A Series of Unfortunate Events: War Stories in Bug Hunting
Ben Sadeghipour (NahamSec) and Corben Leo share war stories from high-impact bug bounty engagements across prisons, major tech firms, and online casinos.
Summary
High-Stakes Vulnerability Hunting in the Wild
Top bug bounty hunters encounter complex architectures spanning diverse industries, uncovering unexpected vulnerabilities with massive real-world impact.
Breaching Enterprise Prison Management Systems
Ben Sadeghipour and Corben Leo detail discovering critical authentication bypasses in correctional facility management software, granting full administrative access to sensitive inmate records.
Publishing Spoofed News on Major Tech Portals
The authors recount discovering CMS logic flaws that allowed unauthorized content publication directly onto the front pages of major global technology corporations.
Escalating Privilege in Online Gaming and Casinos
Dissecting logic vulnerabilities and API authorization oversights in leading online gaming platforms illustrates the severe financial and operational impact of chainable bugs.
Related talks
Creator Stage·50 min
Adam Langley · Ben Sadeghipour
Demonstrates practical regular expression techniques for bug bounty hunters to uncover hidden API endpoints, bypass filters, and extract secrets from code repositories.
Red Team Village·1 hr 16 min
Jason Haddix
Jason Haddix presents an updated edition of The Bug Hunter's Methodology, sharing advanced asset discovery toolchains, port scanning, and web fuzzing workflows.
Village Interviews·< 1 min
A quick spotlight on the Bug Bounty Village highlighting collaborative hunting events, live hacking, and educational sessions at DEF CON 34.