Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Free Bugs Campaign

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for 8ayac 8ayac
March 11, 2019
Technology
990
0

Free Bugs Campaign

Burp Suite Japan LT Carnivalの登壇資料

Avatar for 8ayac

8ayac

March 11, 2019

More Decks by 8ayac

See All by 8ayac
MBSD Cybersecurity Challenges 2018 最終審査会 発表スライド
Avatar for 8ayac 8ayac
0
1.9k
MBSD Cybersecurity Challenges 2017 最終審査会 発表スライド
Avatar for 8ayac 8ayac
0
670

Other Decks in Technology

See All in Technology
Amazon Quick on DesktopがIAM Identity Centerで動かない理由
Avatar for YukiOgawa yukiogawa
0
170
Screen Lens - 今見てる画面を翻訳する
Avatar for komagata komagata
0
260
日経電子版を支えていく Kasane Design System/fec_fukuoka
Avatar for 日本経済新聞社 エンジニア採用事務局 nikkei_engineer_recruiting
0
1k
2026_devsumi_ozono.pdf
Avatar for O3(ozono) o3
3
440
クロスボーダーM&AのValue Upを支えるプロダクト開発。日米チームのハブになったプロダクトエンジニアの実践 / Product Engineering Conference 2026
Avatar for GENDA genda
0
120
あるけみー式LTスライド作成術
Avatar for Ryotaro Harada alchemy1115
1
200
#jawssonic2026 あの時代が悪かった ~動かなかったSageMakerと共に迎えたイベント当日~
Avatar for Kana Kitagawa ktkn1129
0
150
事業課題から技術的負債に向き合う
Avatar for SansanTech sansantech
PRO
1
220
目の前の楽しいが人生を変える - コミュニティの螺旋の歩き方と楽しむコツ / change your life
Avatar for soudai sone soudai
PRO
4
530
すぐできる衛星通信対応 あとは山奥に行くだけ
Avatar for tatetate55 tatetate55
0
110
「図書館」という名前のままでいいのか -Code4Lib JAPANカンファレンス2026 アンカンファレンス報告- / Code4Lib JAPAN Conference 2026: Unconference Report
Avatar for Kiyota Yoji, Ph.D. ykiyota
0
170
Slack上でインフラをトラブルシュートする！ Agentic Platform Engineeringの第一歩
Avatar for teru0x1 teru0x1
4
1.5k

Featured

See All Featured
Fireside Chat
Avatar for paigeccino paigeccino
43
4k
The State of eCommerce SEO: How to Win in Today's Products SERPs - #SEOweek
Avatar for Aleyda Solis aleyda
2
11k
Jamie Indigo - Trashchat’s Guide to Black Boxes: Technical SEO Tactics for LLMs
Avatar for Tech SEO Connect techseoconnect
PRO
0
670
Odyssey Design
Avatar for Ryan Kendrick rkendrick25
PRO
2
800
Money Talks: Using Revenue to Get Sh*t Done
Avatar for Nikki Halliwell nikkihalliwell
0
490
Unlocking the hidden potential of vector embeddings in international SEO
Avatar for Frank van Dijk frankvandijk
0
930
Winning Ecommerce Organic Search in an AI Era - #searchnstuff2025
Avatar for Aleyda Solis aleyda
1
2.1k
Pawsitive SEO: Lessons from My Dog (and Many Mistakes) on Thriving as a Consultant in the Age of AI
Avatar for David Carrasco davidcarrasco
0
240
The Impact of AI in SEO - AI Overviews June 2024 Edition
Avatar for Aleyda Solis aleyda
6
1.2k
エンジニアに許された特別な時間の終わり
Avatar for watany watany
108
250k
Ecommerce SEO: The Keys for Success Now & Beyond - #SERPConf2024
Avatar for Aleyda Solis aleyda
1
2.1k
Measuring & Analyzing Core Web Vitals
Avatar for Philip Tellis bluesmoon
9
990

Transcript

  1. None

  2. : -> @8ayac (Twitter/HackerOne/Flickr) 2 PSIRT (’18/04~) MBSD Cybersecurity Challenges

    (’17/’18) GitLab Bug Bounty Program - Hall of Fame 7 (2018) 45 BugHunt / (←New!) CWE CWE-79 / CWE-400 Follow @8ayac 1

  3. Follow @8ayac 2

  4. Free Bugs Campaign Follow @8ayac 3

  5. Free Hugs Campaign ※ Follow @8ayac 4

  6. None
  7. None

  8. Burp Pro Cy-PSIRT HackerOne Follow @8ayac 7

  9. CVE-XXXX-XXXX … ( Burp Pro ) Follow @8ayac 8

  10. None

  11. Follow @8ayac 10

  12. Follow @8ayac 11

  13. None
  14. None

  15. Follow @8ayac 14

  16. Follow @8ayac 15

  17. + DEMO + α Stored XSS(1) - $0 - $0

    Stored XSS(2) - $0 Free Bugs Campaign Follow @8ayac 16
  18. None

  19. OSS GitLab Issue Tracker / ✨ Follow @8ayac 18

  20. None

  21. Title: Issue Stored XSS Issue Type: XSS(CWE-79) Severity: High(7~8.9) Affected

    Versions: 11.3.x < 11.3.1 11.2.x < 11.2.4 11.1.x < 11.1.7 Report: https://hackerone.com/reports/384255 Follow @8ayac 20
  22. None

  23. https://github.com/gitlabhq/gitlabhq/commit/6d360c210d3d822fc266eecc04753481ae4bda70#diff-ebb2ac556337fa87bae1c9e999fca8cfR2 Follow @8ayac 22

  24. None

  25. Follow @8ayac 24

  26. Follow @8ayac 25

  27. Follow @8ayac 26

  28. Follow @8ayac 27

  29. GitLab Public Program 10 Follow @8ayac 28

  30. Title: Issue Type: Information Exposure Through Browser Caching(CWE-525) Severity: Medium

    Affected Versions: 11.4.x < 11.4.3 11.3.x < 11.3.8 11.2.x < 11.2.7 Report: https://hackerone.com/reports/407763 Follow @8ayac 29
  31. None

  32. https://github.com/gitlabhq/gitlabhq/commit/782badd0a2cd00d2a9cbe591e78b30aca32e252b#diff-55c5b7aecfb519d0e4880eaf2788eb6e Follow @8ayac 31

  33. None

  34. Follow @8ayac 33

  35. Follow @8ayac 34

  36. Follow @8ayac 35

  37. Follow @8ayac 36

  38. Follow @8ayac 37

  39. Follow @8ayac 38

  40. Follow @8ayac 39

  41. Follow @8ayac 40

  42. Follow @8ayac 41

  43. Follow @8ayac 42

  44. Public Program Private Follow @8ayac 43

  45. Title: Stored XSS Issue Type: XSS(CWE-79) Severity: High Affected Versions:

    11.4.x < 11.4.3 11.3.x < 11.3.8 11.2.x < 11.2.7 Report: https://hackerone.com/reports/409380 Follow @8ayac 44
  46. None

  47. Follow @8ayac 46

  48. None
  49. None

  50. GitLab Public Program ! !(Low $1000) : https://hackerone.com/gitlab/policy_versions?change=3597572# Follow @8ayac

    49

  51. Follow @8ayac 50

  52. Follow @8ayac 51

  53. Follow @8ayac 52

  54. Follow @8ayac 53

  55. Follow @8ayac 54

  56. Follow @8ayac 55

  57. Follow @8ayac 56

  58. None
  59. None

  60. @zseano : Are you submitting bugs for free when others

    are being paid?... Follow @8ayac 59

  61. Follow @8ayac 60

  62. Private Private Researcher Follow @8ayac 61

  63. Private Private Researcher Follow @8ayac 62

  64. Free Bugs Campaign : Public Private Follow @8ayac 63

  65. Follow @8ayac 64

  66. Follow @8ayac 65

  67. None

  68. $500 ( ) “Private Program” GitLab ( HackEDU) 100 Burp

    ( ) Follow @8ayac 67

  69. ☺