PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Tips from Top Hackers – Bug Hunting methodology and the importance of writing quality submissions

bugcrowd.com | research | #bug-bounty | #reconnaissance | #bugcrowd | #methodology | #interview | #subdomain-discovery | #brett-buerhaus
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd interviews top-ranked researcher Brett Buerhaus on his bug hunting methodology: reviewing scope, recon with Google, Shodan and Censys, nmap scanning, fuzzing, and building proof-of-concepts.
Published
Collected

Related coverage

blog · yeswehack.com
‘I’m not the kind of person to rely on tooling’: Sn0rkY shares his Bug Bounty story and top tips
French hacker Sn0rkY shares his Bug Bounty methodology, views on AI tooling and advice for hunters in this YesWeHack interview.
blog · yeswehack.com
‘One challenging thing about Bug Bounty is when it’s black box’: sunshinefactory on bug hunting, CTFs and hardware hacking
YesWeHack interviews sunshinefactory (Yuewei Wu), part of the winning team at the SPIRITCYBER hardware contest, on IoT hacking methodology, CTF versus bug bounty, and career advice.
research · portswigger.net
How I choose a security research topic
James Kettle on choosing security research topics: evaluate how quickly you can fail, chase what scares you, and know when to push on, using his race-conditions research as a case study.
research · portswigger.net
Hunting evasive vulnerabilities
James Kettle's Nullcon keynote explores evasive vulnerabilities from a decade of research — too advanced, too silly or well-masked to spot — extracting principles for finding overlooked flaws.
research · portswigger.net
How to turn security research into profit: a CL.0 case study
Strategies for turning security research into bounty profit, using the CL.0 desync class as a case study: assess competition, find gaps in released scanners, and act before a technique saturates.
research · swarm.ptsecurity.com
Discovering Domains via a Time-Correlation Attack on Certificate Transparency
A new recon technique: since servers renew all TLS certs at once, time-correlating Certificate Transparency logs reveals every domain a server uses — handy for threat intel and bug bounty.
Back