From Easy Wins to Epic Challenges: Bounty Hunter Edition
Recounts intriguing bug bounty stories ranging from simple logic errors to chaining CAPTCHA weaknesses to break sensitive application encryption.
Summary
The Spectrum of Bug Bounty Discoveries
Bug bounty hunting involves finding vulnerabilities that range from surprisingly straightforward logic flaws to intricate multi-stage exploit chains.
Capitalizing on Simple Vulnerabilities
Real-world examples illustrate how simple observation during routine browsing revealed business logic flaws that allowed infinite balance manipulation.
Advanced Exploit Chaining Case Studies
Complex vulnerability investigations demonstrate how exploiting a flawed CAPTCHA implementation enabled breaking the cryptographic protections of a sensitive web application.
Hacker Intuition and Persistence
Developing strong investigative intuition and persisting through ambiguous application behaviors are vital skills for discovering high-impact security bugs.
Related talks
Creator Stage·25 min
Whit Taylor
Uncovers client-side gadgets, race conditions, and business logic flaws hidden within referral and reward systems across major bug bounty programs.
Creator Stage·59 min
Nikhil Shrivastava · Charlie Waterhouse
Shares insights from ten years of bug bounty hunting, focusing on bug chaining strategies and collaboration between hunters and triage teams.
Creator Stage·31 min
Roni Lupin Carta
Examines techniques for discovering high-impact Denial of Service flaws in bug bounties through N+1 database queries, GraphQL abuse, and cache poisoning.