Обещали — публикуем! 👀

На нашем YouTube-канале Positive Events можно посмотреть записи выступлений со стенда Positive Technologies на IT-пикнике, который прошел в Коломенском.

•‎ Уязвимости в тренде? Как понять, что вы не дуршлаг. О том, как создавать продукты, делающие компании неуязвимыми к кибератакам

•‎ Как поймать хакера с помощью искусственного интеллекта

•‎ Как устроен мир вокруг нас: реверс-инжиниринг embedded-устройств

•‎ Преступления в open source: расследуем трояны в Python Package Index

•‎ Как (не) потерять годовой бюджет компании из-за одной ошибки в коде

• Пароль: N4GOR5HK3S!D1TKOROL. Что хакерам известно о паролях

•‎ Как заработать на ипотеку, или Вкатываемся в bug bounty

Приятного просмотра! 🍿

#PositiveЭксперты

100 (very) short bug bounty rules:

1/ Spend at least 30 minutes on a new target
2/ Look for "No"s
3/ Use Italics Tags in your inputs instead of XSS payloads
4/ Focus on SaaS apps that are multi-tenant
5/ Buy Burp Pro

6/ On a new target go straight to the User Management section
7/ See if inviting an existing user to your org exposes their name
8/ See if inviting an existing user removes them from their own org
9/ If the scope has a wildcard, use subfinder to find subdomains
10/ Run HTTPX on the list of subdomains to narrow down alive targets

11/ On an app you're not familiar with, use it like a normal user first
12/ If the docs say you can't do X, but you can do X then you have a bug
13/ Use match & replace rules to find new endpoints
14/ Budget time into your week specifically for hacking
15/ Give yourself a no-bug time limit. I do 3 hours.

16/ Go back to old dupes and see if you can still reproduce.
17/ Look for "+2" in your reputation log to find dupes that should be now.
18/Ask for help from other hackers
19/ Make your report a conversation, not a sales pitch
20/ Accept & expect that dupes will happen

21/ File & Forget
22/ If an endpoint has "api/v2/", try "api/v1/"
23/ If an endpoint has "api/v2", try removing the "v2" altogether
24/ 6 $1000 Mediums pay more than 1 $5,000 crit. Don't ignore any bugs
25/ Lows are still bugs that should be filed

26/ Be kind to your triager
27/ Say "thank you" when you get a bounty
28/ If an app uses UUIDs, you can still look for IDORs. Just set "AC:H".
29/ If UUID IDORs exist, then look for an endpoint that exposes UUIDs
30/ Pin your success on whether your followed your plan, not if you found bugs

31/ A program that has a lot of hackers doesn't mean there isn't low-hanging fruit
32/ Going deep _will_ payoff
33/ Working with new hackers will payoff in dividends
34/ Don't be jealous
35/ Bug Bounty income isn't consistent. Be okay with peaks & valleys for your own sanity

36/ If you find a bug that's OOS, still ask the customer if they care
37/ There's no end. Enjoy the journey
38/ Have a hobby that's not related to hacking
39/ Have friends that don't hack
40/ Figure out what time of day you hack the best. Late nights aren't for me.

41/ Spend that extra 2 minutes to make your report look/read nice
42/ "Subscribe" to programs that pay well and have good scope
43/ Don't whine on Twitter about a single report. Or at all for that matter.
44/ IDORs and Privilege Escalations are a great place to start
45/ Unmet expectations lead to disappointment

46/ Teach someone else how to hack
47/ Time spent reading/learning is time-well spent
48/ Focus on programs that you actually use in your day-to-day
49/ Establish a relationship with the program
50/ Try asking the program what types of bugs they want to see

#bugbountytips

51/ Look at a programs leaderboard to see who you should collab with
52/ When collaborating, an even bounty split eliminates hassle
53/ Take a break when you stop having fun
54/ At an LHE, start hacking ahead of time
55/ Look for programs that are active in resolving reports

56/ Look for programs that haven't awarded a lot recently
57/ Look for programs that have collaboration enabled
58/ Look for programs that don't list out a bunch of known issues
59/ Look for programs that have a history of adding new scope
60/ Change your strategy if you've gone a while without a finding

61/ If you're on a roll, keep doing what you're doing
62/ But don't let success keep you from evolving/growing
63/ Compare yourself against yourself from last year
64/ Maintain online presence for new opportunities
65/ Be thankful for failure

66/ Read disclosed reports
67/ Focus on one program at a time. Cycle if you get bored.
68/ Don't spray XSS payloads everywhere
69/ If possible, work at a company that has a BBP
70/ Spend bounty money on tools that will generate more bounties

71/ Budget a specific amount of your bounties for fun. And stick to it.
72/ When hacking a store, don't be afraid to make small purchases
73/ Look for changes in JS files to know when there may be new functionality
74/ Look for references to subdomains in a company's GH repos
75/ Look for references to subdomains in employee's GH repos

76/ If the app uses Intercom, try booting it with another email
77/ Look for second-degree IDORs
78/ SSRFs exist when the app makes any external request. Look for these requests.
79/ Look for actuator endpoints
80/ Find hackers that hack differently than you.

81/ Try hacking in a different room of the house
82/ Try hacking at a different location altogether
83/ If you find the same bug on different endpoints, file as different bugs
84/ Try always having some pending bugs in your pipeline
85/ Break your yearly bounty goal into monthly goals

86/ Know when a bounty isn't worth fighting over
87/ Push back gently when a report gets downgraded
88/ Use the leaderboard as motivation, not as comparison
89/ Don't re-invent the wheel when a tool exists
90/ Don't be afraid to build the wheel if the tool doesn't

91/ Try collabing in real time over video chat
92/ Always ask why something works the way it does
93/ When collabing, don't be afraid to be the underperformer
94/ When collabing, don't get salty about being the overperformer
95/ Use mediation, but use it sparingly

96/ Be generous with your earnings
97/ Hack for fun, not for a paycheck
98/ LHEs are a privilege, not an expectation
99/ Programs are your friend, not your adversary. Work with them
100/ The platform is your friend, not your adversary. Work with them

credit by @ArchAngelDDay

#bugbountytips