Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Free Bugs Campaign

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for 8ayac 8ayac
March 11, 2019
Technology
980
0

Free Bugs Campaign

Burp Suite Japan LT Carnivalの登壇資料

Avatar for 8ayac

8ayac

March 11, 2019

More Decks by 8ayac

See All by 8ayac
MBSD Cybersecurity Challenges 2018 最終審査会 発表スライド
Avatar for 8ayac 8ayac
0
1.9k
MBSD Cybersecurity Challenges 2017 最終審査会 発表スライド
Avatar for 8ayac 8ayac
0
660

Other Decks in Technology

See All in Technology
Claude Code公式skillで 自分の仕事を少しずつ手放そう！（Claude Code開発ノウハウ大公開スペシャル by クラスメソッド）
Avatar for Kei Masaoka kaym
1
250
Making sense of Google’s agentic dev tools
Avatar for Guillaume Laforge glaforge
1
180
LLM/Agent評価：トップ営業の発言を「正解」にする 〜暗黙的正解による評価を営業資産に変える〜
Avatar for Hirotaka takkuhiro
1
210
AICoEでAIネイティブ組織への進化
Avatar for YukiOgawa yukiogawa
0
160
「早く出す」より「事業に効く」 ── 顧客の業務サイクルから逆算するAI時代の二重ループ開発と「変化の設計者」 / devsumi2026
Avatar for Rakus_Dev rakus_dev
1
210
GuardrailからGovernanceへ～AIエージェント運用の次の課題～
Avatar for 吉岡駿 sbspsy
2
270
Oracle Exadata Database Service on Cloud@Customer X11M (ExaDB-C@C) サービス概要
Avatar for oracle4engineer oracle4engineer
PRO
2
8.4k
Empower GenAI with Agile - あなたのアジャイルが生成AIのバフになる仕組み
Avatar for Hiroyuki Ito (TheHiro) hageyahhoo
1
170
ヘルスケア領域における AI 活用と その安全性担保のための取り組み (Leveraging AI in Healthcare and Our Efforts to Ensure Its Safety) - Google I/O Extended Tokyo 2026, July 11, 2026
Avatar for Akira Tameoka zettaittenani
0
270
プロダクトだけじゃない、社内プロセスにおける自動化・省力化ノススメ
Avatar for KAKEHASHI kakehashi
PRO
1
3.6k
はじめてのWDM
Avatar for miyukichi_ospf miyukichi_ospf
1
140
「最後に責任を取るのはチーム」— 人間のPRレビューを最小化してアップデートしたメンタルモデル
Avatar for Jotaro Nishime jnishime_dresscode
0
540

Featured

See All Featured
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
Avatar for Tammy Everts tammyeverts
55
3.4k
Noah Learner - AI + Me: how we built a GSC Bulk Export data pipeline
Avatar for Tech SEO Connect techseoconnect
PRO
0
210
Performance Is Good for Brains [We Love Speed 2024]
Avatar for Tammy Everts tammyeverts
12
1.7k
brightonSEO & MeasureFest 2025 - Christian Goodrich - Winning strategies for Black Friday CRO & PPC
Avatar for Christian Goodrich cargoodrich
3
750
Keith and Marios Guide to Fast Websites
Avatar for Keith Pitt keithpitt
413
23k
Code Reviewing Like a Champion
Avatar for maltzj maltzj
528
40k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
Avatar for Stéphanie Walter stephaniewalter
287
14k
[Rails World 2023 - Day 1 Closing Keynote] - The Magic of Rails
Avatar for Eileen M. Uchitelle eileencodes
38
2.9k
From Legacy to Launchpad: Building Startup-Ready Communities
Avatar for Dug Song dugsong
0
260
Odyssey Design
Avatar for Ryan Kendrick rkendrick25
PRO
2
730
A brief & incomplete history of 
UX Design for the World Wide Web: 1989–2019
Avatar for Jason CranfordTeague jct
2
420
For a Future-Friendly Web
Avatar for Brad Frost brad_frost
183
10k

Transcript

  1. None

  2. : -> @8ayac (Twitter/HackerOne/Flickr) 2 PSIRT (’18/04~) MBSD Cybersecurity Challenges

    (’17/’18) GitLab Bug Bounty Program - Hall of Fame 7 (2018) 45 BugHunt / (←New!) CWE CWE-79 / CWE-400 Follow @8ayac 1

  3. Follow @8ayac 2

  4. Free Bugs Campaign Follow @8ayac 3

  5. Free Hugs Campaign ※ Follow @8ayac 4

  6. None
  7. None

  8. Burp Pro Cy-PSIRT HackerOne Follow @8ayac 7

  9. CVE-XXXX-XXXX … ( Burp Pro ) Follow @8ayac 8

  10. None

  11. Follow @8ayac 10

  12. Follow @8ayac 11

  13. None
  14. None

  15. Follow @8ayac 14

  16. Follow @8ayac 15

  17. + DEMO + α Stored XSS(1) - $0 - $0

    Stored XSS(2) - $0 Free Bugs Campaign Follow @8ayac 16
  18. None

  19. OSS GitLab Issue Tracker / ✨ Follow @8ayac 18

  20. None

  21. Title: Issue Stored XSS Issue Type: XSS(CWE-79) Severity: High(7~8.9) Affected

    Versions: 11.3.x < 11.3.1 11.2.x < 11.2.4 11.1.x < 11.1.7 Report: https://hackerone.com/reports/384255 Follow @8ayac 20
  22. None

  23. https://github.com/gitlabhq/gitlabhq/commit/6d360c210d3d822fc266eecc04753481ae4bda70#diff-ebb2ac556337fa87bae1c9e999fca8cfR2 Follow @8ayac 22

  24. None

  25. Follow @8ayac 24

  26. Follow @8ayac 25

  27. Follow @8ayac 26

  28. Follow @8ayac 27

  29. GitLab Public Program 10 Follow @8ayac 28

  30. Title: Issue Type: Information Exposure Through Browser Caching(CWE-525) Severity: Medium

    Affected Versions: 11.4.x < 11.4.3 11.3.x < 11.3.8 11.2.x < 11.2.7 Report: https://hackerone.com/reports/407763 Follow @8ayac 29
  31. None

  32. https://github.com/gitlabhq/gitlabhq/commit/782badd0a2cd00d2a9cbe591e78b30aca32e252b#diff-55c5b7aecfb519d0e4880eaf2788eb6e Follow @8ayac 31

  33. None

  34. Follow @8ayac 33

  35. Follow @8ayac 34

  36. Follow @8ayac 35

  37. Follow @8ayac 36

  38. Follow @8ayac 37

  39. Follow @8ayac 38

  40. Follow @8ayac 39

  41. Follow @8ayac 40

  42. Follow @8ayac 41

  43. Follow @8ayac 42

  44. Public Program Private Follow @8ayac 43

  45. Title: Stored XSS Issue Type: XSS(CWE-79) Severity: High Affected Versions:

    11.4.x < 11.4.3 11.3.x < 11.3.8 11.2.x < 11.2.7 Report: https://hackerone.com/reports/409380 Follow @8ayac 44
  46. None

  47. Follow @8ayac 46

  48. None
  49. None

  50. GitLab Public Program ! !(Low $1000) : https://hackerone.com/gitlab/policy_versions?change=3597572# Follow @8ayac

    49

  51. Follow @8ayac 50

  52. Follow @8ayac 51

  53. Follow @8ayac 52

  54. Follow @8ayac 53

  55. Follow @8ayac 54

  56. Follow @8ayac 55

  57. Follow @8ayac 56

  58. None
  59. None

  60. @zseano : Are you submitting bugs for free when others

    are being paid?... Follow @8ayac 59

  61. Follow @8ayac 60

  62. Private Private Researcher Follow @8ayac 61

  63. Private Private Researcher Follow @8ayac 62

  64. Free Bugs Campaign : Public Private Follow @8ayac 63

  65. Follow @8ayac 64

  66. Follow @8ayac 65

  67. None

  68. $500 ( ) “Private Program” GitLab ( HackEDU) 100 Burp

    ( ) Follow @8ayac 67

  69. ☺