SlideShare a Scribd company logo

Bug Bounty Hunter Methodology - Nullcon 2016

bugcrowd, profile picture
bugcrowd

The document outlines a bug hunting methodology presented by Faraz Khan and based on Jason Haddix's original work. It covers strategies and tools used in discovering vulnerabilities through web and mobile bug hunting, including techniques for parsing, mapping, and exploiting various vulnerabilities. Key topics include the differences between standard penetration testing and bounty hunting, discovery techniques, and specific vulnerabilities such as XSS, SQL injection, and CSRF.

Technology
Related topics:
Information Security
1 of 82
Downloaded 610 times
1
2
3
4
5
6
7
8
9
10
11
12
Most read
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
Most read
74
75
76
77
78
79
80
Most read
81
82
1 The Bug Hunter’s Methodology
2 Faraz Khan ● Bugcrowd Tech-OPS Team Member ● Part time Hacker & Bug hunter ● Writer at Securityidiots.com ● Ex-Full time Penetration Tester whoami
3 These Slides were originally developed and presented by Jason Haddix at Defcon 23 on August 6th ● Director of Technical Ops at Bugcrowd ● Hacker & Bug hunter ● #1 on all-time leaderboard bugcrowd 2014 Source of the Slides @jhaddix
4 Hack Stuff Better (and practically) What this talk’s about... And…LOTS of memes…. only some of them are funny
5 Step 1: Started with my bug hunting methodology Step 2: Parsed some of the top bug hunters’ research (web/mobile only for now) Step 3: Create kickass preso Topics? BB philosophy shifts, discovery techniques, mapping methodology, common attack parameters, useful fuzz strings, bypass or filter evasion techniques, new/awesome tooling Note: All information is from Jason Haddix’s own methodology and public resource. No information from the Bugcrowd platform is obtained! More Specifically
6 Philosophy
7 Differences from standard testing Single-sourced Crowdsourced ● looking mostly for common-ish vulns ● not competing with others ● incentivized for count ● payment based on sniff test ● looking for vulns that aren’t as easy to find ● racing vs. time ● competitive vs. others ● incentivized to find unique bugs ● payment based on impact not number of findings
8 Scenario while Standard Penetration Test
9 Scenario while Bounty Hunting
10 The regular methodologies
11 Discovery
12 Find the road less traveled ^ means find the application (or parts of an application) less tested to avoid duplicate. 1. *.acme.com scope is your friend 2. Find domains via Google (and others!) a. Can be automated well via recon-ng and other tools. 3. Confirm the subdomain to be in Scope 4. Port scan for obscure web servers or services (on all domains) 5. Find acquisitions and the bounty acquisition rules 6. Functionality changes or re-designs 7. Mobile websites 8. New mobile app versions
13 Tool: Recon-ng script (enumall.sh) https://github.com/jhaddix/domain
14 LMGTFY
15 LMGTFY
16 DEMO: enumall.sh script
17 LMGTFY Google dorks on Exploit-Db Link: https://www.exploit-db.com/google-hacking-database/
18
19 https://www.facebook.com/notes/phwd/facebook-bug-bounties/707217202701640
20 Port scanning is not just for Netpen! A full port scan of all your new found targets will usually yield #win: ● separate webapps ● extraneous services ● Facebook had Jenkins Script console with no auth ● IIS.net had rdp open vulnerable to MS12_020 nmap -sS -A -PN -p- --script=http-title dontscanme.bro ^ syn scan, OS + service fingerprint, no ping, all ports, http titles Port Scanning!
21 Mapping
22 Mapping tips ● Google ● *Smart* Directory Brute Forcing ● RAFT lists (included in Seclists) ● SVN Digger (included in Seclists) ● Git Digger ● Platform Identification: ● Wapplyzer (Chrome) ● Builtwith (Chrome) ● retire.js (cmd-line or Burp) ● Check CVE’s ● Auxiliary ● WPScan ● CMSmap
23 Just what the hack is SecList? SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to enable a security tester to pull this repo onto a new testing box and have access to every type of list that may be needed. This project is maintained by Daniel Miessler and Jason Haddix. https://github.com/danielmiessler/SecLists
24 DEMO: Wapplyzer
25 DEMO: wpscan
26 Directory Bruteforce Workflow After bruteforcing look for other status codes indicating you are denied or require auth then append list there to test for misconfigured access control. Example: GET http://www.acme.com - 200 GET http://www.acme.com/backlog/ - 404 GET http://www.acme.com/controlpanel/ - 401 hmm.. ok GET http://www.acme.com/controlpanel/[bruteforce here now]
27 Auth and Session
28 Auth (better be quick) Auth Related (more in logic and priv sections) ● Make sure they are in scope before submitting ● User/pass discrepancy flaw ● Registration page harvesting ● Login page harvesting ● Password reset page harvesting ● No account lockout ● Weak password policy ● Password not required for account updates ● Password reset tokens (no expiry or re-use)
29 Session (better be quick) Session Related ● Failure to invalidate old cookies ● No new cookies on login/logout/timeout ● Never ending cookie length ● Easily reversible cookie (base64 most often)
30 Tactical Fuzzing - XSS
31 XSS Core Idea: Does the page functionality display something to the users? For time sensitive testing the 80/20 rule applies. Many testers use Polyglot payloads. You probably have too!
32 XSS ';alert(String.fromCharCode(88,83,83))//';alert(String. fromCharCode(88,83,83))//";alert(String.fromCharCode (88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83)) </SCRIPT> Multi-context, filter bypass based polyglot payload #1 (Rsnake XSS Cheat Sheet)
33 XSS '">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext></|><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm&lpar; 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg"> Multi-context, filter bypass based polyglot payload #2 (Ashar Javed XSS Research)
34 XSS “ onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)// Multi-context polyglot payload (Mathias Karlsson) http://polyglot.innerht.ml/
35 XSS
36 Other XSS Observations Input Vectors Customizable Themes & Profiles via CSS Event or meeting names URI based Imported from a 3rd party (think Facebook integration) JSON POST Values (check returning content type) File Upload names Uploaded files (swf, HTML, ++) Custom Error pages fake params - ?realparam=1&foo=bar’+alert(/XSS/)+’ Login and Forgot password forms
37 SWF Parameter XSS
38 DEMO: Flashbang
39 Tactical Fuzzing - SQLi
40 SQL Injection Core Idea: Does the page look like it might need to call on stored data? There exist some SQLi polyglots, i.e; SLEEP(1) /*‘ or SLEEP(1) or ‘“ or SLEEP(1) or “*/ Works in single quote context, works in double quote context, works in “straight into query” context! (Mathias Karlsson)
41 SQL Injection You can also leverage the large database of fuzzing lists from Seclists here:
42 SQL Injection Observations Blind is predominant, Error based is highly unlikely. ‘%2Bbenchmark(3200,SHA1(1))%2B’ ‘+BENCHMARK(40000000,SHA1(1337))+’ SQLMap is king! ● Use -l to parse a Burp log file. ● Use Tamper Scripts for blacklists. ● SQLMapper Burp plugin works well to instrument SQLmap quickly. Lots of injection in web services! Common Parameters or Injection points ID Currency Values Item number values sorting parameters (i.e order, sort, etc) JSON and XML values Cookie values (really?) Custom headers (look for possible integrations with CDN’s or WAF’s) REST based Services
43 Burp Suite Extension Burp allows you to use a range of addons/extensions which can be added from BAPP Store, you download and add manually or you can program your own script and add to Burp. There are many cool Burp Extensions you can add to your collection to help you automate many manual tasks and make your life easier. Example: - Autorize - CO2 - Reflected Parameters
44 DEMO: Adding Burp Extension
45 DEMO: SQLMapper
46 SQLmap All Tamper Scripts https://forum.bugcrowd.com/t/sqlmap-tamper-scripts-sql-injection-and-waf-bypass/423 --tamper=apostrophemask,apostrophenullencode,appendnullbyte, base64encode,between,bluecoat,chardoubleencode,charencode, charunicodeencode,concat2concatws,equaltolike,greatest, halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned, modsecurityzeroversioned,multiplespaces,nonrecursivereplacement, percentage,randomcase,randomcomments,securesphere,space2comment, space2dash,space2hash,space2morehash,space2mssqlblank, space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus, space2randomblank,sp_password,unionalltounion,unmagicquotes, versionedkeywords,versionedmorekeywords
47 SQLmap Targeted Tamper Scripts General: tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode, charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage, randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes MSSQL: tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement, percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash, space2plus,space2randomblank,unionalltounion,unmagicquotes MySQL: tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest, halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces, nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash, space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords, versionedmorekeywords,xforwardedfor
48 Best SQL injection resources DBMS Specific Resources mySQL PentestMonkey's mySQL injection cheat sheet Reiners mySQL injection Filter Evasion Cheatsheet MSSQL EvilSQL's Error/Union/Blind MSSQL Cheatsheet PentestMonkey's MSSQL SQLi injection Cheat Sheet ORACLE PentestMonkey's Oracle SQLi Cheatsheet POSTGRESQL PentestMonkey's Postgres SQLi Cheatsheet Others Access SQLi Cheatsheet PentestMonkey's Ingres SQL Injection Cheat Sheet pentestmonkey's DB2 SQL Injection Cheat Sheet pentestmonkey's Informix SQL Injection Cheat Sheet SQLite3 Injection Cheat sheet Ruby on Rails (Active Record) SQL Injection Guide
49 SSRF - A new face in Picture
50 SSRF (Server-Side Script Request Forgery) Core Idea : Is there any external resource accessed by any parameter which could be controlled by us. Polyglot : www.yoursite.com/your_resource Simply capture the IP from which your resource is accessed. There we start, once we get the IP and we confirm that the resource is accessed by server- side, we are up with our game for SSRF.
51 SSRF Tools - Testing & Exploitation Tools Burp Scanner, other few scanners in market…. Testing As we know SSRF does not need automated fuzzing, because once we confirm a resource is accessible from the Server-Side we can confirm SSRF/XFPA. Exploitation Once we have confirmed SSRF, we can move on to further exploitation which includes the following but not limited to: 1. Internal Server/Port Scan 2. Access to File System 3. SSRF via 306 Redirects 4. Exploitation via other known Protocols
52 DEMO: SSRF
53 XXE - XML eXternal Entity
54 XML External Entity Injection Core Idea : Trial & Error, find any XML upload request or any request which takes XML in input body. Not very commonly we finds an application functionality which is dealing with XML inputs. But if we do, we might get lucky to find an XXE. Here’s how it works, if the XML is getting parsed by the application and the External entities in the DTD (Document Type declaration) is resolved then it may lead to XXE. You can also try converting a JSON endpoint request to XML and try XML Injections.
55 XXE Tools - Testing & Exploitation As the vulnerability is in its early stages we do not have any specific tool that totally concentrate on finding or exploiting XXE, but as per automated scanning/finding we have Burp scanner, other updated automated vulnerability scanner which are able to find XXE. Simple Payload <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///dev/random" >]><foo>&xxe;</foo> Exploitation: Can be used to read system files + Other attacks SSRF is capable of.
56 DEMO: XXE
57 Tactical Fuzzing - FI & Uploads
58 Local file inclusion Core Idea: Does it (or can it) interact with the server file system? Liffy is new and cool here but you can also use Seclists: Common Parameters or Injection points file= location= locale= path= display= load= read= retrieve=
59 Malicious File Upload ++ File upload attacks are a whole presentation. Try this one to get a feel for bypass techniques: ● content type spoofing ● extension trickery ● File in the hole! presentaion - http://goo.gl/VCXPh6
60 Malicious File Upload ++ This is an important and common attack vector in this type of testing A file upload functions need a lot of protections to be adequately secure. Attacks: ● Upload unexpected file format to achieve code exec (swf, html, php, php3, aspx, ++) Web shells or... ● Execute XSS via same types of files. Images as well! ● Attack the parser to DoS the site or XSS via storing payloads in metadata or file header ● Bypass security zones and store malware on target site via file polyglots
61 CSRF
62 CSRF Everyone knows CSRF but the TLDR here is find sensitive functions and attempt to CSRF. Burps CSRF PoC is fast and easy for this:
63 CSRF Many sites will have CSRF protection, focus on CSRF bypass! Common bypasses: ● Remove CSRF token from request ● Remove CSRF token parameter value ● Add bad control chars to CSRF parameter value ● Use a second identical CSRF param ● Change POST to GET Check this out...
64 CSRF Debasish Mandal wrote a python tool to automate finding CSRF bypasses called Burpy. Step 1: Enable logging in Burp. Crawl a site with Burp completely executing all functions. Step 2: Create a template...
65 DEMO: Burpy
66 CSRF Or focus on pages without the token in Burp: https://github. com/arvinddoraiswamy/mywebappscripts/blob/master/BurpExtensions/csrf_token_d etect.py
67 CSRF CSRF Common Critical functions Add / Upload file Password change Email change Transfer Money / Currency Delete File Profile edit CSRF N/A functions Logout CSRF Public Forms Forms that don’t make any change
68 Privilege, Transport, Logic
69 Privilege Often logic, priv, auth bugs are blurred. Testing user priv: Here is how it should be: 1. admin has power 2. user has few permissions And we are looking for functions which are only meant for the admin and are accessible by user.
70 Privilege 1. Find site functionality that is restricted to certain user types 2. Try accessing those functions with lesser/other user roles 3. Try to directly browse to views with sensitive information as a lesser priv user Autorize Burp plugin is pretty neat here... https://github.com/Quitten/Autorize Common Functions or Views Add user function Delete user function start project / campaign / etc function change account info (pass, CC, etc) function customer analytics view payment processing view any view with PII
71 DEMO: Autorize
72 Insecure direct object references IDORs are common place in bounties, and hard to catch with scanners. Find any and all UIDs ● increment ● decrement ● negative values ● Attempt to perform sensitive functions substituting another UID ○ change password ○ forgot password ○ admin only functions
73 Idor’s Common Functions , Views, or Files Everything from the CSRF Table, trying cross account attacks Sub: UIDs, user hashes, or emails Images that are non-public Receipts Private Files (pdfs, ++) Shipping info & Purchase Orders Sending / Deleting messages
74 Logic Logic flaws that are tricky, mostly manual: ● substituting hashed parameters ● step manipulation ● use negatives in quantities ● authentication bypass ● application level DoS ● Timing attacks
75
76 A simple logic Flaw An online cute dog contest, the dog with the best average of likes wins. 1. Anyone can register and take part. 2. Once a dog is registered, people can start liking or disliking that dog. 3. Everyone dislikes each other’s dogs to win the contest 4. The dog with the best average wins the contest. 5. Registration and votings gets closed 5 minutes before the results are announced. What is the Logic Flaw over here?
77 Auxiliary
78 The vulns formerly known as “noise” ● Content Spoofing or HTML injection ● Referer leakage ● security headers ● path disclosure ● clickjacking ● ++
79 Things to take with you… 1. Crowdsourced testing is different enough to pay attention to 2. Crowdsourcing focuses on the 20% because the 80% goes quick 3. Data analysis can yield the most successfully attacked areas 4. A 15 minute web test, done right, could yield a majority of your critical vulns 5. Add polyglots to your toolbelt 6. Use SecLists to power your scanners 7. Remember to periodically refresh your game with the wisdom of other techniques and other approaches Follow these ninjas who I profiled: https://twitter.com/Jhaddix/lists/bninjas
80 Meme Count: 14
81 Attribution and Thanks
82 Tim Tomes - Recon-ng Joe Giron - RFI params Soroush Dalili - File in the Hole preso Mathias Karlsson - polyglot research Ashar Javed - polyglot/xss research Ryan Dewhurst & Wpscan Team Bitquark - for being a ninja, bsqli string rotlogix - liffy LFI scanner Arvind Doraiswamy - HTTPs, CSRF Burp Plugins Barak Tawily - Autorize burp plugin the RAFT list authors Ferruh Mavituna - SVNDigger Jaime Filson aka wick2o - GitDigger Robert Hansen aka rsnake - polyglot / xss Dan Crowley - polyglot research Daniel Miessler - methodology, slide, and data contributions My awesome team at Bugcrowd ( Ashley,Grant,Shpend,Fatih, Dan, Sean,Jay, Patrik ++) Nullcon & All the bug hunting community!!!

More Related Content

PPTX
Bug Bounty 101
Shahee Mirza
 
PDF
The Game of Bug Bounty Hunting - Money, Drama, Action and Fame
Abhinav Mishra
 
PPTX
Bug bounty
n|u - The Open Security Community
 
PDF
Bug bounty null_owasp_2k17
Sagar M Parmar
 
PDF
Bug Bounty - Hackers Job
Arbin Godar
 
PPTX
Bug Bounty - Play For Money
Shubham Gupta
 
PPTX
Bounty Craft: Bug bounty reports how do they work, @sushihack presents at Nu...
HackerOne
 
PDF
Neat tricks to bypass CSRF-protection
Mikhail Egorov
 
Bug Bounty 101
Shahee Mirza
 
The Game of Bug Bounty Hunting - Money, Drama, Action and Fame
Abhinav Mishra
 
Bug bounty
n|u - The Open Security Community
 
Bug bounty null_owasp_2k17
Sagar M Parmar
 
Bug Bounty - Hackers Job
Arbin Godar
 
Bug Bounty - Play For Money
Shubham Gupta
 
Bounty Craft: Bug bounty reports how do they work, @sushihack presents at Nu...
HackerOne
 
Neat tricks to bypass CSRF-protection
Mikhail Egorov
 

What's hot (20)

PDF
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
Frans Rosén
 
PPTX
Reverse proxies & Inconsistency
GreenD0g
 
PPTX
XSS Attacks Exploiting XSS Filter by Masato Kinugawa - CODE BLUE 2015
CODE BLUE
 
PDF
Building Advanced XSS Vectors
Rodolfo Assis (Brute)
 
PDF
Polyglot payloads in practice by avlidienbrunn at HackPra
Mathias Karlsson
 
PPTX
Pentesting ReST API
Nutan Kumar Panda
 
PPTX
Saying Hello to Bug Bounty
Null Bhubaneswar
 
PPTX
Bug Bounty for - Beginners
Himanshu Kumar Das
 
PDF
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
Frans Rosén
 
PDF
Bug Bounty Basics
HackerOne
 
PDF
Frans Rosén Keynote at BSides Ahmedabad
Security BSides Ahmedabad
 
PDF
Bug Bounty Secrets
n|u - The Open Security Community
 
PDF
Live Hacking like a MVH – A walkthrough on methodology and strategies to win big
Frans Rosén
 
PPTX
Understanding Cross-site Request Forgery
Daniel Miessler
 
PDF
Offzone | Another waf bypass
Дмитрий Бумов
 
PDF
Hacking and Defending APIs - Red and Blue make Purple.pdf
Matt Tesauro
 
PPTX
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition
Soroush Dalili
 
PDF
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
Frans Rosén
 
PDF
XSS Magic tricks
GarethHeyes
 
PDF
IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
CODE BLUE
 
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
Frans Rosén
 
Reverse proxies & Inconsistency
GreenD0g
 
XSS Attacks Exploiting XSS Filter by Masato Kinugawa - CODE BLUE 2015
CODE BLUE
 
Building Advanced XSS Vectors
Rodolfo Assis (Brute)
 
Polyglot payloads in practice by avlidienbrunn at HackPra
Mathias Karlsson
 
Pentesting ReST API
Nutan Kumar Panda
 
Saying Hello to Bug Bounty
Null Bhubaneswar
 
Bug Bounty for - Beginners
Himanshu Kumar Das
 
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
Frans Rosén
 
Bug Bounty Basics
HackerOne
 
Frans Rosén Keynote at BSides Ahmedabad
Security BSides Ahmedabad
 
Bug Bounty Secrets
n|u - The Open Security Community
 
Live Hacking like a MVH – A walkthrough on methodology and strategies to win big
Frans Rosén
 
Understanding Cross-site Request Forgery
Daniel Miessler
 
Offzone | Another waf bypass
Дмитрий Бумов
 
Hacking and Defending APIs - Red and Blue make Purple.pdf
Matt Tesauro
 
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition
Soroush Dalili
 
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
Frans Rosén
 
XSS Magic tricks
GarethHeyes
 
IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
CODE BLUE
 
Ad

Similar to Bug Bounty Hunter Methodology - Nullcon 2016 (20)

PDF
How to Shot Web - Jason Haddix at DEFCON 23 - See it Live: Details in Descrip...
bugcrowd
 
PDF
DEFCON 23 - Jason Haddix - how do i shot web
Felipe Prado
 
PDF
Ekoparty 2017 - The Bug Hunter's Methodology
bugcrowd
 
PPTX
Hacking WebApps for fun and profit : how to approach a target?
Yassine Aboukir
 
PDF
BugBounty Roadmap with Mohammed Adam
Mohammed Adam
 
PPTX
Pentesting Tips: Beyond Automated Testing
Andrew McNicol
 
PPT
Beyond Automated Testing - RVAsec 2016
Andrew McNicol
 
PPT
BSidesDC 2016 Beyond Automated Testing
Andrew McNicol
 
PPT
Andrew and Zac RVA-Beyond-Automated-Testing-2016.ppt
BUSHRASHAIKH804312
 
PDF
The Web Application Hackers Toolchain
jasonhaddix
 
PDF
Hacking Web Apps by Brent White
EC-Council
 
PDF
Web Security - Introduction v.1.3
Oles Seheda
 
PDF
Web Security - Introduction
SQALab
 
PDF
Web Application Security: Introduction to common classes of security flaws an...
Thoughtworks
 
PDF
Tw noche geek quito webappsec
Thoughtworks
 
PPT
Pentesting Using Burp Suite
jasonhaddix
 
PPTX
C#Web Sec Oct27 2010 Final
Rich Helton
 
PDF
CNIT 129S: Ch 4: Mapping the Application
Sam Bowne
 
PPTX
Web Hacking With Burp Suite 101
Zack Meyers
 
PPTX
Squashing bugs: Introduction to Bug Bounties ISSA Dehradun Chapter
Avi Sharma
 
How to Shot Web - Jason Haddix at DEFCON 23 - See it Live: Details in Descrip...
bugcrowd
 
DEFCON 23 - Jason Haddix - how do i shot web
Felipe Prado
 
Ekoparty 2017 - The Bug Hunter's Methodology
bugcrowd
 
Hacking WebApps for fun and profit : how to approach a target?
Yassine Aboukir
 
BugBounty Roadmap with Mohammed Adam
Mohammed Adam
 
Pentesting Tips: Beyond Automated Testing
Andrew McNicol
 
Beyond Automated Testing - RVAsec 2016
Andrew McNicol
 
BSidesDC 2016 Beyond Automated Testing
Andrew McNicol
 
Andrew and Zac RVA-Beyond-Automated-Testing-2016.ppt
BUSHRASHAIKH804312
 
The Web Application Hackers Toolchain
jasonhaddix
 
Hacking Web Apps by Brent White
EC-Council
 
Web Security - Introduction v.1.3
Oles Seheda
 
Web Security - Introduction
SQALab
 
Web Application Security: Introduction to common classes of security flaws an...
Thoughtworks
 
Tw noche geek quito webappsec
Thoughtworks
 
Pentesting Using Burp Suite
jasonhaddix
 
C#Web Sec Oct27 2010 Final
Rich Helton
 
CNIT 129S: Ch 4: Mapping the Application
Sam Bowne
 
Web Hacking With Burp Suite 101
Zack Meyers
 
Squashing bugs: Introduction to Bug Bounties ISSA Dehradun Chapter
Avi Sharma
 
Ad

More from bugcrowd (19)

PDF
Bug Bounties, Ransomware, and Other Cyber Hype for Legal Counsel
bugcrowd
 
PPTX
3 Reasons to Swap Your Next Pen Test With a Bug Bounty Program
bugcrowd
 
PPTX
7 Bug Bounty Myths, BUSTED
bugcrowd
 
PDF
If You Can't Beat 'Em, Join 'Em (AppSecUSA)
bugcrowd
 
PPTX
AppSecUSA 2016: 'Your License for Bug Hunting Season'
bugcrowd
 
PDF
Bug Bounty Tipping Point: Strength in Numbers
bugcrowd
 
PDF
[Webinar] Building a Product Security Incident Response Team: Learnings from ...
bugcrowd
 
PDF
If You Can't Beat 'Em, Join 'Em
bugcrowd
 
PDF
Writing vuln reports that maximize payouts - Nullcon 2016
bugcrowd
 
PDF
Revitalizing Product Securtiy at Zephyr Health
bugcrowd
 
PPTX
HI THIS IS URGENT PLZ FIX ASAP: Critical Vunlerabilities and Bug Bounty Programs
bugcrowd
 
PPTX
How Portal Can Change Your Security Forever - Kati Rodzon at BSidesLV
bugcrowd
 
PDF
4 Reasons to Crowdsource Your Pen Test
bugcrowd
 
PDF
Mobile Application Security Threats through the Eyes of the Attacker
bugcrowd
 
PPTX
Build or Buy: The Barracuda Bug Bounty Story [Webinar]
bugcrowd
 
PDF
5 Tips to Successfully Running a Bug Bounty Program
bugcrowd
 
PDF
[Webinar] The Art & Value of Bug Bounty Programs
bugcrowd
 
PDF
Key Takeaways from Instructure's Successful Bug Bounty Program
bugcrowd
 
PDF
How to run a kick ass bug bounty program - Node Summit 2013
bugcrowd
 
Bug Bounties, Ransomware, and Other Cyber Hype for Legal Counsel
bugcrowd
 
3 Reasons to Swap Your Next Pen Test With a Bug Bounty Program
bugcrowd
 
7 Bug Bounty Myths, BUSTED
bugcrowd
 
If You Can't Beat 'Em, Join 'Em (AppSecUSA)
bugcrowd
 
AppSecUSA 2016: 'Your License for Bug Hunting Season'
bugcrowd
 
Bug Bounty Tipping Point: Strength in Numbers
bugcrowd
 
[Webinar] Building a Product Security Incident Response Team: Learnings from ...
bugcrowd
 
If You Can't Beat 'Em, Join 'Em
bugcrowd
 
Writing vuln reports that maximize payouts - Nullcon 2016
bugcrowd
 
Revitalizing Product Securtiy at Zephyr Health
bugcrowd
 
HI THIS IS URGENT PLZ FIX ASAP: Critical Vunlerabilities and Bug Bounty Programs
bugcrowd
 
How Portal Can Change Your Security Forever - Kati Rodzon at BSidesLV
bugcrowd
 
4 Reasons to Crowdsource Your Pen Test
bugcrowd
 
Mobile Application Security Threats through the Eyes of the Attacker
bugcrowd
 
Build or Buy: The Barracuda Bug Bounty Story [Webinar]
bugcrowd
 
5 Tips to Successfully Running a Bug Bounty Program
bugcrowd
 
[Webinar] The Art & Value of Bug Bounty Programs
bugcrowd
 
Key Takeaways from Instructure's Successful Bug Bounty Program
bugcrowd
 
How to run a kick ass bug bounty program - Node Summit 2013
bugcrowd
 

Recently uploaded (20)

PDF
madgavkar20181017ppt McKinsey Presentation.pdf
georgschmitzdoerner
 
PDF
Chapter 2 Digital Image Fundamentals.pdf
Getnet Tigabie Askale -(GM)
 
PPTX
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
PDF
BLW VOCATIONAL TRAINING SUMMER INTERNSHIP REPORT
codernjn73
 
PDF
Cloud-Migration-Best-Practices-A-Practical-Guide-to-AWS-Azure-and-Google-Clou...
Artjoker Software Development Company
 
PDF
NewMind AI Monthly Chronicles - July 2025
NewMind AI
 
PDF
How Onsite IT Support Drives Business Efficiency, Security, and Growth.pdf
Captain IT
 
PDF
Event Presentation Google Cloud Next Extended 2025
minhtrietgect
 
PDF
KodekX | Application Modernization Development
KodekX
 
PDF
Sensors and Actuators in IoT Systems using pdf
jeffinmathew654
 
PDF
A Day in the Life of Location Data - Turning Where into How.pdf
Precisely
 
PDF
CIFDAQ's Teaching Thursday: Moving Averages Made Simple
CIFDAQ
 
PDF
HCSP-Presales-Campus Network Planning and Design V1.0 Training Material-Witho...
fahmeedakram1
 
PPTX
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
PPTX
Web Security: Login Bypass, SQLi, CSRF & XSS.pptx
SahilGupta752945
 
PDF
Automating ArcGIS Content Discovery with FME: A Real World Use Case
Safe Software
 
PDF
CIFDAQ's Market Wrap: Ethereum Leads, Bitcoin Lags, Institutions Shift
CIFDAQ
 
PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
PDF
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
SHREYAS PHANSE
 
PDF
Dell Pro 14 Plus: Be better prepared for what’s coming
Principled Technologies
 
madgavkar20181017ppt McKinsey Presentation.pdf
georgschmitzdoerner
 
Chapter 2 Digital Image Fundamentals.pdf
Getnet Tigabie Askale -(GM)
 
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
BLW VOCATIONAL TRAINING SUMMER INTERNSHIP REPORT
codernjn73
 
Cloud-Migration-Best-Practices-A-Practical-Guide-to-AWS-Azure-and-Google-Clou...
Artjoker Software Development Company
 
NewMind AI Monthly Chronicles - July 2025
NewMind AI
 
How Onsite IT Support Drives Business Efficiency, Security, and Growth.pdf
Captain IT
 
Event Presentation Google Cloud Next Extended 2025
minhtrietgect
 
KodekX | Application Modernization Development
KodekX
 
Sensors and Actuators in IoT Systems using pdf
jeffinmathew654
 
A Day in the Life of Location Data - Turning Where into How.pdf
Precisely
 
CIFDAQ's Teaching Thursday: Moving Averages Made Simple
CIFDAQ
 
HCSP-Presales-Campus Network Planning and Design V1.0 Training Material-Witho...
fahmeedakram1
 
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
Web Security: Login Bypass, SQLi, CSRF & XSS.pptx
SahilGupta752945
 
Automating ArcGIS Content Discovery with FME: A Real World Use Case
Safe Software
 
CIFDAQ's Market Wrap: Ethereum Leads, Bitcoin Lags, Institutions Shift
CIFDAQ
 
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
SHREYAS PHANSE
 
Dell Pro 14 Plus: Be better prepared for what’s coming
Principled Technologies
 

Bug Bounty Hunter Methodology - Nullcon 2016

  • 2. 2 Faraz Khan ● Bugcrowd Tech-OPS Team Member ● Part time Hacker & Bug hunter ● Writer at Securityidiots.com ● Ex-Full time Penetration Tester whoami
  • 3. 3 These Slides were originally developed and presented by Jason Haddix at Defcon 23 on August 6th ● Director of Technical Ops at Bugcrowd ● Hacker & Bug hunter ● #1 on all-time leaderboard bugcrowd 2014 Source of the Slides @jhaddix
  • 4. 4 Hack Stuff Better (and practically) What this talk’s about... And…LOTS of memes…. only some of them are funny
  • 5. 5 Step 1: Started with my bug hunting methodology Step 2: Parsed some of the top bug hunters’ research (web/mobile only for now) Step 3: Create kickass preso Topics? BB philosophy shifts, discovery techniques, mapping methodology, common attack parameters, useful fuzz strings, bypass or filter evasion techniques, new/awesome tooling Note: All information is from Jason Haddix’s own methodology and public resource. No information from the Bugcrowd platform is obtained! More Specifically
  • 7. 7 Differences from standard testing Single-sourced Crowdsourced ● looking mostly for common-ish vulns ● not competing with others ● incentivized for count ● payment based on sniff test ● looking for vulns that aren’t as easy to find ● racing vs. time ● competitive vs. others ● incentivized to find unique bugs ● payment based on impact not number of findings
  • 8. 8 Scenario while Standard Penetration Test
  • 12. 12 Find the road less traveled ^ means find the application (or parts of an application) less tested to avoid duplicate. 1. *.acme.com scope is your friend 2. Find domains via Google (and others!) a. Can be automated well via recon-ng and other tools. 3. Confirm the subdomain to be in Scope 4. Port scan for obscure web servers or services (on all domains) 5. Find acquisitions and the bounty acquisition rules 6. Functionality changes or re-designs 7. Mobile websites 8. New mobile app versions
  • 13. 13 Tool: Recon-ng script (enumall.sh) https://github.com/jhaddix/domain
  • 17. 17 LMGTFY Google dorks on Exploit-Db Link: https://www.exploit-db.com/google-hacking-database/
  • 18. 18
  • 20. 20 Port scanning is not just for Netpen! A full port scan of all your new found targets will usually yield #win: ● separate webapps ● extraneous services ● Facebook had Jenkins Script console with no auth ● IIS.net had rdp open vulnerable to MS12_020 nmap -sS -A -PN -p- --script=http-title dontscanme.bro ^ syn scan, OS + service fingerprint, no ping, all ports, http titles Port Scanning!
  • 22. 22 Mapping tips ● Google ● *Smart* Directory Brute Forcing ● RAFT lists (included in Seclists) ● SVN Digger (included in Seclists) ● Git Digger ● Platform Identification: ● Wapplyzer (Chrome) ● Builtwith (Chrome) ● retire.js (cmd-line or Burp) ● Check CVE’s ● Auxiliary ● WPScan ● CMSmap
  • 23. 23 Just what the hack is SecList? SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to enable a security tester to pull this repo onto a new testing box and have access to every type of list that may be needed. This project is maintained by Daniel Miessler and Jason Haddix. https://github.com/danielmiessler/SecLists
  • 26. 26 Directory Bruteforce Workflow After bruteforcing look for other status codes indicating you are denied or require auth then append list there to test for misconfigured access control. Example: GET http://www.acme.com - 200 GET http://www.acme.com/backlog/ - 404 GET http://www.acme.com/controlpanel/ - 401 hmm.. ok GET http://www.acme.com/controlpanel/[bruteforce here now]
  • 28. 28 Auth (better be quick) Auth Related (more in logic and priv sections) ● Make sure they are in scope before submitting ● User/pass discrepancy flaw ● Registration page harvesting ● Login page harvesting ● Password reset page harvesting ● No account lockout ● Weak password policy ● Password not required for account updates ● Password reset tokens (no expiry or re-use)
  • 29. 29 Session (better be quick) Session Related ● Failure to invalidate old cookies ● No new cookies on login/logout/timeout ● Never ending cookie length ● Easily reversible cookie (base64 most often)
  • 31. 31 XSS Core Idea: Does the page functionality display something to the users? For time sensitive testing the 80/20 rule applies. Many testers use Polyglot payloads. You probably have too!
  • 33. 33 XSS '">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext></|><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm&lpar; 1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http: //i.imgur.com/P8mL8.jpg"> Multi-context, filter bypass based polyglot payload #2 (Ashar Javed XSS Research)
  • 34. 34 XSS “ onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)// Multi-context polyglot payload (Mathias Karlsson) http://polyglot.innerht.ml/
  • 36. 36 Other XSS Observations Input Vectors Customizable Themes & Profiles via CSS Event or meeting names URI based Imported from a 3rd party (think Facebook integration) JSON POST Values (check returning content type) File Upload names Uploaded files (swf, HTML, ++) Custom Error pages fake params - ?realparam=1&foo=bar’+alert(/XSS/)+’ Login and Forgot password forms
  • 40. 40 SQL Injection Core Idea: Does the page look like it might need to call on stored data? There exist some SQLi polyglots, i.e; SLEEP(1) /*‘ or SLEEP(1) or ‘“ or SLEEP(1) or “*/ Works in single quote context, works in double quote context, works in “straight into query” context! (Mathias Karlsson)
  • 41. 41 SQL Injection You can also leverage the large database of fuzzing lists from Seclists here:
  • 42. 42 SQL Injection Observations Blind is predominant, Error based is highly unlikely. ‘%2Bbenchmark(3200,SHA1(1))%2B’ ‘+BENCHMARK(40000000,SHA1(1337))+’ SQLMap is king! ● Use -l to parse a Burp log file. ● Use Tamper Scripts for blacklists. ● SQLMapper Burp plugin works well to instrument SQLmap quickly. Lots of injection in web services! Common Parameters or Injection points ID Currency Values Item number values sorting parameters (i.e order, sort, etc) JSON and XML values Cookie values (really?) Custom headers (look for possible integrations with CDN’s or WAF’s) REST based Services
  • 43. 43 Burp Suite Extension Burp allows you to use a range of addons/extensions which can be added from BAPP Store, you download and add manually or you can program your own script and add to Burp. There are many cool Burp Extensions you can add to your collection to help you automate many manual tasks and make your life easier. Example: - Autorize - CO2 - Reflected Parameters
  • 46. 46 SQLmap All Tamper Scripts https://forum.bugcrowd.com/t/sqlmap-tamper-scripts-sql-injection-and-waf-bypass/423 --tamper=apostrophemask,apostrophenullencode,appendnullbyte, base64encode,between,bluecoat,chardoubleencode,charencode, charunicodeencode,concat2concatws,equaltolike,greatest, halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned, modsecurityzeroversioned,multiplespaces,nonrecursivereplacement, percentage,randomcase,randomcomments,securesphere,space2comment, space2dash,space2hash,space2morehash,space2mssqlblank, space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus, space2randomblank,sp_password,unionalltounion,unmagicquotes, versionedkeywords,versionedmorekeywords
  • 47. 47 SQLmap Targeted Tamper Scripts General: tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode, charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage, randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes MSSQL: tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement, percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash, space2plus,space2randomblank,unionalltounion,unmagicquotes MySQL: tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest, halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces, nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash, space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords, versionedmorekeywords,xforwardedfor
  • 48. 48 Best SQL injection resources DBMS Specific Resources mySQL PentestMonkey's mySQL injection cheat sheet Reiners mySQL injection Filter Evasion Cheatsheet MSSQL EvilSQL's Error/Union/Blind MSSQL Cheatsheet PentestMonkey's MSSQL SQLi injection Cheat Sheet ORACLE PentestMonkey's Oracle SQLi Cheatsheet POSTGRESQL PentestMonkey's Postgres SQLi Cheatsheet Others Access SQLi Cheatsheet PentestMonkey's Ingres SQL Injection Cheat Sheet pentestmonkey's DB2 SQL Injection Cheat Sheet pentestmonkey's Informix SQL Injection Cheat Sheet SQLite3 Injection Cheat sheet Ruby on Rails (Active Record) SQL Injection Guide
  • 49. 49 SSRF - A new face in Picture
  • 50. 50 SSRF (Server-Side Script Request Forgery) Core Idea : Is there any external resource accessed by any parameter which could be controlled by us. Polyglot : www.yoursite.com/your_resource Simply capture the IP from which your resource is accessed. There we start, once we get the IP and we confirm that the resource is accessed by server- side, we are up with our game for SSRF.
  • 51. 51 SSRF Tools - Testing & Exploitation Tools Burp Scanner, other few scanners in market…. Testing As we know SSRF does not need automated fuzzing, because once we confirm a resource is accessible from the Server-Side we can confirm SSRF/XFPA. Exploitation Once we have confirmed SSRF, we can move on to further exploitation which includes the following but not limited to: 1. Internal Server/Port Scan 2. Access to File System 3. SSRF via 306 Redirects 4. Exploitation via other known Protocols
  • 53. 53 XXE - XML eXternal Entity
  • 54. 54 XML External Entity Injection Core Idea : Trial & Error, find any XML upload request or any request which takes XML in input body. Not very commonly we finds an application functionality which is dealing with XML inputs. But if we do, we might get lucky to find an XXE. Here’s how it works, if the XML is getting parsed by the application and the External entities in the DTD (Document Type declaration) is resolved then it may lead to XXE. You can also try converting a JSON endpoint request to XML and try XML Injections.
  • 55. 55 XXE Tools - Testing & Exploitation As the vulnerability is in its early stages we do not have any specific tool that totally concentrate on finding or exploiting XXE, but as per automated scanning/finding we have Burp scanner, other updated automated vulnerability scanner which are able to find XXE. Simple Payload <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///dev/random" >]><foo>&xxe;</foo> Exploitation: Can be used to read system files + Other attacks SSRF is capable of.
  • 57. 57 Tactical Fuzzing - FI & Uploads
  • 58. 58 Local file inclusion Core Idea: Does it (or can it) interact with the server file system? Liffy is new and cool here but you can also use Seclists: Common Parameters or Injection points file= location= locale= path= display= load= read= retrieve=
  • 59. 59 Malicious File Upload ++ File upload attacks are a whole presentation. Try this one to get a feel for bypass techniques: ● content type spoofing ● extension trickery ● File in the hole! presentaion - http://goo.gl/VCXPh6
  • 60. 60 Malicious File Upload ++ This is an important and common attack vector in this type of testing A file upload functions need a lot of protections to be adequately secure. Attacks: ● Upload unexpected file format to achieve code exec (swf, html, php, php3, aspx, ++) Web shells or... ● Execute XSS via same types of files. Images as well! ● Attack the parser to DoS the site or XSS via storing payloads in metadata or file header ● Bypass security zones and store malware on target site via file polyglots
  • 62. 62 CSRF Everyone knows CSRF but the TLDR here is find sensitive functions and attempt to CSRF. Burps CSRF PoC is fast and easy for this:
  • 63. 63 CSRF Many sites will have CSRF protection, focus on CSRF bypass! Common bypasses: ● Remove CSRF token from request ● Remove CSRF token parameter value ● Add bad control chars to CSRF parameter value ● Use a second identical CSRF param ● Change POST to GET Check this out...
  • 64. 64 CSRF Debasish Mandal wrote a python tool to automate finding CSRF bypasses called Burpy. Step 1: Enable logging in Burp. Crawl a site with Burp completely executing all functions. Step 2: Create a template...
  • 66. 66 CSRF Or focus on pages without the token in Burp: https://github. com/arvinddoraiswamy/mywebappscripts/blob/master/BurpExtensions/csrf_token_d etect.py
  • 67. 67 CSRF CSRF Common Critical functions Add / Upload file Password change Email change Transfer Money / Currency Delete File Profile edit CSRF N/A functions Logout CSRF Public Forms Forms that don’t make any change
  • 69. 69 Privilege Often logic, priv, auth bugs are blurred. Testing user priv: Here is how it should be: 1. admin has power 2. user has few permissions And we are looking for functions which are only meant for the admin and are accessible by user.
  • 70. 70 Privilege 1. Find site functionality that is restricted to certain user types 2. Try accessing those functions with lesser/other user roles 3. Try to directly browse to views with sensitive information as a lesser priv user Autorize Burp plugin is pretty neat here... https://github.com/Quitten/Autorize Common Functions or Views Add user function Delete user function start project / campaign / etc function change account info (pass, CC, etc) function customer analytics view payment processing view any view with PII
  • 72. 72 Insecure direct object references IDORs are common place in bounties, and hard to catch with scanners. Find any and all UIDs ● increment ● decrement ● negative values ● Attempt to perform sensitive functions substituting another UID ○ change password ○ forgot password ○ admin only functions
  • 73. 73 Idor’s Common Functions , Views, or Files Everything from the CSRF Table, trying cross account attacks Sub: UIDs, user hashes, or emails Images that are non-public Receipts Private Files (pdfs, ++) Shipping info & Purchase Orders Sending / Deleting messages
  • 74. 74 Logic Logic flaws that are tricky, mostly manual: ● substituting hashed parameters ● step manipulation ● use negatives in quantities ● authentication bypass ● application level DoS ● Timing attacks
  • 75. 75
  • 76. 76 A simple logic Flaw An online cute dog contest, the dog with the best average of likes wins. 1. Anyone can register and take part. 2. Once a dog is registered, people can start liking or disliking that dog. 3. Everyone dislikes each other’s dogs to win the contest 4. The dog with the best average wins the contest. 5. Registration and votings gets closed 5 minutes before the results are announced. What is the Logic Flaw over here?
  • 78. 78 The vulns formerly known as “noise” ● Content Spoofing or HTML injection ● Referer leakage ● security headers ● path disclosure ● clickjacking ● ++
  • 79. 79 Things to take with you… 1. Crowdsourced testing is different enough to pay attention to 2. Crowdsourcing focuses on the 20% because the 80% goes quick 3. Data analysis can yield the most successfully attacked areas 4. A 15 minute web test, done right, could yield a majority of your critical vulns 5. Add polyglots to your toolbelt 6. Use SecLists to power your scanners 7. Remember to periodically refresh your game with the wisdom of other techniques and other approaches Follow these ninjas who I profiled: https://twitter.com/Jhaddix/lists/bninjas
  • 82. 82 Tim Tomes - Recon-ng Joe Giron - RFI params Soroush Dalili - File in the Hole preso Mathias Karlsson - polyglot research Ashar Javed - polyglot/xss research Ryan Dewhurst & Wpscan Team Bitquark - for being a ninja, bsqli string rotlogix - liffy LFI scanner Arvind Doraiswamy - HTTPs, CSRF Burp Plugins Barak Tawily - Autorize burp plugin the RAFT list authors Ferruh Mavituna - SVNDigger Jaime Filson aka wick2o - GitDigger Robert Hansen aka rsnake - polyglot / xss Dan Crowley - polyglot research Daniel Miessler - methodology, slide, and data contributions My awesome team at Bugcrowd ( Ashley,Grant,Shpend,Fatih, Dan, Sean,Jay, Patrik ++) Nullcon & All the bug hunting community!!!