PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

PayPal on Creating Strong Relationships with Security Researchers

hackerone.com | research | #bug-bounty | #community | #program-management | #cvss | #security-researchers | #paypal
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PayPal's bug bounty team has awarded over $6 million to some 3,000 hackers since 2012, and shares lessons on researcher relationships: open feedback, transparency, and objective CVSS-based rewards.
Published
Collected

Related coverage

research · hackerone.com
How Security Researchers and Bug Bounty Programs Can Build Lasting Partnerships
Lasting bug bounty success comes from relationships: programs should clarify priorities in overviews, while researchers who study program guidelines closely uncover higher-impact vulnerabilities.
research · hackerone.com
Open-Xchange Approaches 3 Years of Bug Bounties & 250 Valid Vulnerabilities
Open-Xchange marks three years of bug bounties for OX App Suite, PowerDNS, and Dovecot with 250 valid vulnerabilities. Rewards follow a CVSS-based rating, with critical bugs earning up to $5,000.
research · portswigger.net
HTTP Desync Attacks: Request Smuggling Reborn
James Kettle revives HTTP Request Smuggling as HTTP Desync Attacks, splicing requests into victims' connections to poison caches and compromise PayPal's login page, earning over $70k in bounties.
research · portswigger.net
Finding DOM Polyglot XSS in PayPal the Easy Way
Using DOM Invader, PortSwigger found a polyglot DOM XSS in PayPal hidden in CSS-selector handling, then chained unintended script gadgets to bypass the site's CSP after triage dismissed the report.
research · portswigger.net
Bypassing CSP with policy injection
Gareth Heyes injects directives into PayPal's CSP via a token parameter in report-uri, dropping Edge's whole policy with a stray semicolon and overriding Chrome's script-src for a $900 bounty.
research · bugcrowd.com
How to Write a Clear and Thoughtful Scope, A Deep Dive
Bugcrowd's scoping deep dive explains how ambiguous bounty brief scope leads researchers to under-test or over-test, urging explicit in-scope assets and exclusions in every bug bounty brief.
Back