Helping
secure
popular
services,
improving
my
skills,
the
credit,
and
of
course
the
payment
for
a
job
well
done
“
@NightRang3r
Bug
Bounty
Hunter
Slide 38
Slide 38 text
…enhances
my
logical
bug
finding
crea2vity
a n d
a p p r o a c h .
I t
mo2vates
me..
“
@AjaySinghNegi
Bug
Bounty
Hunter
Slide 39
Slide 39 text
First
of
all
is
the
c h a l l e n g e ,
a n d
s e c o n d ,
t h e
acknowledgement
of
researcher’s
hard
work
and
rewarding
them
accordingly
“
@NightRang3r
Bug
Bounty
Hunter
Slide 40
Slide 40 text
3
Themes
Slide 41
Slide 41 text
PresBge,
RecogniBon,
and
Fame
Slide 42
Slide 42 text
PracBce
Makes
Perfect
Slide 43
Slide 43 text
Cash
Money
Slide 44
Slide 44 text
Money
Fame
Experience
Pick
One:
Slide 45
Slide 45 text
4
Problems
Slide 46
Slide 46 text
No
Visibility
Slide 47
Slide 47 text
Terms
can
change
at
any
Bme
Slide 48
Slide 48 text
Inefficient
use
of
testers
Bme
Slide 49
Slide 49 text
Fixes
Take
Time
Slide 50
Slide 50 text
In
the
News
Slide 51
Slide 51 text
51
';alert(String.fromChar
Code(88,83,83))//';
Slide 52
Slide 52 text
52
To
be
eligible
you
*must
not*:
Be
less
than
18
years
of
age.
...
PayPal
will
remove
that
researcher
from
the
Bug
Bounty
Program
and
disqualify
them
from
receiving
any
bounty.
“
PayPal
Site
Security
Slide 53
Slide 53 text
53
Full
Disclosure
Slide 54
Slide 54 text
54
Slide 55
Slide 55 text
55
OAuth
Regex
Bypass
3/2013
Slide 56
Slide 56 text
56
UBlize
facebook.facebook.com
subdomain
bypasses
subdomain
regex
protecBon
in
OAuth
Slide 57
Slide 57 text
57
Abuse
strange
redirecBon
behavior
in
facebook.com
domain
with
mulBple-‐hash
signs
Slide 58
Slide 58 text
58
Get
past
the
warning
message
in
l.php
with
5
byte
hack
Slide 59
Slide 59 text
59
Redirect
the
vicBm
to
external
websites
located
through
Facebook
app
in
order
to
save
the
vicBm’s
access_token
62
Denied
• Lack
of
Technical
Detail
• Language
Barrier
Slide 63
Slide 63 text
63
Slide 64
Slide 64 text
64
We
are
unfortunately
not
able
to
pay
you
for
this
vulnerability
because
your
ac2ons
violated
our
Terms
of
Service.
We
do
hope,
however,
that
you
con2nue
to
work
with
us
to
find
vulnerabili2es
in
the
site.
“
Facebook
Slide 65
Slide 65 text
65
Slide 66
Slide 66 text
66
I
could
sell
on
the
black
(hat)
hackers'
websites
and
I
could
make
more
money
than
Facebook
could
pay
me.
But
for
me
-‐-‐
I
am
a
good
guy.
I
don't
deal
with
the
black
(hat)
stuff."
“
Khalil - Interview with CNN
Slide 67
Slide 67 text
67
What
about
black
market
bug
sales?
Slide 68
Slide 68 text
StaBsBcs
Don’t
Lie
Slide 69
Slide 69 text
44%
percent
of
all
bugs
are
the
first
and
only
bug
sent
by
a
researcher
PayPal
Slide 70
Slide 70 text
Almost
80%
of
bug
submissions
are
sent
in
by
researchers
who
submit
less
than
10
bugs
total
PayPal
Slide 71
Slide 71 text
10%
of
the
researchers
submit
25
bugs
or
more
PayPal
Slide 72
Slide 72 text
Google
has
paid
out
over
$1M
Google
Slide 73
Slide 73 text
Facebook
has
paid
out
over
$1M
in
the
last
2
years
Facebook
Slide 74
Slide 74 text
329
bounty
hunters
have
been
paid
at
least
$500
by
Facebook
Facebook
Slide 75
Slide 75 text
Almost
70%
of
valid
bugs
are
Cross-‐Site
Scrip2ng
Google
XSS
XSRF
Slide 76
Slide 76 text
Does
it
Work?
Slide 77
Slide 77 text
Google
is
reporBng
fewer
bug
submissions
“Harder
to
find”
Google
Bug
Hunter
Slide 78
Slide 78 text
Crowd-‐Sourced
Security
is
changing
tes2ng
Slide 79
Slide 79 text
Free
Advice
Slide 80
Slide 80 text
Be
prepared
to
run
such
a
program,
have
the
professional
man
power
to
deal
with
bug
submissions
and
to
understand
them
“
@NightRang3r
Bug
Bounty
Hunter
Slide 81
Slide 81 text
Proper
verifica2on
of
logical
bugs,
2mely
reply
to
bugs
submissions
with
status
“
@AjaySinghNegi
Bug
Bounty
Hunter
Slide 82
Slide 82 text
?
Slide 83
Slide 83 text
Submit
bugs
Accept
bugs
Provide
Rewards
Get
Secure