PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How this seasoned bug bounty hunter combines Burp Suite and HackerOne to uncover high-impact vulnerabilities

portswigger.net | research | #bug-bounty | #interview | #workflow | #hackerone | #burp-suite-professional | #js-miner
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Full-time bug bounty hunter Arman S. (Tess) explains how pairing Burp Suite Professional with HackerOne, plus extensions like JS Miner, helps him find and report high-value vulnerabilities.
Published
Collected

Related coverage

research · portswigger.net
Responsible denial of service with web cache poisoning
James Kettle shows how web cache poisoning can take down websites with a single request without collateral damage, earning bounties from Tesla and HackerOne along the way.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
blog · portswigger.net
What's new in Burp Suite Professional: A year of innovation
A roundup of a year of Burp Suite Professional updates: major performance improvements, expanded Bambdas scripting capabilities, Burp AI launch, and workflow enhancements across the toolkit.
blog · portswigger.net
Welcome to the next generation of Burp Suite: elevate your testing with Burp AI
Burp Suite Professional 2025.2 introduces Burp AI with five features: Explore Issue, Explainer, AI-generated recorded logins, access control false positive reduction and AI-powered extensibility.
blog · portswigger.net
Find GraphQL API vulnerabilities, with Burp Suite Professional
Burp Suite Professional adds GraphQL scan checks that find known and hidden endpoints, detect enabled introspection and Apollo suggestions, and flag endpoints that fail to validate content types.
Back