Bug Bounty Thread

Don't think we've ever had a bug bounty thread. I hope we can keep this alive for a while. >Platforms https://hackerone.com https://www.bugcrowd.com/ Resources for getting started, feel free to post some more. >Bug Bounty Methodology v3 from Jason Haddix. https://www.youtube.com/watch?v=Qw1nNPiH_Go >A list of write ups, can be useful for getting an idea of what kind of vulnerabilities to look for. https://github.com/ngalongc/bug-bounty-reference/blob/master/README.md Hasn't been updated in a couple months. >OWASP testing guide. https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents >Hackerone hacktivity. https://hackerone.com/hacktivity >Interviews with successful bug hunters. https://www.youtube.com/user/yaworsk1/videos I've only found 4 valid bugs over the past 2 years. I'm interested in how others have progressed. Also I'm going to try to post a new write up every week or so to keep this thread alive.

>>6620 That's an interesting thread. I have found a couple of bugs in non bug-bounty sites, but most of them was just running dirsearch... I regularly play ctfs, I mostly do pwn, re and web. I tried bug bounty, but without success. Any tips how to get better at bug-bounty? I regularly read /hacktivity on hackerone and I know that most of bugs are trivial to exploit, but it's hard to find them.

>>6622 Honestly, I don't really feel like qualified for giving advice, since the bugs I found were for programs with huge scopes and no pay. I consider these programs to be easier than others. From what I've gathered just from reading advice from others is that alot of bugs will require you to perform multiple steps to find them. Basically, it might not be as simple as dropping an xss payload somewhere and winning, because web devs are more aware of them now. Most of the guys making huge money off of this will post new bypasses and little tips on twitter as well.

>>6622 here >>6628 I think that a good practice would be to have a 'corpus of bugs/vulns' and for each target: a) detect scope (all domains/addresses) b) for each element in scope try this 'corpus' c) if nothing works try anything what comes to your mind and then move on to another bug-bounty program I think that most cash is made when someone find 'new way' or 'not yet posted on /r/netsec way' of exploiting, like this guy who found like 6 cache-poisoning vulns, then posted his writeup on r/netsec and now everyone has cache-poisoning in his 'corpus' But my corpus it too small or maybe I hadn't had enough luck/hadn't spent enough time trying. Maybe there is a better approach, idk.

>>6659 It's definitely true that new vulns and techniques get people big money, but it seems to me that there are more people who simply find write-ups religiously and incorporate it in their hunting. For example people like Ron Chan, he started with basically no IT knowledge, but learned how to just through googling what he didn't know and reading write-ups. (His interview is on the channel I put in the op) That's why I think following the successful bug hunters on twitter and watching for write-ups are so important . You have to keep your 'corpus' at the cutting edge to stay ahead of developers. Funny enough I never did this until last week, and I just submitted a bug for a private program that will hopefully payout 1k. Anyway here's this weeks write-up as promised in the OP. >Server-side Request Forgery in OpenID support https://medium.com/@putracraft.theworld/server-side-request-forgery-in-openid-support-defcc64d5e41

>>6726 Congrats! Where have you found this private program? Would you mind sharing?

>>6732 I'm not him, but as far as private programs go, you generally need to be invited to participate.

>>6732 >>6733 Yes I was doing this program on hackerone and you need to be invited. I think once you have certain signal score, that's when you start getting automatic invites. I started getting them when my fourth bug was resolved. As for this bug itself it's nothing complicated, it was just some amazon aws keys that were left in the javascript of a dev server. I swear finding dev servers is like a free win. You're pretty much guaranteed at least some useful recon information from finding them. 3 out of the 4 previously submitted bugs were on dev servers.

>>6735 dev or anything with test :P

>>6742 >>6735 yeah, I agree, but there are dozens of people trying for dev servers. I feel like recon is my weak spot. What tools do you recomend to recon? I have used aquatone and it's great, but I feel like there should be more of it. >>6733 Sounds awesome, I should try to find a few bugs and then try private programs. I think that they are easier because less people participate in them.

I just wanted to extend my post, as aquatone isn''t only tools I use. My usual setup wepons oc choice are: aquatone for enumerating domains/hidden servers nmap for scanning ports on those domains dirsearch for fast guessing possible endpoints Any other reccomendations? Also, any writeups better than nullbytewonderhowto kind of stull which contain recon are welcome!

>>6744 I prefer subfinder for web scraping, massdns for brute forcing, nmap for port scanning, and wfuzz for directory bruteforcing. Also looking in the javascript or even seeing what burp has passively found can yield results. I don't really know too much about aquatone to compare it with what I use. The bug hunter methodology v3 presentation in the op goes over subdomain enumeration, that's pretty much all I know. This presentation covers some different recon techniques. I'm looking forward to using the scans.io data, but I need a new hard drive. >LevelUp 0x02 - Practical recon techniques for bug hunters & pen testers https://www.youtube.com/watch?v=McLdm4c1oLs

>>6746 Thanks Have you tried with autonomus scanner? https://2018.zeronights.ru/wp-content/uploads/materials/4%20ZN2018%20WV%20-%20BugBounty%20automation.pdf After this presentation I feel like I need to create one

I don't know if this will be any help, but it's a book on web hacking that explains bugs by the guys at hackerone.

>>6748 Woah this looks awesome. This kind of thing would be great for finding low hanging fruit. I'll definitely look into stuff like this once I get a vps. Thanks for sharing.

>>6757 Check this out: https://twitter.com/Alra3ees/status/1080276301909504002 :)

>Gaining access to Uber's user data through AMPScript evaluation https://blog.assetnote.io/bug-bounty/2019/01/14/gaining-access-to-ubers-user-data-through-ampscript-evaluation/

>>6726 Nice job posting some security-related OC. This board needs more of it.

>>6726 Nice OC Would you be willing to fix some minor grammar issues in your medium post if I put the corrections in a pastebin?

>>6898 >>6907 These aren't my write ups, I'm just posting new right ups that I find interesting. Also bug crowd is stream their live internet conference thing right now. https://www.bugcrowd.com/event/level-up-0x03/ The serverless Top 10 talk is going on now. It's a pretty sick presentation. I'll try to post the slides when they're up. I feel like serverless bugs are going to be a big deal in the future. Check out the owasp top 10 for serveless stuff https://www.owasp.org/images/5/5c/OWASP-Top-10-Serverless-Interpretation-en.pdf

https://mirror.eu.oneandone.net/projects/media.ccc.de/congress/2018/webm-hd/35c3-9979-eng-deu-fra-The_Laymans_Guide_to_Zero-Day_Engineering_webm-hd.webm found this little gold nugget today, hope you guys enjoy as much as i did (also make sure to read the blogpost mentioned)

>>6938 Finding 0 days like this has always been fascinating to me. I wish I watched this before I gave up on exploit development stuff. Turning crashes into working exploits always seemed like high level wizardry to me. The bug crowd event is up on youtube if anyones wondering. https://www.youtube.com/playlist?list=PLIK9nm3mu-S61oMP7pie5d2t1Aah41Fji Hopefully the slides get uploaded soon.

Heres a tip: Github recon. I've really started going places with this. Just start searching in github for their domains/urls/parameters and you might find something helpful. Even if you don't find their backend code, devs will often leak their testing domains which is cool. If you see a weird request or something that stands out (like a comment in the html) search it on github. Just got a $500 bounty from a dev uploading their sql credentials on github. There's really nothing to lose. Also a write up >Dude bypassing googles 2fa just from waiting lol https://medium.com/@lukeberner/how-i-abused-2fa-to-maintain-persistence-after-a-password-change-google-microsoft-instagram-7e3f455b71a1