Download as PDF, PPTX
![Diving deep into the target using passive..sh Recon
Find all the **ASSETS** that belongs to that organisation. Assets?
○ Domains?
○ Subdomains?
○ 3rd Party Services used by Organisation (GitHub, Jira, Trello, Jenkins, GitLab, etc...)
○ IP Ranges?
○ iOS / Android Apps?
○ Doesn’t ends [n number of assets] ..….](https://image.slidesharecdn.com/bugbountyroadmap-adam-200829071400/85/BugBounty-Roadmap-with-Mohammed-Adam-10-320.jpg)
![Subdomains | Asset(s) Identification
● Subfinder [https://github.com/subfinder/subfinder]
● VirusTotal [https://www.virustotal.com/#/domain/domain.com]
● Certificate Transparency [https://crt.sh/?q=%.domain.com]
● Censys [https://www.censys.io]
● Google - site:example.com -www [Other Search Engines - Bing, DuckDuckGo, Yahoo]
● Google Certificate Transparency
[https://transparencyreport.google.com/https/certificates?hl=en]
● Facebook Certificate Transparency Monitoring
[https://developers.facebook.com/tools/ct]
● GitHub, Gist, Gitlab, Trello, Jira, etc…](https://image.slidesharecdn.com/bugbountyroadmap-adam-200829071400/85/BugBounty-Roadmap-with-Mohammed-Adam-11-320.jpg)
![Hacking with BurpSuite
Did you know? You don’t always need an automated Script to demonstrate the
impact of any data leak [PIIs].
Intruder for the win!](https://image.slidesharecdn.com/bugbountyroadmap-adam-200829071400/85/BugBounty-Roadmap-with-Mohammed-Adam-29-320.jpg)
![Diving deep into the target using passive..sh Recon
Find all the **ASSETS** that belongs to that organisation. Assets?
○ Domains?
○ Subdomains?
○ 3rd Party Services used by Organisation (GitHub, Jira, Trello, Jenkins, GitLab, etc...)
○ IP Ranges?
○ iOS / Android Apps?
○ Doesn’t ends [n number of assets] ..….](https://image.slidesharecdn.com/bugbountyroadmap-adam-200829071400/75/BugBounty-Roadmap-with-Mohammed-Adam-10-2048.jpg)
![Subdomains | Asset(s) Identification
● Subfinder [https://github.com/subfinder/subfinder]
● VirusTotal [https://www.virustotal.com/#/domain/domain.com]
● Certificate Transparency [https://crt.sh/?q=%.domain.com]
● Censys [https://www.censys.io]
● Google - site:example.com -www [Other Search Engines - Bing, DuckDuckGo, Yahoo]
● Google Certificate Transparency
[https://transparencyreport.google.com/https/certificates?hl=en]
● Facebook Certificate Transparency Monitoring
[https://developers.facebook.com/tools/ct]
● GitHub, Gist, Gitlab, Trello, Jira, etc…](https://image.slidesharecdn.com/bugbountyroadmap-adam-200829071400/75/BugBounty-Roadmap-with-Mohammed-Adam-11-2048.jpg)
![Hacking with BurpSuite
Did you know? You don’t always need an automated Script to demonstrate the
impact of any data leak [PIIs].
Intruder for the win!](https://image.slidesharecdn.com/bugbountyroadmap-adam-200829071400/75/BugBounty-Roadmap-with-Mohammed-Adam-29-2048.jpg)
Uploaded byMohammed Adam
BugBounty Roadmap with Mohammed Adam
Bug bounty roadmap covers various techniques for finding vulnerabilities such as understanding the target application flow, using passive reconnaissance tools to discover assets, hacking with Burp Suite to find bugs like XSS and SQLi, and keeping up with new trends to improve bounty hunting. The presentation emphasizes thorough preparation and research to avoid duplicate reports and better understand the target before launching attacks. It also provides tips for writing high-quality bug reports to build good relationships with security teams.
More Related Content
Similar to BugBounty Roadmap with Mohammed Adam
More from Mohammed Adam
BugBounty Roadmap with Mohammed Adam
- 1.
- 2. AGENDA ➔ Intro ➔ BugBounty Definition ➔ How to select a target ➔ Passive Recon Techniques ➔ Hacking with Burp Suite ➔ Importance of understanding an application flow ➔ Better Bug Bounty Report ➔ Keep up with all the new trends ➔ Live Session ➔ Recap | Wrapping up
- 3.
- 4. #whoami ❖ Mohammed Adam ❖Senior Security Consultant @ Crossbowlabs ❖ Occasional Bug Bounty Hunter ❖ Bike rider & Gamer ❖ Email: adamlaskas24@gmail.com
- 5. Hey you! What’sBug Bounty?
- 6. What’s Bug Bounty? ❏Bug Bounty is a reward offered to individuals who identifies and report bugs or security vulnerabilities in a computer program/system or software. ❏ The reward could be in any form - from goodies to hard cash or just acknowledgement.
- 7. How to selecta target?
- 8. How to selecta target? Assets in scope: ● Priority to wildcard {*.example.com} ● Mobile Apps Paying attention to out of scope / exclusions list: ● XSS ● CSRF ● Subdomain Takeovers Meh “really? Do you even care about Security 🤔”
- 9. Diving deep intothe target, Passive..sh Recon
- 10. Diving deep intothe target using passive..sh Recon Find all the **ASSETS** that belongs to that organisation. Assets? ○ Domains? ○ Subdomains? ○ 3rd Party Services used by Organisation (GitHub, Jira, Trello, Jenkins, GitLab, etc...) ○ IP Ranges? ○ iOS / Android Apps? ○ Doesn’t ends [n number of assets] ..….
- 11. Subdomains | Asset(s)Identification ● Subfinder [https://github.com/subfinder/subfinder] ● VirusTotal [https://www.virustotal.com/#/domain/domain.com] ● Certificate Transparency [https://crt.sh/?q=%.domain.com] ● Censys [https://www.censys.io] ● Google - site:example.com -www [Other Search Engines - Bing, DuckDuckGo, Yahoo] ● Google Certificate Transparency [https://transparencyreport.google.com/https/certificates?hl=en] ● Facebook Certificate Transparency Monitoring [https://developers.facebook.com/tools/ct] ● GitHub, Gist, Gitlab, Trello, Jira, etc…
- 12.
- 13. Trello, Jira, Gitlab... Even though if an organization's Jira instance has an auth, administrators set up "public" projects, they forget “public” means public for everyone. This could sometime give you keys to kingdom.
- 14. Trello, Jira, Gitlab... Thanks Ed :)
- 15. fofa.so - chineseversion of shodan
- 16.
- 17.
- 18.
- 19. IP Ranges Sir, I’vefound the IP Space now what?
- 20. IP Range -now what? ● Fire NMap and run NSE Scripts on those discovered IP Ranges ● Perform content discovery (file/folder bruteforcing) on every discovered asset ○ BurpSuite ○ Dirsearch, Dirbuster ○ Wfuzz
- 21. Oh the mobileapps are in scope, what should I look for? Did you know? You can find leakage of sensitive data in mobile apps without even installing them on your phone. Howwww?
- 22. Oh the mobileapps are in scope, what should I look for? Short Cut:
- 23. Oh the mobileapps are in scope, what should I look for? Long Route: ❖ Download the apk, you can do it from https://apkpure.com/ ❖ Upload the apk at https://apkscan.nviso.be/, run the Scan and wait for the results.
- 24. Oh the mobileapps are in scope, what should I look for? VIRUSTOTAL
- 25. Hacking with BurpSuite Settingthe right Scope
- 26.
- 27. Hacking with BurpSuite Keepingan eye on these issues list, always handy and helps a lot!
- 28. Hacking with BurpSuite BURPSPIDER ● Turn off Passive Scanning ● Set Forms to auto submit ● Set scope to advanced control and use a target name instead of regex (something like zomato instead of .zomato.com or .*.zomato.com$), you will be surprised to see the results and after effects of it 😲 ● Browse all URLs, make all requests POST/GET/PUT whatever, then spider all hosts recursively ● Profit (More Targets)!
- 29. Hacking with BurpSuite Didyou know? You don’t always need an automated Script to demonstrate the impact of any data leak [PIIs]. Intruder for the win!
- 30. Hacking with BurpSuite Using“Repeater tab” to find: ● XSS ● SQLi ● Privilege Escalation ● IDOR(s) ● More Bugs
- 31. Hacking with BurpSuite ●Using “Repeater tab” to find XSS, SQLi, IDOR(s), Privilege Escalation ● Catch a Request which accepts user input and throw it into a repeater tab. ● Start Fuzzing the parameters.
- 32.
- 33. Hacking with BurpSuite ●IDOR(s) are always easy, playing with the id parameters. Manipulate the create requests. ● id=1 > id=2 > Easy Money
- 34. Hacking with BurpSuite EasyPrivilege Escalation with Repeater ● Have 2 different user accounts, one low privileged user and other one with some level of permissions. ● Catch the request in BURPSUITE, throw them into a “Repeater tab” replace the cookies of a high level privileged user with low level privileged user, see if it’s a success!
- 35. Hacking with BurpSuite JSfor the WIN Feeding these in tools: https://github.com/GerbenJavado/LinkFinder
- 36. Feeding these intool python linkfinder.py -i /Desktop/z.burp -b -o cli
- 37. Shooting in Dark?Understand the application flow to find bugs
- 38. Shooting in Dark?Understand the application flow to find more bugs You’re doing it wrong - ● If you haven’t spent good amount of time to study the target. ● If you haven’t understood the privileges and functionalities of a user. ● If you haven’t checked their available docs, neither gathered all the information about the target. What happens next if you haven’t done your homework?
- 39. Shooting in Dark?Understand the application flow to find more bugs What happens next if you haven’t done your homework?
- 40. Shooting in Dark?Understand the application flow to find more bugs Researchers have a tendency to jump on the target application and start attacking them. What happens then? YOU END UP GETTING DUPE
- 41. Shooting in Dark?Understand the application flow to find more bugs
- 42. Shooting in Dark?Understand the application flow to find more bugs If you’ve invested good amount of time on a target, you will: ● Get better understanding about how the target app works. ● Know what parameters are usually being used by the target app. ● Understand the functionalities & privileges of the user’s in target app. ● Be able to identify what parameters to use when you discover tons of endpoints in JS files. Found an internal endpoint in JS and immediately knew what parameters to use based on my past research
- 43. Shooting in Dark?Understand the application flow to find more bugs
- 44. Shooting in Dark?Understand the application flow to find more bugs Read the Docs = Get a BUG?
- 45. Shooting in Dark?Understand the application flow to find more bugs Few Nice Reads: ● Static Analysis of Client-Side JavaScript for pen testers and bug bounty hunters - https://blog.appsecco.com/static-analysis-of-client-side-javascript- for-pen-testers-and-bug-bounty-hunters-f1cb1a5d5288 ● Discovering hidden endpoints using LinkFinder - https://gerbenjavado.com/discovering-hidden-content-using-linkfinder/ ● Getting started in Bug Bounty - https://medium.com/@ehsahil/getting-started- in-bug-bounty-7052da28445a
- 46. Better Bug BountyReport better bug reports
- 47. Better Bug BountyReport better bug reports better relationship
- 48. Better Bug BountyReport better bug reports better relationship better bounties
- 49. Sharing from otherside of the fence What you shouldn’t do?
- 50. Sharing from otherside of the fence ● What you shouldn’t do? ● Follow up after 5 mins of report submission ● Bounty Plz! ● Contacting someone from Security Team on Twitter asking for an update.
- 51. Sharing from otherside of the fence The Wrong Way, How not to submit a report?
- 52. Sharing from otherside of the fence The Right Way - ● Introduction ● Details ● Steps to reproduce (POC) ● Impact
- 53. Sharing from otherside of the fence Before reporting, always think from organization’s point of view and think from the other side - Understand companies nature of business Seeing an image of other users on a company like Zomato? Seriously are you kidding me? That’s not sensitive at all - Closing it as N/A VS Viewing others uploaded images on an Image Sharing Site
- 54. Sharing from otherside of the fence Mantra to build a strong relationship with Security team ● Be Professional with your communication ● While Submitting a report, provide detailed report with clear steps to reproduce ● Don’t bug or spam them, prepare a schedule for follow up’s ● Don’t do this - send a LinkedIn invite, or DM on Twitter asking for an update
- 55. Keeping up withnew trends ….Staying on top of new hacking trends can help you earn more bounties.
- 56. Keeping up withnew trends Sir, what should we do to keep up with all the new trends? #BugBounty #BugBountyTip #TogetherWeHitHarder Subscribe to topics like Information Security, Bug Bounty, Infosec, etc..
- 57. Keeping up withnew trends IT’S ALL ABOUT SOURCES
- 58. Keeping up withnew trends Hacktivity! https://hackerone.com/hacktivity ZERO DAILY! https://hackerone.com/zerodaily
- 59. Profit!! Time toearn bounties...
- 60. Profit!! Time toearn bounties...
- 61. Profit!! Time toearn bounties...
- 62.
- 63.
- 64.
- 65. #bugbountytip Waybackurls Scrape URLs using- https://github.com/tomnomnom/waybackurls/ root@pt:~/tools/recon/waybackurl$ cat domains.txt | waybackurls > urls root@pt:~/tools/recon/waybackurl$ cat urls | grep ".js"
- 66. #bugbountytip Bringing few more#tips: ● Search for developers, QA on Stackoverflow ● Always run wfuzz / dirsearch on all subdomain(s) found to discover more content, more bounties? ● Earlier this year, I got a bounty for redacted.corp.com/documentation and found an excel spreadsheet of the database, eehhh, easy money 😳 ● Can’t CSRF delete method? Few frameworks / API(s) allows to “fake” methods by additional parameters, ex: ○ Adding a parameter such as: method=delete | _method=delete -> API will parse it as a Delete request.
- 67. Recap | Let’sRoll It Back ● Dive deep into the target using Passive techniques: ○ Virustotal ○ crt.sh ○ censys.io ○ https://transparencyreport.google.com/https/certificates?hl=en ○ https://developers.facebook.com/tools/ct ○ CSP Headers ○ Don't forget the third party services, those are so helpful and always helps you to learn more about the target ● Shodan.io and fofa.so will give you a lot of juicy stuffs. ● Always give a shot at Mobile Apps - use apkscan.nviso.be | virustotal … ● Submit better reports, think from the other side about the impact before submitting. ● Keeping up with what’s happening around will help you earn more bounties.
- 68. Note ● Don’t payfor any kind of Bugbounty courses in market. ● There are many resources available free in internet ● For example: Web Security Academy - Free Online Training from PortSwigger ● Follow the Top Security Researchers in social medias Nahamsec Stock Jason Haddix Heath Adams Tomnomnom etc
- 69.