4 ms·

> that in itself breaks their ToS for the bug bounty program Except it doesn't?

• Mandatum 11y ago
  Once RCE is confirmed, any further access from there would break ToS. It's bullshit, and kind of a cop-out - but it's a trade-off that these companies have to make. Otherwise we could employ techniques like social engineering to gain internal access, then start pen-testing from within the network.
  • ryanlol 11y ago
    Their ToS does not state this. They do however specifically state that social engineering attacks are not eligible.
    • Mandatum 11y ago
      You're actually correct. I think this situation is a bit more complicated than it seems at first. Updated original reply.
• franjkovic 11y ago
  I'd say it does. Not interact with other accounts without the consent of their owners. Edit: whoops I mis-read this a bit, but the point still stands - he escalated using AWS keypair that did not belong to him, and he had no consent of the owner.
  • ryanlol 11y ago
    Obviously that's referring to facebook accounts. Edit: I feel that your edit is still stretching the terms a bit. It seems pretty clear that this isn't the abuse that the clause intends to prevent. Also, the guy seems to only have verified that the credentials worked.