PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

‘There are a lot of vulnerabilities on public programs’: pwnii’s Bug Bounty journey so far

yeswehack.com | blog | #bug-bounty | #burp-suite | #mobile-security | #community | #idor | #interview
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Q&A with YesWeHack hunter pwnii (ranked 49th): entering Bug Bounty via CTFs, her favourite mobile IDOR account-takeover find, tools like Burp Suite with PwnFox, and tips for newcomers.
Published
Collected

Related coverage

blog · yeswehack.com
‘I usually choose targets that offer value to society’: krevetk0 on his principled approach to Bug Bounty hunting
Berlin-based Bug Bounty hunter krevetk0 talks about moving from QA into hacking, choosing socially valuable targets such as healthcare and banking, and the findings that shaped his career.
blog · yeswehack.com
‘I’m not the kind of person to rely on tooling’: Sn0rkY shares his Bug Bounty story and top tips
French hacker Sn0rkY shares his Bug Bounty methodology, views on AI tooling and advice for hunters in this YesWeHack interview.
blog · yeswehack.com
‘People think I’m all about automation, but I only automate recon’: how rabhi became our all-time #1 Bug Bounty hunter
YesWeHack interviews Issam Rabhi, its all-time #1 bug bounty hunter, on his path from reverse engineering to top rankings, his recon-first automation methodology, favourite vulnerability types, notable finds, and advice for aspiring hackers.
blog · yeswehack.com
‘One challenging thing about Bug Bounty is when it’s black box’: sunshinefactory on bug hunting, CTFs and hardware hacking
YesWeHack interviews sunshinefactory (Yuewei Wu), part of the winning team at the SPIRITCYBER hardware contest, on IoT hacking methodology, CTF versus bug bounty, and career advice.
blog · yeswehack.com
‘It was a revelation’: lemonoftroy’s origin story and hacking methodology
Interview with Adrián Pedrazzoli (lemonoftroy): his path into hacking, a preference for IDORs and access control bugs, a manual minimal-tool methodology, and advice for new hunters.
blog · yeswehack.com
‘My best attribute is persistence – technical skills you can learn’: drak3hft7’s Bug Bounty story so far
Q&A with Italian hunter drak3hft7 (Simone Paganessi, 8th on YesWeHack's 2024 leaderboard with 656 reports): soft skills over technical ability, his critical IDOR find, and favourite tools like Ghauri.
Back