Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How to find SSTI, cache poisoning, business logic vulnerabilities: methodology tips from top Bug Bounty hunters

yeswehack.com | blog | #bug-bounty | #methodology | #ssti | #business-logic | #cache-poisoning | #cwe-1336 | #cwe-349 | #cwe-840

Summary

Top hunters supr4s, codejump and Kto94 share methodology tips for SSTI (CWE-1336), cache poisoning (CWE-349) and business logic errors (CWE-840), from recon and tools to impact-driven exploitation.
Published
Collected

original ↗

Related coverage

  1. ‘I usually choose targets that offer value to society’: krevetk0 on his principled approach to Bug Bounty hunting (yeswehack.com)
  2. YesWeHack joins G-Cloud framework for UK public-sector procurement after clearing rigorous evaluation (yeswehack.com)
  3. How to use Codex for Bug Bounty research: explore broadly, validate rigorously (yeswehack.com)
  4. ‘Having humans in the loop’: Crédit Agricole Personal Finance & Mobility on the value of Bug Bounty (yeswehack.com)
  5. Dojo challenge #53 Hacker Club solution (yeswehack.com)
  6. PUMA live hacking event revisited: leHACK’s biggest Bug Bounty yet (yeswehack.com)

back