51/ Look at a programs leaderboard to see who you should collab with
52/ When collaborating, an even bounty split eliminates hassle
53/ Take a break when you stop having fun
54/ At an LHE, start hacking ahead of time
55/ Look for programs that are active in resolving reports

56/ Look for programs that haven't awarded a lot recently
57/ Look for programs that have collaboration enabled
58/ Look for programs that don't list out a bunch of known issues
59/ Look for programs that have a history of adding new scope
60/ Change your strategy if you've gone a while without a finding

61/ If you're on a roll, keep doing what you're doing
62/ But don't let success keep you from evolving/growing
63/ Compare yourself against yourself from last year
64/ Maintain online presence for new opportunities
65/ Be thankful for failure

66/ Read disclosed reports
67/ Focus on one program at a time. Cycle if you get bored.
68/ Don't spray XSS payloads everywhere
69/ If possible, work at a company that has a BBP
70/ Spend bounty money on tools that will generate more bounties

71/ Budget a specific amount of your bounties for fun. And stick to it.
72/ When hacking a store, don't be afraid to make small purchases
73/ Look for changes in JS files to know when there may be new functionality
74/ Look for references to subdomains in a company's GH repos
75/ Look for references to subdomains in employee's GH repos

76/ If the app uses Intercom, try booting it with another email
77/ Look for second-degree IDORs
78/ SSRFs exist when the app makes any external request. Look for these requests.
79/ Look for actuator endpoints
80/ Find hackers that hack differently than you.

81/ Try hacking in a different room of the house
82/ Try hacking at a different location altogether
83/ If you find the same bug on different endpoints, file as different bugs
84/ Try always having some pending bugs in your pipeline
85/ Break your yearly bounty goal into monthly goals

86/ Know when a bounty isn't worth fighting over
87/ Push back gently when a report gets downgraded
88/ Use the leaderboard as motivation, not as comparison
89/ Don't re-invent the wheel when a tool exists
90/ Don't be afraid to build the wheel if the tool doesn't

91/ Try collabing in real time over video chat
92/ Always ask why something works the way it does
93/ When collabing, don't be afraid to be the underperformer
94/ When collabing, don't get salty about being the overperformer
95/ Use mediation, but use it sparingly

96/ Be generous with your earnings
97/ Hack for fun, not for a paycheck
98/ LHEs are a privilege, not an expectation
99/ Programs are your friend, not your adversary. Work with them
100/ The platform is your friend, not your adversary. Work with them

credit by @ArchAngelDDay

#bugbountytips

#bitrix

Карочи, в админку в битриксе иногда можно зайти просто зарегистрировавшись.
Но у многих кнопка регистрации вовсе отсутствует, но это не мешает вызвать стандартные формы:

/auth/?register=yes
/crm/?register=yes
/auth/oauth2/?register=yes

Наличие форм, кстати, тоже не обязательно, достаточно разгадать капчу (если она вообще есть) и отправить POST-запрос на регу.

Помимо стандартных путей, существуют еще demo-проекты:

/bitrix/wizards/bitrix/demo/public_files/ru/auth/index.php?register=yes
/bitrix/wizards/bitrix/demo/modules/examples/public/language/ru/examples/custom-registration/index.php
/bitrix/wizards/bitrix/demo/modules/examples/public/language/ru/examples/my-components/news_list.php?register=yes
/bitrix/wizards/bitrix/demo/modules/subscribe/public/personal/subscribe/subscr_edit.php?register=yes

Или можно попробовать обратиться к подобным модулям:

/bitrix/modules/bitrix.siteinfoportal/install/wizards/bitrix/infoportal/site/public/ru/personal/profile/index.php?register=yes
/bitrix/modules/bitrix.siteinfoportal/install/wizards/bitrix/infoportal/site/public/ru/board/my/index.php?register=yes

После регистрации (получив валидный сессионный идентификатор), можно побрутить директорию /bitrix/ следующими файликами.

Вот и закончилась конференция KazHackStan, организаторы были гостеприимны к иностранным гостям, сняли им дорогой отель и угостили барашком.

Доклады, которые были на конференции прикреплены файлами к посту выше:

«Выйди и зайди нормально!» (Ломаем Bitrix)
@i_bo0om

«Атакуем языковые модели»
@wearetyomsmnv

«Что нужно учитывать при первом участии в Bug Bounty?»
@turbobarsuchiha — triage team Standoff365

«Ломаем Ethereum: Пентестинг Смарт-Контрактов»
@gspdnsobaka — triage team Immunefi

«Red Purple Team»
@Sn0w7 — lead MTC RED

«DevSecOps»
@gazizovasg — Swordfish

«Как ломать SAML, если у меня лапки?»
@agrrrdog — Acunetix

«Offensive OSINT»
@adkkkkkkkk — Innostage