War of money - Bug Bounty

A virtual session on "War of money - Bug Bounty" organized by WeArePlaymouths

Transcript

1. ./war of money Bug Bounty
2. #WHOAMI • Zubair Ansari • Web Application Penetration Tester • Founder of Arcotics • DSC Lead @ Google Developers
3. #AGENDA • W2 bug hunting? • How to do bug hunting? • Secret tips • Experiments • Q/A
4. #W2 bug hunting? • Process of earning ❌ • Process of doing experiments ✔
5. #W2 bug hunting? • Ethical deal between COMPANY AND RESEARCHER
6. #W2 bug hunting? • How? Company invites security researchers / platforms to test their application Research / Pen test Vulnerability found Report to company IT / Security team validate and FIX the issue Valid issues are rewarded
7. #W2 bug hunting? • What researchers get? Real time experiences
8. #W2 bug hunting? • Reliability ❌
9. #How to do bug hunting?
10. All you have to pay is…… • Passion • Time
11. #How to do bug hunting? • Decide the area of Pentesting Network Pentesting Web Application Pentesting Clients Side Pentesting Wireless Pentesting Social Engineering
12. #How to do bug hunting? • Web Application Pentesting
13. #What next?...
14. #Bug bounty platforms • Researchers do their real time experiments • Companies make their business secure and safe
15. #Secret tips…
16. #Secret tips • Try to avoid preprogrammed scripts (Code your own tools) • Try write quality reports. *Step by step approach *Instructions that can resolve the issue. *Use professional language • Think about learning always (Instead of money) • Always look at the path less visited • Don’t cry over duplicates. • Do not stop reading & doing experiments.
17. #Experiments