3 ms·

I've noticed a spike recently in bug bounties going to people who using a combination of fuzzing and code analysis tools. It may be that we're moving to a poin

I've noticed a spike recently in bug bounties going to people who using a combination of fuzzing and code analysis tools. It may be that we're moving to a point where bug-hunters' ability to use sophisticated tools will be what earns them the most money, rather than their ability to eyeball code and see the bugs. Speaking just for myself: A few years ago I was saying "I should really set aside a few months to learn to use fuzzing tools"; now I'm saying "it's easier to just offer bounties and let someone else do the fuzzing for me".

dsacco 9y ago
As those tools become more widely used and more easy to use, you'll be able to lower the mean bug bounty reward payment as well.
mindingdata 9y ago
There was this thing called "Hostile Subdomain Takeover" where a company would point a subdomain to a particular SaaS product (Say Zendesk), sometime later, they would cancel their subscription but not change the A record. Someone could then go and register a new Zendesk account (If the service doesn't require proof of ownership of domain), and say that they want to use the same subdomain. Now they have a Zendesk account with the URL of http://help.somedomain.com http://help.somedomain.com as an example. And they can phish people quite easily. Anyway, the reason I bring it up is because for a while, I saw people spamming the shit out of bug bounties with this stuff. Because it's super simple to do. So I'm not sure what is more lucrative for an average joe, actually learning proper techniques or trying to piggy back on some low hanging fruit that may be easy to automate.
- thaumasiotes 9y ago
  This is definitely still a thing.
dsl 9y ago
I did this on a popular bug bounty platform. Wrote a tool to look for the top 10 most common issues with mobile apps and auto submit bugs. Fuzzing is where you are going to find most memory corruption bugs these days, bounties or not.
deleted 9y ago
[deleted]

dsacco 9y ago

As those tools become more widely used and more easy to use, you'll be able to lower the mean bug bounty reward payment as well.

mindingdata 9y ago

There was this thing called "Hostile Subdomain Takeover" where a company would point a subdomain to a particular SaaS product (Say Zendesk), sometime later, they would cancel their subscription but not change the A record. Someone could then go and register a new Zendesk account (If the service doesn't require proof of ownership of domain), and say that they want to use the same subdomain. Now they have a Zendesk account with the URL of http://help.somedomain.com http://help.somedomain.com as an example. And they can phish people quite easily. Anyway, the reason I bring it up is because for a while, I saw people spamming the shit out of bug bounties with this stuff. Because it's super simple to do. So I'm not sure what is more lucrative for an average joe, actually learning proper techniques or trying to piggy back on some low hanging fruit that may be easy to automate.

thaumasiotes 9y ago
This is definitely still a thing.

dsl 9y ago

I did this on a popular bug bounty platform. Wrote a tool to look for the top 10 most common issues with mobile apps and auto submit bugs. Fuzzing is where you are going to find most memory corruption bugs these days, bounties or not.

deleted 9y ago

[deleted]