PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hack The Army Results Are In

hackerone.com | vulnerability | #bug-bounty | #dod | #hack-the-army | #us-army | #results
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Hack the Army results: 371 invited participants filed 416 reports (about 118 unique and actionable), earning roughly $100K in bounties; the standout finding chained an open proxy from goarmy.com into an internal DoD site.
Published
Collected

Related coverage

blog · hackerone.com
Announcing HACK THE ARMY
Army Secretary Eric Fanning announces Hack the Army, the U.S. Army's first bug bounty challenge with HackerOne, expanding DoD's hacker-powered security after Hack the Pentagon resolved 138 vulnerabilities in its pilot.
vulnerability · hackerone.com
Hackers Wanted: Hack the Army & Pentagon!
The DoD announces its first Vulnerability Disclosure Policy — a legal route for hackers to report bugs in DoD public systems via HackerOne — and opens registration for the Hack the Army bug bounty challenge.
research · hackerone.com
ANNOUNCING HACK THE ARMY 3.0 RESULTS: A CONVERSATION WITH DEFENSE DIGITAL SERVICE, U.S. ARMY, AND HACK THE ARMY 3.0’S TOP HACKER
Hack the Army 3.0 drew 40 researchers who found 238 vulnerabilities — 102 high or critical — earning over $150,000. DDS, Army leaders, and a top hacker discuss the results and what's next.
vulnerability · hackerone.com
How Federal Agencies Use Vulnerability Disclosure Policies to Level Up Security
Vulnerability disclosure policies are becoming a requirement for federal agencies. The article recaps HackerOne's government work since Hack the Pentagon and five components of an effective VDP.
vulnerability · hackerone.com
Why Every Federal Agency Needs a VDP
A CISA draft directive requires all US federal civilian agencies to publish a vulnerability disclosure policy, following the DoD VDP model that surfaced 12,000+ vulnerabilities in three years.
vulnerability · hackerone.com
8 High-impact Bugs and How HackerOne Customers Avoided a Breach: SQL Injection
This series entry covers SQL injection, fifth most rewarded on HackerOne, with disclosed Starbucks and US DoD reports showing how verbose errors and XML upload endpoints lead to database compromise.
Back