Pinned
Philippe Delteil
1,917 posts
- Probably on of the best reports I ve read: Starbucks | Report #502758 - RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/ | HackerOne
- Bug bounty hunting is very stressful. Hunters have al most no power against companies or platforms. There's an asimetry of power and information. Programs (companies) can refuse to accept a bug just because they can. Programs might delay triage and payment for months, even years
- I reported a DNS takeover, the POC is a TXT DNS record. Report says "dig TXT poc.domain". Triager opens domain in the browser. Claims is not reproducible... What!?
- I get a lot of DMs asking how to start in bug bounty. I can give you 4 advises that helped me a lot: 1. Stop reading writeups and watching videos and start hunting. 2. Check @Jhaddix's methodology (got my first bounty this way) 3. Start practicing in @hackthebox_eu (@Viss)
- Jason Haddix "The Darkest Side of Bug Bounty" - I closed all my github projects related to Bug Bounty, except templates that are very basic. - I don't use any specific headers - I don't talk in open discord/channels
- If you want to start in bug bounty hunting this is my recommendation regarding platforms (best to worst): 1. Intigriti : Fair triaging, excellent support. 2. HackerOne: A big amount of programs. Bounties are higher. 3. Yeswehack: Fast triaging 4. Bugcrowd: If you are bored.
- This is interesting.. A company had a functionality to confirm the user's email address. The POST request had a JSON like : {"emails": [ "[email protected]"]} I repeated the address: {"emails": [ "[email protected]", "[email protected]"]} It worked. Tested 10 worked
- Triagers can do an awful job. Closing valid reports as NA, not responding comments. But If I tweet a joke I get a warning! I wish @Hacker0x01 were as fast with mediation tickets I have still l open since December 2024.
- This is the general vibe in Bugcrowd Marked 20 reports as NA without any explanation. #bugcrowd #Bugbounty
- This is what my set of Bug bounty programs looks like (using BBRF) How to install BBRF: medium.com/hacking-info-s… BBRF by @honoki #BugBounty #bugbountyhunting #BBH
- I started adding Hackerone programs to the repo scammy bug bounty. The source is publicly disclosed reports. Also included discussions so we can specify and comment the problems with any given report. Feel free to add some!
