3 ms·
>those terms include not exfiltrating data Is there a way to determine that your credentials are sufficient to download an S3 object without actually downloadi
by closeparen 6y ago
>those terms include not exfiltrating data
Is there a way to determine that your credentials are sufficient to download an S3 object without actually downloading it?
How would you know whether you'd found an information disclosure vulnerability without peeking at the information?
- BlueGh0st 6y agoBounty programs explicitly tell you to only to target accounts that belong to you. Outside of that, if you're "peeking" at information that doesn't belong to you, you immediately stop, document, and submit the report. You do not download 14,000 files as the Uber hackers did. This is a non-trivial amount of nuance that clearly shows the hackers were not acting in good faith.