PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

What Are Bug Bounties and How Do They Work?

hackerone.com | research | #bug-bounty | #pentesting | #red-teaming | #vulnerability-disclosure | #security-program | #hackerone
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A primer on bug bounty programs: how organizations define scope and rewards, differences between private, public, and time-bound formats, and how bounties complement VDPs and pentesting.
Published
Collected

Related coverage

blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
research · portswigger.net
Responsible denial of service with web cache poisoning
James Kettle shows how web cache poisoning can take down websites with a single request without collateral damage, earning bounties from Tesla and HackerOne along the way.
research · yeswehack.com
Junior devs ‘can’t actually code’, AI coding risks, security researchers decry inscrutable AI – OffSec roundup for CISOs
CISO roundup: junior devs' over-reliance on AI coding assistants sparks debate; researchers decry inscrutable AI; the UK iCloud encryption downgrade raises privacy fears; AI red-teaming lessons.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
research · certik.com
Inside CertiK's Independent Security Research on Besu
CertiK's chaos-engineering-style testing against a private multi-node Besu testnet uncovered five resource-exhaustion vulnerabilities, patched in Besu 26.7.1 and credited in Besu's release notes.
Back