
Rule 5 - No Cheating

Cheating of any form is not allowed. This is not limited to asking for help with assessed schoolwork or exams.

TryHackMe Rules ·
unborn ice
fading sky
#

I just saw a post very similar to that one posted in the TCM Security discord. 😅

stray tapir
#

why are path traversal bugs so popular all of a sudden?

elder vigil
#

hey guys, i pushed this question on another channel, and a helpful mod told me to ask here

#

that said

#

has anyone here done bug bounties before? going for a sanity check, but what is some down-to-earth advice you can give for someone potentially starting on bug bounties? it seems like a promising side hustle, but i like to believe such things don't come easy

#

in addition to, what is some prerequisite knowledge i need? i need to checklist if im ready for this sort of thing

#

i also need some statistics! for the much more experienced bug hunters, how many successful submissions do you get in a month or a year?

lilac bough
# elder vigil has anyone here done bug bounties before? going for a sanity check, but what is ...

How I would approach this would be to pick a topic here https://portswigger.net/web-security/all-topics , learn about a specific bug (xss or idors for example), then once you are done with the labs put that newly acquired knowledge to use on a VDP . You will have less competition on a VDP compared to a BBP. Get some valid submissions on a VDP, that will boost your rep, and also unlock the potential for private invites, which will also have less competition on them. After about a month of hacking/ hunting go back to portswiggers and learn a new vuln, rinse and repeat...

All Web Security Academy topics | Web Security Academy

An overview of all topics, from beginner to expert level, through the Web Security Academy - brought to you by PortSwigger. Create an account to get started.

#

Also I wouldn't go in with the mind set that you will make a living off bug Bounty, I would do it for the knowledge itself and the money will follow...

#

There are also several bug hunting checklists out there, google will be your best friend for this

unborn ice
#

Even if you get dupes, you're still finding bugs

elder vigil
#

yeah i was talking to professional in the red team field a week or two ago

#

and he suggested bug bounties as a good project to make my resume stand out

#

while the money is creepypog im mostly just there to learn. cash is just a bonus

lilac bough
#

Me personally I like to hunt on programs with wildcard domains in scope, there's a good chance you could find something that nobody has tested yet, and then there's easy wins... I would also create 2 accounts on the program I'm hunting on, for when I'm searching for idors... Creating an account will also unlock additional features that can be tested.

lilac bough
# elder vigil this is great advice!!

One last thing when you find something and you go to report your findings, make sure you can actually exploit the bug... For example you think you've found an account takeover, actually take the account over, otherwise it could be marked as informative and you'll miss out on any rep or money associated with your bug... Think what's the worst thing that could happen if a malicious actor found this bug and then try to see if you can do that, unless the policy explicitly states not too ..

river kraken
#

Hey guys I need to start bug bounty is ZAP enough ?

river kraken
lilac bough
#

Well the advice would be universal advice for any beginner looking to get into bug bounty... As far as is zap enough, any proxy would be good enough to start hunting.. eventually you'll want to start looking into automated recon to get leads. And maybe spinning up a VPS (using any cloud provider) to host some payloads. Heres a video on recon process https://m.youtube.com/watch?v=Z9es1_BUXmQ&pp=ygUIbmFoYW1zZWM%3D and another for setting up a basic VPS to hack from https://m.youtube.com/watch?v=qlX5jR7Z4uo&t=329s @river kraken

YouTube
NahamSec
2024 Bug Bounty Recon Basics

📚 Purchase my Bug Bounty Course here 👉🏼 bugbounty.nahamsec.training

💵 Support the Channel:
You can support the channel by becoming a member and get access exclusive content, behind the scenes, live hacking session and more!
☕️ Buy Me Coffee:
https://www.buymeacoffee.com/nahamsec

JOIN DISCORD:
https://discordapp.com/invite/ucCz7uh

🆓 🆓 🆓 $200...

▶ Play video
YouTube
NahamSec
This Is How You Setup Your Bug Bounty & Automation Box (Part 1)

📚 Purchase my Bug Bounty Course here 👉🏼 bugbounty.nahamsec.training

💵 Support the Channel:
You can support the channel by becoming a member and get access exclusive content, behind the scenes, live hacking session and more!
☕️ Buy Me Coffee:
https://www.buymeacoffee.com/nahamsec

JOIN DISCORD:
https://discordapp.com/invite/ucCz7uh

🆓 🆓 🆓 $200...

▶ Play video
river kraken
#

Ping me

#

Hey where did u go ?

lilac bough
# river kraken Y do I need to setup some box can't I use a vm ?

At work rn... Sure you can use a VM ... May want to use a VPN then, so your IP doesn't get blocked while scanning.. I guess it all depends on what you are hunting for. For some bugs you are going to need to have a way for your payload to call back whether it's a burp collaborator session or a server you can control. But I think the last video will / can explain it better

upbeat spear
#

Hello everyone, i am new here, and i started learning about bug bounty recently.
Currently i am learning XSS vulnerabilty, do you recommend me hunting through automation, or manual testing.
If manual testing is better, do i need to know a lot of java script or just the basics.
Thanks!

unborn ice
#

Can you confirm the scope?

south oasis
#

What scope?

unborn ice
#

For the bug bounty.

#

We have no idea what you're doing, so if you'd like help, you'd need to confirm.

south oasis
#

It's a private program on Intigriti.

unborn ice
#

If you can't provide a scope, we can't help, and I'd like to ask for you stop asking for help also. 🙂

south oasis
#

Ah you asking to see If it's an Illegal or no?

unborn ice
#

Pretty much.

south oasis
#

Yup got it, thanks <3.

lilac bough
# upbeat spear Hello everyone, i am new here, and i started learning about bug bounty recently....

I'd recommend looking for xss manually, automated tools can miss a lot... You can use automation to hunt for xss but may receive false positives, so will need to verify any automated findings. I'd recommend automation for hunting parameters, then manually test for xss on those parameters. As far as js the basics are sufficient to find xss but a deep dive on js can help with more complex xss. Here's a few good xss cheat sheets https://portswigger.net/web-security/cross-site-scripting/cheat-sheet , https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html

Cross-Site Scripting (XSS) Cheat Sheet - 2024 Edition | Web Securit...

Interactive cross-site scripting (XSS) cheat sheet for 2024, brought to you by PortSwigger. Actively maintained, and regularly updated with new vectors.

XSS Filter Evasion - OWASP Cheat Sheet Series

Website with the collection of all the cheat sheets of the project.

proud reef
#

i'm taking nahamsec intro to bug bounty course and try to do the lab https://tryhackme.com/r/room/nahamsecsudemylabs I'm connected to tryhackme vpn and tried using tryhackme attack box but can't ssh into the machine. Which username and password should I use to ssh into the machine?

image.png
TryHackMe
TryHackMe | Cyber Security Training

TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs, all through your browser!

little meteor
proud reef
unborn ice
fading sky
unborn ice
#

Oh bob damn it.

I forgot I can see some of those rooms.

unborn ice
lilac bough
upbeat spear
uneven galeBOT
#

Gave +1 Rep to @lilac bough (current: #103 - 62)

upbeat spear
#

Hello everyone, i am new and i have a question, is it a good idea to just look for XSS on my targets, as it is the only vulnerability i know at this time, and it is maybe the most common found vulnerability, thanks

lilac bough
# upbeat spear Hello everyone, i am new and i have a question, is it a good idea to just look f...

I would say yes, sure you might miss out on other bugs during your testing but the thing is, once you are confident finding xss in hardened targets you can branch off and learn new vuln types. You can always go back and retest that program for the new vulns you just learned. But if you want vulns that are similar to testing for xss, you could always learn different injections like SQL, command, template, etc... or could always learn how to hunt for idors... That's a pretty easy one to spot .. honestly it's up to you though

upbeat spear
uneven galeBOT
#

Gave +1 Rep to @lilac bough (current: #101 - 63)

upbeat spear
#

Hi everyone, i am looking for people who are relatively new, or begginers in bug bounty to collaborate with, so maybe we can help each other, thank you everyone!

brave hemlock
ancient prism
#

hi guys,

I have a question about domain security and potential vulnerabilities. Suppose a company owns a primary domain for its online services, but I noticed that similar domain names with different extensions (e.g., .ae , .co) are available for registration.

Could the availability of these similar domains pose a security risk, such as phishing or brand misuse? Any use of reporting these?

spiral shuttle
lilac bough
stiff apex
#

Intercom] Launcher is disabled in settings or current page does not match display conditions
/api/v2/paths/outline?pathCode=:1

    Failed to load resource: the server responded with a status of 404 ()

I have this error, how can I fix this?

#

it works

elder saddle
#

@ancient prism totally plausible risk. My agency used something like sub latin char for some other char that looks like the same damn letter if you don't count pixels

#

than we do pt from that domain

brave hemlock
#

What is the best way to go form doing tryhackme ctf's to getting into bug bounty? Are there CTF's geared towards learning bug bounty? Not expecting to make money more just for fun and something new to learn.

unborn ice
austere rapids
brave hemlock
lusty pagoda
static plinth
#

Hi everyone!
Looking for experienced collaborators for Bug Bounty programs.
No beginners or amateurs, please!
Thanks in advance.

lilac bough
# brave hemlock Are There any CTF that are geared towards learning bug bounty or is CTF not the ...

Here are a few ctf style https://mctf.io/mini-zine code=mixed . Solve 5 of the 6 challenges and get a month of free access to the entire Antisyphon Cyber Range. This is from Black hills Info Sec.

Hackerone ctf
https://ctf.hacker101.com/

Hackinghub
http://hackinghub.io/

Nahamstore THM
https://tryhackme.com/r/room/nahamstore

And then there's portswiggers
https://portswigger.net/web-security/all-topics

Hacker101 CTF

The Hacker101 CTF is a game designed to let you learn to hack in a safe, rewarding environment. Hacker101 is a free educational site for hackers, run by HackerOne.

HackingHub - Ethical Hacking Training

Learn ethical hacking skills with hands-on labs and education from cyber security experts.

TryHackMe
NahamStore

In this room you will learn the basics of bug bounty hunting and web application hacking

All Web Security Academy topics | Web Security Academy

An overview of all topics, from beginner to expert level, through the Web Security Academy - brought to you by PortSwigger. Create an account to get started.

swift basin
#

it requires that you already know everything, it is basically a what can you do task

lilac bough
#

Combine this with portswiggers labs and you should be good to go for testing.

barren depot
#

hi

#

guys am studying for bug bounty

#

do u guys know any way to increase skills

limber flume
uneven galeBOT
#

Gave +1 Rep to @lilac bough (current: #78 - 79)

deft hedge
#

I found a vulnerability in Olay's system (Insecure privileges) but they don't have a bug bounty program or a VDP or security disclosure page , what approach should I take to report the issue?

unborn ice
#

Ruh Roh.

#

You could notify their IT team, however don't even mention a reward.

#

However they could take action.

deft hedge
lilac bough
#

Is there a security.txt file ?

lilac bough
deft hedge
uneven galeBOT
#

Gave +1 Rep to @lilac bough (current: #78 - 80)

abstract nacelle
#

guys can you suggest bigginer friendly bug bounty platform

lilac spindle
abstract nacelle
#

i am a fresher on bug bounty so why i asked

lilac spindle
#

I’d say Intigriti was one of the easiest to get started in.

abstract nacelle
#

thank you brother🫂

fallen palm
#

hi

barren depot
#

Guys can anyone guide me

mighty elbow
spiral shuttle
lilac bough
still jasper
#

How is that begging to be hacked? Also they're not even validated by H1

image.png
#

I'm not surprised they have had to make that statement tho. I've seen a few people asking for a reward from VDPs due to not reading the scope properly

lilac bough
#

Basic VDP terminology... Generally not a lot of hunters are actually hunting on VDPs because of the lack of payments,, so a good place for people trying to "practice"

#

But there is a debate about large companies like this using VDPs ... When they are large enough to pay for serious bugs ....

#

I can see smaller / start up companies beginning with VDPs but as a bigger corporation and serious reports come in you should value your company's security and invest back into it and researchers... Just my opinion... Not like they are just wasting money by paying a researcher that found a crit...

#

I've also heard of some bigger companies that have public VDPs that state they do not pay for bugs but also have a private program where they pay for crits ... Which is weird that some hunters could get paid while others won't (assuming they found the same bug)...

hybrid orchid
#

I mean, to meet compliance you get a pentest (amongst other things). Don't forget: community submissions -- be they bug bounty or VDP -- are supplementary to a proper security programme, not instead of.

analog glen
#

it's expected that a VDP is not going to find really significant thing, if the company participating has even a modicum of competency in their security program

#

Unless the thing that's found is an actual 0day

hybrid orchid
#

Bug bounty / VDP submissions can be really useful for being made aware of issues, 100%, but they are far less reliable than, y'know, paying a team with all the relevant qualifications to thoroughly assess the systems.

#

This is also very sketchy imo.
VDPs exist to give researchers legal protection to responsibly disclose findings. I do get where you're coming from with the just reward thing, but no one is obligated to give you money for something you've done voluntarily, unless they've made it explicitly clear that they are open to doing that.

Frankly, your suggestion that you should just sell the data instead of telling the company is a massive red flag. It tells us that you value money over ethics. It tells us that you are willing to compromise a company (and potentially thousands or more customers) simply because they're not willing to pay you to not do that.
Which, frankly, is scummy af.

#

Is it a choice between "hand them free security" and "sell their data"?
Because if so, yes, you're meant to take option A. That's what an ethical hacker does.

In reality it's more nuanced than that. If you don't want to actively hunt VDPs, that's fine (and I don't even remotely blame you if you value your time). That's not why VDPs exist anyway. They exist so that if you stumble across a flaw, you are safe to report it without fear of legal repercussions.

If, heaven forbid, you did accidentally find a way to leak user data from a company with a VDP but no bug bounty, then yes, as a security researcher I would expect you to report it with no expectation of a reward.

#

That's literally the difference between a white hat and a black hat.

#

And yes, orgs tend to have their own best interests at heart -- over those of their customers -- but that doesn't mean you get a free pass to stick it to them. Especially if it involves customer data.

How many real people do you think get hurt every time there's a data breach? Yes, it hurts the company in fines and reputation, but the users themselves also end up compromised, identities stolen, whatever (depending on what gets nicked obviously).

#

Then what happens if someone comes along tomorrow, finds the same issue, and uses it to dump that PII? You're morally responsible for that just as surely as if you did it yourself. If you knew something that could have stopped it and chose to do nothing then like it or not, that blame is also on you.

#

For the record, I do agree that a big org using a VDP instead of a bug bounty programme is a dick move, although I wouldn't call it "petty". I also don't think they automatically owe you money for voluntarily finding flaws for them -- although it's obviously courteous of them to offer it.

That said, stooping to their level and refusing to use your knowledge of an active vuln to help them makes you just as bad.

#

Again, neither a VDP or a BBP is the only line of defence... Or, if it is, they have serious problems lmao.
Don't overestimate the role BBPs play in a security architecture. In the grand scheme of things they mean very little to an org. Basically a nice little bonus rather than something to be directly relied on.

If one org has decided that they don't need a BBP, well, that's their decision 🤷‍♂️

#

I would always argue that if you're not using a BBP then publishing a VDP is a sensible option though, because it means that if an ethical researcher does find something then they feel safe to report it.

Then again, I would also argue that you should voluntarily reward said researcher for their expertise, regardless of whether you want people to be actively hunting on your platforms 🤷‍♂️

#

Yes, it's a sensible option imo -- in many cases at least. Just up to them whether they go that route. At the very least most countries require them to get pen tested frequently if they're handling sensitive data.

#

That said, think about it this way:
Let's say you were out walking and the path took you underneath a road or a rail bridge. If you saw that one of the struts was rusted almost completely through and looked to be close to collapse, would you report it, or just keep walking?
Would you expect to be paid for reporting it? What happens if you don't report it and a week later that bridge collapses letting a train fall down, killing hundreds of people? Would you feel responsible for that, even though you're not a bridge inspector employed by the state to go and find those issues?

#

Arguably the professionals (pentesters for our industry) should have spotted that issue. The bridge should have been shut (system not been allowed to go live) until it was confirmed to be safe. But for whatever reason that hasn't happened.

That's the role that BBP and VDP play. They're an unreliable way of finding the flaws that have either been missed, or have developed after testing occurred -- counting on the good will of the "public" to stop a catastrophe that slipped through the gaps of the official testing. BBP are just a way of incentivising people to actually go and look for issues, rather than just reporting them when they find them.

mighty elbow
uneven galeBOT
#

Gave +1 Rep to @spiral shuttle (current: #65 - 105)

mighty elbow
#

what is rep

red dome
fallen palm
#

How likely are bug bounties to be replaced by AI? and in how many years? Is it worth starting in 2024?

silk cosmos
#

Don't know about it being replaced by AI, but I will be starting my first bug bounty later this year

spiral shuttle
#

My bet is that absolutely a large chunk of the market will get replaced. It's the ideal application for LLMs. Systems that you interact with using text, no human intermediary, in addition a perfect environment for automated training at scale with auto-generated boxes, not limited by any human factors (like having audio transcript for training).

I expect much faster progress in this area than for example in customer service. AI will do at a minimum the low hanging fruits at a speed and price that humans aren't gonna compete with. Including detailed reports with instructions for remediation. I have no doubt by the end of the decade that's gonna be standard.

There's gonna be room for top experts for many years to come, but that's not gonna help most.

fallen palm
tiny root
unborn ice
#

People already use automation tools for searching for bounties, AI would just be an upgrade.

spiral shuttle
fallen palm
#

But there's always gonna be zero days which will never be found using automation right

unborn ice
#

Yes and No.

spiral shuttle
fallen palm
#

And also since most people develop their own automation tools there's probably never gonna be one perfect tool that does it all

unborn ice
spiral shuttle
unborn ice
uneven galeBOT
#

Gave +1 Rep to @spiral shuttle (current: #54 - 130)

fallen palm
#

Literally everything I decide to do there's people telling me It's either too hard, too late, or that It's gonna be replaced by AI

I am completely lost.

unborn ice
#

Don't base it on what somebody else wants things you should do.

spiral shuttle
#

Aa I said "just an upgrade" is a meaningless statement unless you define "upgrade" and the consequences that come with it.

unborn ice
#

Who knows, maybe the lack of bugs found will bore you and put you off searching.

fallen palm
unborn ice
fallen palm
#

Im pretty sure help desk is way more competitive than bug bounties

spiral shuttle
fallen palm
#

Okay, I'll just finish my A+, and do bug bounties in my free time

unborn ice
#

I don't care what anybody says,

Bug bounty is not a sustainable income.

tiny root
#

lets destroy all the IA plateforms like chatGPT then 😹 🙏

unborn ice
fallen palm
#

Also if I find a few bounties I could brag about it at work, and ask for a Pentest+ voucher

unborn ice
#

Or have enough money from the bounties you can purchase it yourself.

#

Win/Win.

#

Unless you fail.... kekw

fallen palm
#

but who doesnt love free stuff right

tiny root
unborn ice
fallen palm
tiny root
tiny root
fallen palm
#

technology is too complex to be 100% un-hackable in my opinion

so while AI will replace a lot of jobs, hackers will hack the AI, and more security jobs will appear

tiny root
spiral shuttle
tiny root
#

i dont want to be useless when i got all my certifications

fallen palm
#

10 years from now

#

so the math does work out

more robots = more security needed

spiral shuttle
#

Basic economics dictates that if using AI required more staff to develop, maintain and secure it than the staff it makes obsolete, AI is not going to be used.

If your assumption is correct you solved the problem you're afraid of.

near spear
#

Depends if it manages a higher profit.

fast fable
near spear
#

But probably AI will take jobs. Get some others in return. In the end high unemployment is also bad for companies that profit from AI because it hurts the economy overall. Will end up balancing itself out.

fallen palm
#

The question is, which jobs in Tech are in danger

#

Flip a coin I guess

#

Web development will surely be one of the first to be replaced

tiny root
solar dagger
#

Can someone with knowledge about ssrf send me a private message? I think I found a vulnerability, but I'm not sure, I have a question☝️

crystal thicket
#

bro tryhackme legit tweaking

#

man i thought premium users had it good, was 12 bucks worth it for issue like this. (the issue is that nothing wont run but they work on other machines

fallen palm
#

If I wanna do bounty hunting can I skip Windows/Linux CTFs?
And just focus on web app CTFs?
Or is that a bad idea

lavish hollow
novel arrow
#

any way to bypass?

image.png
#

im tryna do (site)/etc/whatever and it rejects it just cuz my ip

wicked sundial
#

You're asking us to do work that you're getting paid for

novel arrow
#

lord forgive being generous

#

its a question, not really the whole thing

#

just asking around if anyone knew

unborn ice
novel arrow
#

wdym scope

#

sry im new to this

unborn ice
#

Are you trying to get a bounty on a random website?

novel arrow
#

its listed

outer ore
#

Hi

unborn ice
#

Then you'll need to share the scope set by hackerone.

Just bare in mind that any help you recieve, somebody may just submit the report for the bounty

brisk shuttle
novel arrow
uneven galeBOT
#

Gave +1 Rep to @brisk shuttle (current: #1400 - 2)

novel arrow
#

could you check your dms?

brisk shuttle
dreamy nest
wicked sundial
# dreamy nest what about split bounty with you ?

Where's the guarantee though? Only one person can submit and you're trusting the other person, that you don't know, will a) give you the money at all and b) will give the appropriate percentage. Things get even more convoluted if you're not in the same country as well as a bunch of other factors.

dreamy nest
wicked sundial
#

That must be newer, I don't remember it being there a while ago. It still seems like there is room for dispute though as each party is rating contributions? Still something I would be wary of.

raw quiver
#

I'd be open to collaborating on a bug bounty

#

at one point I had a very large map of Tesla's network

lilac bough
novel arrow
vale brook
novel arrow
#

where 2 learn how to bypass WAF's?

#

please, if you actually want to help me, do not just tell me to google it, ive already tried that

lilac spindle
#

theres no course out there for it

#

you just bash your head in until a payload works

novel arrow
#

got a url vulnerable to XSS

#

anyone wanna colab and help me?

long shale
#

anyone could recommend some good reverse engineering resources like free Books, online courses, or tutorials. Thanks in advance!

fading sky
crystal turret
#

on hackerone if i wanna join a bug bounty program

#

do i just start immediately or is there some sort of legal forms and consent i have to do

fading sky
lilac bough
lilac bough
lilac bough
# novel arrow where 2 learn how to bypass WAF's?

Here's that video ... https://m.youtube.com/watch?v=VKnX1vj65Ro

YouTube
NahamSec
#NahamCon2024: The Art of Bypassing WAFs (with live demos!) | @Brum...

LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍

The presentation will provide various methods on how you can bypass modern web application firewalls (WAF). During the presentation, we will cover hands-on labs that simulate various WAF scenarios. The labs will be open source and you will learn how to effectively customize yo...

▶ Play video
#

They also have a "playground" where you can practice the techniques shown...

novel arrow
#

thanks man

patent glacier
#

Hi, I have just configured the header for my requests, but I cant still see my custom header in my request header

#

I used Custom Header Extension

lilac spindle
#

Match and Replace rules under Proxy Settings

image.png
#

Click add and it has a placeholder that teaches about adding a new header

patent glacier
uneven galeBOT
#

Gave +1 Rep to @lilac spindle (current: #22 - 380)

solar dagger
#

hello everyone! When I want to make a transaction with the inscope url given in a bug bounty target, are sub domains and directory urls included? So, is it necessary or prohibited to scan sub domains and directories via inscope url (main domain)? Are the sub domains and directories I found considered outscope?

simple jewel
opal olive
#

Hi guys im learning different web vulnerabilities , can someone tell me which method is best to learn

  1. Learn a web vuln and become perfect(100%) at it (doing extra labs, ctf etc) .
    Or
  2. Learn a web vuln til intermediate lvl then go to next vuln , and when done all vuln then go for advance lvl
solar dagger
#

thank you!

simple jewel
patent glacier
#

If I managed to insert javascript to execute XSS, but when open source code it appears and not execute, is a way to make the payload execute?

#

I dont know how to explain, first time the website have seen that I want to insert <> ", but once I managed to insert it dont execute, it appear on source code but nothing

#

And I dont know if it worth or not to continur

lilac bough
patent glacier
#

In the first instance the website didnt let the permission to use <>" but it works by modifying the request with burp

versed hazel
#

First thing that pops into my head is trying to see if you can create a scriptable context within the html tag you are in

#

for example: <a href="javascript:prompt(document.domain)">

#

I'd also use portswigger labs as a reference they've got some pretty good stuff on xss

lilac spindle
novel arrow
#

quick question

#

if you have smthing like value="" then when you insert a script wouldnt the double quote cause a syntax error?

bleak rivet
hybrid seal
kind lake
#

Hey,
I am doing a bbp and I am pretty desperate as I was working on this one endpoint for too long to drop it so I am writing here. So I had found an interesting functionality on bbp and idk how to exploit it and if it is even possible. So in the website there is an error for incorrect login like Error: invalid username or password. And I found a way to change that error to whatever (it is in parameter in website like website.com/login?error=Invalidusername) so I can change it to whatever and I began trying to get xss on the website, but they encode every input I make (for example < " ' all that) and I would have moved on but what is interesting is that I am in div element not in some input of whatever so like <div> I am here </div> and I don't wanna move on because I think that there should he a way to do something.

If anyone has any ideas I would be very interested to hear them.

Thank you very much

fallen palm
kind lake
#

I will try thanks for help

fast fable
kind lake
uneven galeBOT
#

Gave +1 Rep to @fast fable (current: #14 - 540)

novel arrow
#

anyone been able to use OpenSSH cve POC?

#

cant use it for the life of me

fading sky
novel arrow
#

it is

#

but i still cant use the POC

fading sky
#

Haven't looked at it myself so let's wait for others to chime in.

novel arrow
#

aight

lilac spindle
novel arrow
#

and gives me the terminal prompt again (but not a reverse shel)

lilac spindle
novel arrow
#

istn it suppoised to take hours?

novel arrow
#

cuz i thought that memory corruption takes centuries

lilac spindle
turbid wedge
#

I have a pretty massive question about bug bounties specifically so i figured this was the best place to put it

#

I am trying to find the specific IP address for a domain. When I run the host command I get:
example.com is and alias for example.cloudnet.com followed by four IPv4 addresses and a litany of IPv6 addresses
I receive the same output for:
nslookup www.example.com
However when I run a reverse dns lookup on Viewdns (still looking up www.example.com) I recieve two IPv4 address associated to what appears to be amazon associated domains that are not matching any of the previously found IPv4 addresses
Ultimately my question is what can I do with this information, why is it contradicting, and how can I find a singular IP address. I figured even if they were load balancing the requests it would still be associated to a singular address. I don't want to accidentally footprint something out of scope.

lilac spindle
regal aspen
#

I am a noob Just getting started how can I get my hand into bbp?

lilac bough
# regal aspen I am a noob Just getting started how can I get my hand into bbp?

Well to start, I would suggest learning about 1 or 2 web vulnerabilities like xss, SQL injection, idors, etc and how to find them... You can use some of the newer thm rooms or portswiggers labs for learning how to hunt for those specific bugs, after u feel like u know what you're looking for, then test out your luck on a target. If you are just learning I would suggest starting with a vdp instead of bbp, as a bbp will have a lot more competition and a higher chance of dupes, especially on any low hanging fruit...

echo tangle
#

Hi everyone!

Can you advise good bounty platforms for beginners? Preferably with some kind of on-boarding. If it was already discussed here, please link the post.

Also, are there any good vulnerabilities to start learning bug hunting with?

echo tangle
lilac bough
# echo tangle that's great advice does vdp stand for Vulnerability Discovery Program?

Yes, there's a lot less competition on vdp's so there's the chance that some of the easy bugs like idors, xss, authentication misconfigurations, etc still exist on those. Now these may still exist bbp's but chances are they have already been reported. As far as platforms I would suggest hackerone bugcrowd or integriti. Targets I would suggest a company you are already pretty familiar with.

echo tangle
uneven galeBOT
#

Gave +1 Rep to @lilac bough (current: #77 - 85)

lilac bough
# echo tangle Thank you!

I would also suggest checking out some of nahamsec's newer video's and engaging with his discord server, he just recently had a 5 week program going on where he chose 3 targets for the month, did a bunch of the initial recon for you and covered which bug to hunt for the week, there's live bug hunting sessions going on all the time...then once 5 week program was over 1 person out of the group was chosen to work for nahamsec as a web pentester... But heres the thing, the 5 week program went well and was extended so now there's monthly targets, he partnered with trickest and they scanned every bug bounty program and created a big database of recon on every "target" free to use ..

echo tangle
split spoke
#

Hello guys.
If this is the wrong channel i'm sorry.
I am testing for RCE because i have found a bash script on a page. When accessing it it will be downloaded with following content:

#!/bin/sh
DOMAIN=$1;
APPLICATION="MyApp";

cp -r /directory1/$APPLICATION/usr/hosts/customertemplate /directory1/$APPLICATION/usr/hosts/$DOMAIN;
chmod -R g+w /directory1/$APPLICATION/usr/hosts/$DOMAIN;

with curl i can send the parameter. My question now is: How can i manipulate the parameter to get (i.e. whoami) RCE?
Thank you for your help ❤️

unborn ice
split spoke
#

I found a bash script on a webpage. when i run curl i get following message:

curl -sSL https://URL-TO-BASH-SCRIPT.sh | bash -s -- ";whoami;#"
cp: cannot stat '/directory1/MyApp/usr/hosts/customertemplate': No such file or directory
chmod: cannot access '/directory1/MyApp/usr/hosts/;whoami;#': No such file or directory

how can i run a correct parameter? I mean its like a sql injection but it's on a bash script (no input sanitization)

unborn ice
split spoke
#

it's my companys website and yes i'm permitted to do penetration tests. i dont want to tell the correct url because of the might security issue

unborn ice
split spoke
#

Does it help you to know that the webserver is running ubuntu as setup? i just want to know how to pass the whoami parameter to proof RCE on that file.

unborn ice
#

Not at all, there is many different versions of Ubuntu.

acoustic ore
split spoke
#

Ups sorry my bad 🙈 but thank you anyway

grand knot
#

Guys I have a question
I'm a beginner at bug bounty
Does anyone have sources or courses on it

shadow veldt
jovial violet
#

@grand knot you can try sources like nahamsec or jason hadix on youtube but the best way i believe you can get into bug-bounties is by jumping right in and practicing with black box rooms like ones from portswigger or vulnhub. tryhackme also has a bunch of amazing modules to learn from as well.

lavish hollow
tropic mural
#

guys, does anyone have an idea if these exploit count as a VM escape? CVE-2024-21111 / CVE-2024-21112. Says on Nist "allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox". So only local priv escalaption but not VM escape?

regal aspen
#

Hello, How can I update multiple product reviews using NoSQL manipulation technique on Mongo DB

humble goblet
#

Hey I am a full-time bounty hunter. I'd like to collab.
I found an sqli, we can escalate it. 😉

unborn ice
humble goblet
#

just to collab bro but I'm almost done exploiting it

#

there waf was in place

#

and maybe motivating some ppl to start their bug bounty journey

unborn ice
#

If you'd like help, you'd need to share the scope.

lilac bough
#

If he shared scope here wouldn't that dox the company since he's already mentioned the bug... Sqli should be a high to crit finding anyways, but you could always look into SQLi => RCE for some additional impact..

humble goblet
#

we already dumped the database rn

#

and wrote the report

humble goblet
#

its already p1 so I'm sure I'll get the max payment

fast fable
#

nice find

lilac bough
winter sigil
#

hello anyone up?

unborn ice
unborn ice
lilac bough
lilac bough
# humble goblet we already dumped the database rn

Id also be careful with that one depending on the table that was dumped, because now you could possibly have access to confidential information.... And depending on the scope, would be considered out of scope.... For example here's a snippet from NBA bbp ``` - Do not access NBA customer, employee, or confidential information.

  • Do not intentionally view or access any data beyond what is needed to prove the vulnerability.```
shadow veldt
#

Those who work a 9-5, what's your schedule for learning/live testing look like? Currently I'm thinking a spend an hour or two a day after work learning and doing labs and then try live targets on weekends to try to build on what I've learnt during the week

charred lichen
# shadow veldt Those who work a 9-5, what's your schedule for learning/live testing look like? ...

This is pretty much what my schedule looks like, the key is to just be very deliberate with your testing when you do have the time and automating some of the repetitive tasks so you can focus on actually finding bugs. Also, keep your expectations at a realistic level, you won't make as much money as full time hunters and that's ok. But it's been a nice side hustle for some extra play money here and there.

shadow veldt
uneven galeBOT
#

Gave +1 Rep to @charred lichen (current: #1440 - 2)

nova gyro
#

what level of severity is reading /etc/passwd on a bounty site?

charred lichen
nova gyro
#

would it be considered sensitive data exposure ?

shadow veldt
#

Let's gooooo. I do love it, just not enough hours in the sat hahaha. Or I ruin my sleep schedule

charred lichen
nova gyro
uneven galeBOT
#

Gave +1 Rep to @charred lichen (current: #1090 - 3)

shadow veldt
#

The biggest blessing is definitely just loving to learn and not being just satisfied that something works but needing to know the how and why. It's gotten me promotions at work and gotten me pretty far in a lot of other things

shadow veldt
# nova gyro would it be considered sensitive data exposure ?

Not sure how useful this is since I haven't found my first real bug but something I read was put yourself in the shoes of the team that will be receiving the report and think of the impact something like that has for them. Like could it expose other things? Is it sensitive info. Could it be further exploited

#

Maybe that could give you an idea on how to make the report even better to get a definitive crit

nova gyro
shadow veldt
#

Can you find anything more from there though? Like is it path traversal?

nova gyro
#

twig

#

poping shell doesn't work can just read files

humble goblet
#

and I found another sqli just now

#

I'd like to collab w someone who's good at scripting and owasp top 10

#

we can hunt on all programs ig

image.png
keen haven
#

i am new in bug hunting, can anyone help me out with recon

humble goblet
keen haven
#

kindly dm

lilac bough
# humble goblet I tried but it wasnt possible since there was a waf.. but maybe I havent tried e...

Here is something you could try for the waf https://m.youtube.com/watch?v=VKnX1vj65Ro

YouTube
NahamSec
#NahamCon2024: The Art of Bypassing WAFs (with live demos!) | @Brum...

LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍

The presentation will provide various methods on how you can bypass modern web application firewalls (WAF). During the presentation, we will cover hands-on labs that simulate various WAF scenarios. The labs will be open source and you will learn how to effectively customize yo...

▶ Play video
jovial violet
#

is there anyone willing to colab and build a little mini temporary team for bug-bounties for a while because im struggling heavily im looking to work with some people to help clear up how i might be approaching things and fix or improve my methodology for bug hunting.

gritty bough
#

please who knows anything about LFI attack

lilac spindle
#

What’s your specific question?

gritty bough
#

i'm trying to perform LFI for an api endpoint that looks like this "/api/v1/user/change-avatar/", this allows me to upload an image for the avatar..bt whenever i try doing LFI command in burpsuite, it just resets it as the file that i put initially

humble goblet
lilac spindle
gritty bough
lilac spindle
#

Probably truncation in the backend then

gritty bough
#

damn

#

is there a way to bypass

jovial violet
#

@codex you should try mapping out the upload process by using valid files and changing it slightly each time to get a good idea of why it works. this might work and if i doesn't it should help on getting a better understanding of it so that you could possibly come up with your own bypass.

#

@gritty bough just a suggestion though

crystal turret
#

why do characters like < turn into <?

crystal turret
#

ah i see

#

i am guessing there's no way to bypass it too right?

#

same but eventually we'll find out

#

what was that

#

oh a spammer

modest vector
#

No worries, thank you for notifying. Looks like they have been dealt with.

uneven galeBOT
#

Gave +1 Rep to @glass wraith (current: #185 - 36)

strange galleon
#

what do I need to learn to be a bug bounty hunter?

#

like what libraries in JS?

#

and what programming languages?

lilac bough
strange galleon
lilac bough
thorny verge
#

so im starting to do bug bounties, if i nmap and dirb websites i get blocked after a few seconds of scanning... how do i work around that?

fast fable
#

reduce the rate

#

is automated scanning allowed in scope?

thorny verge
thorny verge
#

they say that requests should be limited

#

but how would you go about enumerating things if not automated?

fast fable
#

Manually

thorny verge
#

but like i want to enumerate a website how would i manually do that?

#

check out the dirb wordlist and go through one after the other?

thorny verge
fast fable
#

I wouldn't do an nmap scan, most times infra isn't part of the scope

#

If it was, I'm not sure - I guess the level of "automation" would differ between each program, you could ask for clarification

thorny verge
#

yea like if a server had a service on port 4444 i would not find it unless i would nmap it no?

#

wouldnt that be the same in the end?

#

yea idk thats why im consfused when they say
"refrain from using automated tools
limit yourself about requests per second"

#

so i guess nmap would be fine if i can make it be slow

fast fable
#

Yeah, that's what I mean by the "level of automation"..it's kinda up to debate what counts as automation, hence why I'd probably ask to clarify

thorny verge
#

i get DoS blocked if i nmap too much 😄

#

so i could do -T2?

lilac bough
#

Bro do more passive recon.... You could also grab endpoints from the js ... Also good idea to use a VPN if you go the scanning route so you don't get your IP blocked... You could get IP address using dig or similar... Check shodan on ip for open ports or something similar ... You could utilize online scanner for subdomains if it's wildcard scope... That way it's not all active recon and you get blocked before you even start hunting

lilac bough
lilac spindle
# thorny verge they say that requests should be limited

Usually in a bug bounty scope and ROE, its specifically stated how automated tools should be configured. They would say to lower the amount of requests (e.g. 1 req/sec) so you need to limit your tooling to that. For example: gobuster uses the -t option to control the threads so you can limit your request tooling there. There is also sometimes explicit mention of adding a header (e.g. X-HackerOne: username) so that your requests are identified and youre not some random bot they will ban outright.

thorny verge
next nova
#

Hey I'm in bug bounty in an IIS website. I looked a bit for vulns and found the short name vuln. I used the Burpsuite extension and the target was vulnerable. The extension found 6 files. But I don't know in what format I should write the file. Here is the extension output (replaced the name of the target by redacted.com) :

[] Trying method "OPTIONS" with magic final part "/~1/.rem"
[] Trying method "POST" with magic final part "/~1/.rem"
[*] Trying method "DEBUG" with magic final part "/~1/.rem"

[+] Host "https://redacted.com/" is vulnerable!
[+] Used HTTP method: DEBUG
[+] Suffix (magic part): /~1/.rem

[*] Starting filename and directory bruteforce on "https://redacted.com/"
[i] File: SVNCSH~1.RUL
[i] File: REDACTED~1.RAR
[i] File: WEB~1.CON
[i] File: APPLIC~1.CON
[i] File: PACKAG~1.CON
[i] File: GLOBAL~1.ASA

[+] Bruteforce completed in 8 seconds
[+] Total time elapsed: 9 seconds
[+] Requests sent: 870

[-] No directories found

[+] Identified files: 6
|_ SVNCSH~1.RUL
|_ REDACTED~1.RAR
|_ WEB~1.CON
|_ Actual file name = WEB
|_ APPLIC~1.CON
|_ PACKAG~1.CON
|_ GLOBAL~1.ASA

I need to show impact can someone help me ?

umbral juniper
#

Hey all, I am new to bug bounty, I was wondering if I could get some tips on how to get started. Really appreciate the help

near spear
umbral juniper
uneven galeBOT
#

Gave +1 Rep to @near spear (current: #41 - 183)

shadow veldt
umbral juniper
finite cobalt
finite cobalt
lilac bough
finite cobalt
proven sentinel
#

hi

lilac spindle
proven sentinel
#

i need help related bug hunting

#

idk but whatever i report they take it as P5

lilac spindle
#

That is the one big thing companies that run BBP want

proven sentinel
lilac spindle
ripe mountain
#

@rustic pebble
i am gonna get into VDP because i was searching for a XSS bug in evernote which BB in hackerone but i cant, So, i just changed to VDP and then need to go BB

rustic pebble
#

nothin wrong with that

#

public bbps are pretty competitive
too many eyes all on the same thing

#

aside from the whole "good for gaining experience" thing with vdps, if they're done on a platform like h1, they can help be a gateway into more private programs that are less competitive and/or fresher targets

ripe mountain
#

if you know any of the websites to do VDP means kindly share

rustic pebble
#

also if you're just wanting to mess around and don't care about getting paid, open source is a great target for simple disclosure, esp those that run a vdp through github advisories

#

not nearly as many people looking there so often easier to find things, depending on the type of software

rustic pebble
ripe mountain
#

And then my main aim is to make my resume look good because i cant pay high paid certifications. So, i just jumped to VDP and add it in my resume instead of n numbers of certificates

ripe mountain
uneven galeBOT
#

Gave +1 Rep to @rustic pebble (current: #58 - 127)

shadow veldt
#

@ripe mountain if you wanna look for something not on a public platform like HackerOne/Bugcrowd you can also try a google dork like
intext:"vulnerability disclosure program" inurl:".com"

For the inurl part I put .com.au because I'm based in Australia and want to work on Australian VDPs but that's just personal preference

ripe mountain
#

Thanks bruh

plain vine
old umbra
#

Hi

fast fable
#

Hi

eternal kayak
#

Anyone know if splunks vuln disclosure through hackerone pay bounties? Didn't get an invite to their private program yet, but can still submit through the embedded submission linked from the splunk page.

stray kiln
#

can anyone explain me IDOR vunerability and how to report for it ?

lilac spindle
stray kiln
#

I mean private game in king of the hill should be private

#

but we can go and see them

stray kiln
lilac spindle
#

If its koth inquiry specifically, #koth should be a better one

stray kiln
#

no it's not a specific

stray kiln
#

Then if anyone see that private thing

#

then what should we call it ?

#

let's take an example if you start a game with your friend privately and if everyone can see it then why it is private ?

stray kiln
#

That's the thing i was talking about

Screenshot_2024-08-30-15-43-09-828_com.brave.browser.png Screenshot_2024-08-30-15-42-46-668_com.brave.browser.png
#

these both games are private

fading sky
quasi steeple
#

I assume the "private" part is that it cannot be participated in by non-invitees, rather than meaning its presence is hidden

#

Or did you verify that such private matches are not accessible via the usual spectate interface, and you explicitly only accessed them by exploiting IDOR

stray kiln
#

but what if someone else.I mean other person that is not in game hack machine and make winner who ever he wants?

#

is it still not considered as a bug ?

stray kiln
#

I don't know who is this.But, there is someone who can see IP too.I don't know how>But, it's true

#

and i have faced this issue several time

#

someone made me king again and again even i'm not pawning any machinebecouse my openvpn doesn't work properly.

#

If you are still ignoring it.Then okay.I don't care too.

#

But, there is a vunerability in KOTH.

tame sirenBOT
lilac spindle
#

@stray kiln if you think there is a vulnerability, you can definitely submit a report. Check the docs I linked for help on the topic.

stray kiln
fading sky
# stray kiln If you are still ignoring it.Then okay.I don't care too.

The intent here is not to ignore, but rather to understand the basis of the concern. As @lilac spindle pointed out, THM has a BBP where you can report it, but you'll need to provide more information on what was achieved, how it can be re-created, etc. for it to be actionable on THM's part (and for it to be prioritised accordingly once confirmed).

stray kiln
quasi steeple
#

how did you discover the issue

#

what step-by-step process did you do to encounter it

stray kiln
#

when i was playing with my friend at my home

#

we both try to hack machine

#

but our openvpn doesn't work properly.So, we both can't hack machine.But, suddenly someone put my friends name in king.txt file and he is showing as king in that game and he won.

#

and there is only two persons in game me and my friend

#

So, how can someone got ip to that machine and hack it too and put my friends name in king.txt file.That's my question.

#

and yesterday also someone put my name in king.txt file.I don't know my opponent is trolling me or someone else help me .but, it's done in continuous 3 games.That's shocking for me that's why i'm here.

unborn ice
stray kiln
#

someone hacked machine and put his name

quasi steeple
#

for a bug bounty / vulnerability report you would really need solid evidence of this at least

Ideally for a bug bounty you would provide a detailed report on step-by-step process to achieve whatever the given exploit is and show its results, so that the company can reproduce the exploit to verify that it exists and then fix it

to report a vulnerability, you would have to be able to demonstrate that it exists with evidence other than anecdotal report of something that seemed a bit weird

It does sound like the game just declared a winner because neither party interacted with it. You'd need evidence of another 3rd party joining the private game somewhere.

stray kiln
red vine
#

Hello friends I’m new to bug bounty hunting which learning paths should I study?

#

I know the basics I want to grow my skills in bugs and ways to find them

gritty pulsar
#

Since XSStrike is abandomware, is it still good for finding XSS bugs?

fallen palm
# gritty pulsar Since XSStrike is abandomware, is it still good for finding XSS bugs?

bro, i should recommend you try it manually with burpsuite if you wish (no intruder of prefference is best manually), and try payloads in different possitions, for example if the webapp you auditing have for publish posts, then you should try some xss payloads on a post, if the webapp have login or register, try on them too, check if url have parameters like search?= p=, etc, get payloads from hacktricks or github and you can arm your own payloads too

# 
https://github.com/BlackFan/content-type-research/blob/master/XSS.md


https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting
gritty pulsar
#

I know how XSS works lol

#

I just want to blast through payloads to see if even ONE sticks

fallen palm
#

XSStrike dont is bad option but will probably miss some parameters, in the context of bug bounty if you want find a bug you have more hight chance of get it manually without automation, but if the noise dont is a problem you can try both, xsstrike and manually

hushed crane
#

Good afternoon everyone

#

I just obtained sec+ and I am looking to expand on my pentesting skills value to ultimately fill a pentester role, is the THM bug bounty program a good place to start?

jagged siren
hushed crane
uneven galeBOT
#

Gave +1 Rep to @jagged siren (current: #2213 - 1)

jagged siren
#

You're welcome!

shadow tangle
#

if someone has found a bug before what are the steps or the things he/she does to enumerate the website and search for vulns I know it is not a standard thing but I mean your ideas about it or if u use a plan or something like this again I know it is not a standard thing but I am beginner and I don't know where to start

lilac spindle
shadow tangle
lilac bough
lilac bough
stray kiln
stray kiln
#

like h1 hard fireworks hackers etc machines

#

1 time it's happen to me in panda too but that time it tells me read only file system and that time i don't know about that command

lilac bough
stray kiln
#

it's happen on public gane but in that gane we both are friends and at the same place and we both don't hack machine but king changes

lilac bough
lilac bough
unborn flower
#

Hi friends some times on intigriti i see in scope: dont use automation tools but then on the other hand they limiting the request for automation tools to 5/per second. Whats allowed at that point ? 😄

lean nebula
#

I have a question if I want to check libraries like libpng or others.

#

How do I start scanning? I have learned the basics of C++, but I feel like there are some codes that are difficult to understand and I don't know which codes I should focus on and which codes I shouldn't focus on.

lilac spindle
lean nebula
#

become advanced in c++?

lilac spindle
#

That’s just a piece of the pie

lean nebula
lilac spindle
lean nebula
uneven galeBOT
#

Gave +1 Rep to @lilac spindle (current: #22 - 402)

thorny verge
#

Hey Guys
I started doing BugBounty and I'm testing for XSS
How do you guys test out forms etc. without bothering the client?
Like testing the form a few times will spam the client and most likely confuse the receptionist

autumn ruin
#

Hi guys how much you can make per month with bug bounty as a side job ?

unborn ice
autumn ruin
#

Do you have a more precise answer please

#

I know there’s not set number but what can expect with a certain level

unborn ice
#

You could report a dupe, you could not get paid.

austere rapids
#

hey guys

#

who is bug hunyer?

unborn ice
#

High number of us, if you have a question, just ask 🙂

past magnet
#

Hello, I just asked this question in #cyber-and-careers but I feel it's more appropriate here. I am on HackerOne but didn't start yet. Do I need any kind of prerequisite or can I just start pentesting them and send them the report afterwards? Also, are there any verified good reports online that I can use as an example?

granite pumice
#

hi i made a bugbounty team we are beginners we need some one to help

unborn ice
unborn ice
#

Posts

past magnet
#

Very helpful, thanks

tardy meteor
#

hi

#

i have uploaded a test malware file to virus total to check detection. that is responding while undergoing analysis. is that a vuln? sorry i'm newbie

lilac spindle
tardy meteor
#

got reply in my telegram bot as. system is running

which i print to detect connection

patent glacier
#

Guys, Ive found an XSS on bug bounty, but I dont know how to make the raport and explain how xss cand affect the website

lilac spindle
# patent glacier Guys, Ive found an XSS on bug bounty, but I dont know how to make the raport and...

Usually, I create 6 sections.

Summary - this includes the summary of all the sections below, including its CVSS Base score and whatnot.

Proof of Concept - this should outline step by step how did you come to that exploit so that they can reproduce it effectively. The more detailed, the better.

Impact - this should outline its business impact, how can it be used maliciously by attackers, etc.

Likelihood - this should outline how hard the exploit can be done. Is it just a copy paste payload, does it always work, what are the pre requisites for the attack, etc.

Recommendation - this should include what is your overall recommendation, what can you recommend in case the first one can’t be done, etc.

References - this should include any and all references you’ve used to create the report

patent glacier
#

Is important to put CVSS score?

#

I dont know how to calculate

#

I mean, Ive found the XSS, I can exploit, but I dont know how can that impact the website

lilac spindle
#

I read which ones are relevant to the exploit then adjust accordingly

lilac spindle
patent glacier
#

Can we chat a little bit on private?

lilac spindle
#

I’d rather not. Maybe others can also pick up from this conversation and help you accordingly.

patent glacier
#

ok, no problem, thx a lot

past magnet
#

Hi guys, do you recommend bugcrowd or hackerone for bug bounty hunting?

quasi steeple
#

yes

tidal cliff
#

Do you guys know about blockchain? If yes then can you help me ?

unborn ice
raven dock
#

Hi, this is my first post (I think). I sincerely don't know how to start this post, so I will be completely honest. I'm "trying" to start my first bounty but I'm very hesitant because I don't want to mess it up (like click somewhere I shouldn't click on). What I'm looking for is a piece of advise or enlightment? or words of encouragement?

gleaming tartan
#

So if you "click somewhere I shouldn't click on" you're actually doing the very thing you sign on to do. That's because most if not all of the people who put that application/api/mobile app on the internet weren't thinking like you thinking. So that's your gift to them, thinking different.

#

I've developed software professionally and I promise you most developers are focussed on the happy path of their application. They want the data to flow to the next stage of their process. A very small number of them ask the question what would go wrong? And an even smaller number understand what can go wrong.

#

So there are no things you shouldn't click on. Clicking on the things you shouldn't in the order you shouldn't is the very essence of good testing.

#

So, go out there and grab that bug bounty, becuase the industry needs your help.

quasi steeple
# raven dock Hi, this is my first post (I think). I sincerely don't know how to start this po...

on the bug bounty platforms they will detail scope and rules of engagement. read them thoroughly and do your best to stay within those bounds.
They will also generally explicitly say whether or not they commit to safe harbor, meaning that they're not going to come after you for good faith security research. Not always 100% reliable but would rather work on something that offers it than something that doesn't.

Make sure you detail all steps you take with notes and screenshots - this isn't just to make your report better, but also to cover yourself.

raven dock
uneven galeBOT
#

Gave +1 Rep to @gleaming tartan (current: #2242 - 1)

raven dock
thorny verge
#

Are there like beginner BugBounty hunter teams you can join so you can learn from each other?

amber wagon
gloomy barn
cobalt aurora
#

@thorny verge I d' love to join

midnight estuary
supple acorn
warm belfry
#

Why don't u make one @thorny verge

fallen palm
#

have u made the team guys?

thorny verge
opaque flare
#

I am interested In Joining

raw quiver
#

I'd be down for collaborating on some bounties. From Canada here.

grand lance
#

that would be amazing actually! ive been wanting to get into bounties since ive been learning from thm but after trying i realized i need some people to talk to mentor and learn from. im 110% in

storm lava
plain vine
#

me too

thorny verge
#

if anyone that hasnt been invited yet wants to join they can add me

gentle gust
#

How accurate are these steps?

20240424_062911.jpg
tranquil bluff
raw quiver
#

That's a pretty good list of things to do. Thou XSS, Clickjacking and Rate Limit Bypassing are often out of scope.

dreamy nest
#

xss is rare to be out of scope

copper tundra
#

Im looking into getting into web application pentesting does anyone have any idea where to begin and what appilcations to use. I was learning in my college days and was looking to start again

#

any tips and advice in starting over is appreciated

lilac spindle
#

Then I recommend trying to build a web app yourself. It doesn’t necessarily help directly but it helps understanding how a developer thinks. Look at theodinproject.com

copper tundra
uneven galeBOT
#

Gave +1 Rep to @lilac spindle (current: #20 - 418)

lilac spindle
#

Then try your hand at some challenges in HTB or THM

#

You can always start bug bounty when you feel like it but I recommend watching others to see how their methodology is done

cyan eagle
#

how to get started

lilac spindle
lilac spindle
#

Not to discourage anyone from bug bounty but this is something you should watch.
https://www.youtube.com/watch?v=6SNy0u6pYOc

YouTube
DEFCONConference
DEF CON 32 - The Darkest Side of Bug Bounty - Jason Haddix

Bug bounty is an intricate game between the bug hunter, the clients, and the intermediary.

Like any game, it can be hacked. Like some games, it can be unfair.

Join Jason as he walks you through the darker secrets of bug bounty , tips and tricks to address them, and in some cases, commiserate that there are just bad realities to the game.

Jaso...

▶ Play video
last raptor
#

Huh. Did he retire his TBHM course? I can't find it any longer

half sleet
#

how do i report a bug on thm

#

a bug on the website

jagged sail
jagged sail
sullen temple
edgy badge
#

what is the best bug hunting community site?

obtuse fern
spark lodge
#

any good video playlists to learn bb?

#

planning to study hackersploit's and nahamsec

obtuse fern
forest plover
#

hi sir

sullen nova
#

How much of cybersecurity and offensive security knowledge do you need to have in order to get started in bug bounty hunting?

stuck folio
sullen nova
uneven galeBOT
#

Gave +1 Rep to @stuck folio (current: #356 - 15)

obtuse fern
sullen nova
obtuse fern
lavish hollow
past finch
twilit elm
#

Hi there, I am asking with the highest naivety if someone could start bug bounty (on which platforms ?) without prior networks and built trust, provided that he would follow with serious scope rules and guidances ?
Thx

#

Also, I was wondering if it's aimed at particulars subnet ips or actually on production networks ?

sullen nova
uneven galeBOT
#

Gave +1 Rep to @obtuse fern (current: #33 - 269)

thorny tartan
#

I want to learn bug huntingHow can i ?

obtuse fern
#

https://tryhackme.com/module/web-hacking

TryHackMe
TryHackMe | Web Hacking

This module helps the user become familiar with web applications, JavaScript, database systems, and SQL. Furthermore, it teaches the basics of BurpSuite so the user gains the necessary knowledge to conduct various web application security tests. Finally, it covers the OWASP Top 10 web application security risks.

wispy barn
#

so i want to join a bug bounty program for an online game, im very new to this, but what vulnerabilities or flaws should i look for? Or what stuff should i try etc

#

btw by new, i mean that im new to both bug bounties and finding vulnerabilities in online games. im experienced in networking, iot, etc, and have a lot of exprerience in hacking in general

obtuse fern
wispy barn
lethal creek
#

Is there a big difference in ctfs and bug bounties besides the passive enumeration part? Like will exploitation techniques in ctfs occur in bug bounties ?

obtuse fern
lethal creek
#

I see

small salmon
#

If you want to learn bug bounty

thorny tartan
#

Anyone here who is a bug hunter ?

#

I need some guide from him

wispy barn
still scarab
wispy barn
mint patio
#

Can anyone tell me where I can ready cyber blogs related to web hacking

obtuse fern
mint patio
#

Thanks

obtuse helm
#

Hey, is anyone a frequent Bounty Hunter on HackerOne? I have some small doubts

unborn ice
#

Just ask your question, we may, or may not be able to answer.

weary siren
#

How should I start bug bounty please help me

obtuse fern
weary siren
#

KDB are you bughunter

#

@obtuse fern

obtuse fern
weary siren
obtuse fern
weary siren
#

How long do you think this will take?

obtuse fern
#

It depends on you 🙂

weary siren
#

do you have roadmap for bug bounty

obtuse fern
# weary siren do you have roadmap for bug bounty

As I said , this THM is a good starting point . After that you can move to something like Burp's Web Security Academy 🙂 . Then you can do some CTFs , practice and then try your luck and skills on some real bug bounty programs 😄

weary siren
#

Do I need to know any programming language?

#

thank you for your information dude

obtuse fern