Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

‘I found a CSRF and could deploy code through an enterprise’s App Store account’: yassine_eal’s Bug Bounty story

yeswehack.com | blog | #bug-bounty | #web-security | #app-store | #interview | #csrf | #hunter-story

Summary

Bug hunter yassine_eal explains how he picks targets by available time and recalls his proudest find — a CSRF that gave admin control over an enterprise's app-store code deployments.
Published
Collected

original ↗

Related coverage

  1. ‘I usually choose targets that offer value to society’: krevetk0 on his principled approach to Bug Bounty hunting (yeswehack.com)
  2. YesWeHack joins G-Cloud framework for UK public-sector procurement after clearing rigorous evaluation (yeswehack.com)
  3. How to use Codex for Bug Bounty research: explore broadly, validate rigorously (yeswehack.com)
  4. ‘Having humans in the loop’: Crédit Agricole Personal Finance & Mobility on the value of Bug Bounty (yeswehack.com)
  5. ‘One challenging thing about Bug Bounty is when it’s black box’: sunshinefactory on bug hunting, CTFs and hardware hacking (yeswehack.com)
  6. Cross-site request forgery: The ultimate Bug Bounty guide to exploiting CSRF vulnerabilities (yeswehack.com)

back