Live Bug Bounty Recon Session on Verizon Media's Yahoo.com W/ @Securinti

### Overview This livestream session features a live bug bounty reconnaissance workflow targeting Verizon Media's Yahoo assets, followed by an in-depth guest interview with prominent bug bounty hunter Inti De Ceukelaire (@securinti / Inti). The host spends the first half of the stream troubleshooting server infrastructure and writing Bash automation to query HTTP response codes and headers into a MySQL database (`reconDB`). The second half transitions into a wide-ranging discussion with Inti covering his hacking background, bug bounty philosophy, discovery of logic flaws, recon approaches, and collaboration dynamics at live hacking events.

### Key Topics - **Live Recon Automation**: Building Bash scripts to take discovered alive domains from `httpprobe`, probe HTTP/HTTPS ports (80 and 443) using `curl`, collect response codes, and store the output in MySQL tables. - **Hacking Journey & Philosophy**: How Inti got started in security via a PlayStation Portable crash bug and Google's Hall of Fame, embracing an "uncertified" path focused on curiosity and reading documentation rather than formal certifications. - **Deep Recon vs. Surface Automation**: Inti's preference for manual core-target analysis, reading client-side JavaScript, and using the Wayback Machine to identify legacy endpoints and architectural changes. - **Logic Flaws & Escalation**: Identifying non-technical, application-logic vulnerabilities (e.g., Ticket Trick, gift card discount loops, grouping/blocking privilege escalation) and escalating low-severity findings (P4/P5, HTML injection, CSS injection) into higher-impact bugs. - **Community, Mental Health & Collaboration**: Managing burnout through vacations and structured routines, collaborating at live hacking events with peers (such as Jack Cable and Jobert Abma / cable-jey), and friendly rivalries with Team Sweden and Frans Rosén.

### Technical Details - **MySQL & Bash Recon Pipeline**: The streamer resolves local MySQL socket configuration issues on Linux before querying `domains_data` where `alive = 1`. A custom Bash loop queries each domain with `curl -s -o /dev/null -w "%{http_code}"`, checking port 80 first. If a `000` status returns, it re-attempts the request via HTTPS on port 443 with `-k` (insecure) and records the resulting status code into a newly created `headers` table. - **Wayback Machine & JS Archaeology**: Inti explains his technique of using the Wayback Machine to fetch historic JavaScript files and analyze diffs. Finding remnants of deprecated software in JavaScript provides hints about backend systems, undocumented endpoints, or lingering legacy services. - **Chaining Logic Flaws**: Inti highlights that logic flaws typically arise from combining individually secure components. Examples discussed include abusing newsletter discounts to continually repurchase gift cards at a discount, exploiting Facebook group admin assignment logic by blocking all group members to force solitary membership, and intercepting password resets through misconfigured email/bounce flows that bypass standard web authentication.

### Takeaways - Deep, manual source code reading (especially JavaScript) often uncovers vulnerabilities that automated broad-scope scanners miss. - Understanding the expected operational workflow of an application allows researchers to find high-impact logic flaws by doing the inverse of what developers anticipated. - Beginners do not need specialized programming backgrounds or security certifications to succeed; persistence, reading documentation thoroughly, and asking specific, well-researched questions are far more valuable.