Hacking on Bug Bounties for Five Years

This presentation explains how vulnerabilities were discovered and reported across five years of bug bounty participation. It walks through selected findings and lessons on reconnaissance, testing techniques, report quality, and getting started.

Syllabus

Intro
Working at Hungry Jacks
PayPal's Bug Bounty
The First Critical Bug (SSRF)
My Background
How I got started
My First Unrated bug
Before You Start Hunting
Writing High Quality Reports
Getting Into Bounties
Exposed HAProxy Statistics ($500)
Open Administration Interface owned by Scompany (Ansible Tower) ($500)
Trying To Be Cheeky
Low Risk Bugs
N/A Bugs
Full Time vs Part Time
Focus on Techniques
Multiple Steps To Victory
Second Order Takeovers
Expanding The Scope
Targeting Country Specific Assets
Dirty box...
Testing Scripts
Debug Endpoints
Transport.Co Dox'd
Third Party Platforms
Dangling IP Subdomain Takeover
Defining Recon
Performing Recon
IDORS: A Systemic Problem
Automation
Retrospective
Further Reading