Full transcript
0:00All righty, Ben. Look, I got to be honest. I don't really know a whole lot, if anything, about bug bounty. I feel bad. I feel a little ashamed cuz I know that's your world and you're always in it, but I feel like, "Oh, I'm just playing with malware or some of the other shenanigans, but not strictly bug bounty." And I feel bad. I don't
0:17want to ask you cuz I know you get the question all the time, but how do you do it? How does someone get started, even me? How do I get started in bug bounty? Yeah, I mean, you're a you're a threat hunter, man. You're a you're doing the hunting part already and you're a hacker at heart. You you know, what I've seen
0:30you on your channel and what I've seen you build and things like that. You have all that knowledge. I think at the core of it is it depends on your path, right? So, it's probably a lot different for somebody who's an app sec engineer pen tester wanting to make the switch versus someone who's done some IT support or they're coming from the
0:47networking world and want to dive into it, right? But really at the core of it is a couple of things. One is the knowledge of it. The knowledge is knowing these vulnerability types in depth because, you know, we have great scanners, we have AI, we have a lot of resources nowadays that make security a little bit easier, even though it's
1:03still, I think, suck at it as an industry, but there's frameworks and, you know, libraries I can use for security, but so, you want to know those things at a very deep level and know how to look for them. But then, outside the knowledge, the thing that I've learned a lot with a lot of successful bug bounty
1:18hunters that I've came across is that I have two things. One is the curiosity part, which that curiosity breaks into Okay, there we go. Google loves doing that. But that curiosity goes into wanting to break things, which asking for yourself, and just having that hacker problem-solving, too. Like, yeah, is this app made to do this? Can I make it do this other thing,
1:38right? And then the second bit that is really, really uh important is the passion. I know a lot of people get into bug bounty hunting because you see all these like massive numbers of you know, I made $5,000, $10,000, $30,000 in bounties and it sounds very cool and exciting, but it's not overnight. It's very rarely you see somebody makes, you know, 12, 15k in
1:57a you know, first bug. I've seen it happen, don't get me wrong, but um it it's just you have to have the passion or you're going to get burnt out and never want to do it and I've also seen it with myself when I'm more passionate about it, it doesn't feel like a chore, I'm more successful, I'm having more fun
2:10with it, too. So, those are just the the knowledge, the personality types and things like that and then it comes into like program selection, the thing you want to hack on, right? Because nowadays it's not just web, we have to secure mobile apps, we have to secure our cameras and cars and connected devices. We have AI, we
2:26have open source project, we have web 3 in um the world of blockchain as well. So, it just depends on what you really I don't know what you want to really hack on and you want to make money from it. I feel like for me, like selfishly, I feel like I think I'd be I'd be okay. Like I'd be good probably on the web
2:41front. Uh I I play enough capture the flag, right? I've done enough of the vulnerability work here and there. I I I feel like I could hack, but I don't know like how to do it. Is there is it a platform that I need to jump into first? I've seen Bugcrowd, I've seen HackerOne. Where do you find home for you and where
2:59you start to do bug bounty like tactically, signing up and registering? Yeah, so there honestly, uh I want to say there are four major players, right? You have your your HackerOne that you just talked about, then you have Bugcrowd, Integrity and YesWeHack. Those are the four that you can focus on. The first two that I mentioned are your I
3:16want to say they're more global. Integrity's becoming more global, so is YesWeHack, but they've been around the longest and you can find companies that are they're based out of Asia, they're based out of South America, North America and you can focus on those because it gives you an edge. If you are a person that lives in a specific country
3:33that uses this European bank, I can't go hack on it, right? Because I can't have a, you know, Swiss bank, for example, if I don't have a bank, you know, that have their bug bounty program because you have to be a Swiss person to get access to it. So, that gives you an edge. Then you're with Integrity and uh YesWeHack,
3:48they have a lot of European brands. I've seen them go after a lot of the bigger European brands like your uh Decathlon is like there. Uh Dick's Sporting Good you know, they have it in Europe. And I I don't know I didn't even know that existed until I went to Europe. Right? [laughter] They don't know what a hack it. So, you
4:04have those two also that are you know, they're becoming global. Don't get me that that with Louis Vuitton on there. You have Integrity has Yahoo and Intel on there. You have all these massive bug bounty platforms, but I really recommend just picking one and sticking to it because there is loyalty programs kind of in place that the more and more you
4:20hack on these bug platforms, they will probably give you more perks and there is a little bit of added uh you know, bonuses that come with being active on a specific uh platform. So, personally, uh my ranking is usually number one is HackerOne just because you know, full disclosure, I also worked at HackerOne for 6-7 years. And then I
4:39switched over to becoming a hacker full-time, but I just have a good uh reputation on them. I was like top 10 for a while. I'm in somewhere in top 30, top 40 now. But then I also hack, you know, equally on Bugcrowd, Integrity, and YesWeHack. Those are my second channels that I go hack on because you know, I just don't
4:55have enough time to hack on all of them, but they have some programs that are interesting to me, so I go after them and just pick a program that I want to hack on on those platforms. So, say I go register on HackerOne. How do I really go find a program? Is there like a directory? Is there a big old listing of
5:12like oh I know you were mentioned oh Yahoo, oh Walmart, whatever the case may be, but I feel like I will probably run into either duplicates or dupes because well, I mean I I would think that's probably kind of picked clean. Like I don't I'm trying to find how to prioritize something that oh I might actually find something and it's not
5:29already saturated with everyone else part of the party. Yeah, let me actually share my screen to make it a little bit easier. There we go. Okay. So, you can see the HackerOne screen. This is going to a directory, so you can go to the hackerone.com/directory. And you have some your you know, you have some of your basic searches here.
5:44You can say I want to do a offers bounty. So, that means they for sure pay you. So, you have limited time, John. I assume you don't want to work for free, even though I have nothing against full disclosure programs. If you're new to bug bounty hunting, you're new to web hacking, full disclosure programs or VDPs should be the place you go to
6:01because they don't pay, and you know, hackers like myself, people that do it full-time or they do it for the money aren't going to look at those. So, VDP is a really good place to go. Do I know how to hack web apps? Do I know how to do recon? Do I have my own methodology? Do I understand these web ones? All
6:17that, it's a good place to practice, and that's where I practice a lot of mine, too. So, you can go offers bounties, and this will give you a ton of programs, and you can just go through all these, honestly, and uh see which ones you like and which ones you don't, right? Then you can also filter it based on Let's say, John, you
6:33are you enjoy source code review. Uh I know you love that kind of stuff, so you can just click on source code review. Uh it would give you the programs that have a source code review in their scope. So, Netflix is one that I highly recommend. Uh but, it's not just source code, it's also web app, and they probably have
6:50something like a source code inside of it, too. Netflix has been a really good one. So, on our Discord we did we do this hacking for fun, you know, we just put a target up, and people go hack on it, and in that 1 month that we did it last year, I think, we generated like $80,000 in bounties. And one of the
7:04hackers on there uh got his first bounty, and it was $25,000 or $15,000, something like that. But, this is what I say, I've seen that happen, but it's it's not it's not every time, right? Right. Um but, let's just say you you pick Netflix, and then here's where you can see if this is worth hacking on or
7:21not, and I'll show you some of the stuff that I personally look at to kind of go, "Eh, do I want to hack on this thing, or do I not care enough?" One is, how much do they really pay? I'm playing this for money. Don't get me wrong, I love hacking. I have the passion for it, but
7:34at the end of the day, I have limited time, and I do this to generate some revenue for myself. So, I look at what this bounty amount is, their primary targets, which I'll explain in a little bit. It's up to $25,000. So, if I spend I don't know, 40 hours this next 2 weeks and I find something that lands in the,
7:50let's say, 15,000 range, that's a pretty good hourly rate to me, right? That's a couple hundred dollars an hour and I get to work for myself and not have to, you know, check my calendar and be like, "Oh, I got to go on this call. I got to do this." It's just it it makes it easy. It gives me the freedom, right?
8:03That's what I look at. It also comes down to your your lifestyle, right? Do you have a really lavish lifestyle that you need to pay a lot of money for? And you're you're living in a penthouse or, you know, is your rent low? So, this is a good spot to look at. Also, you know, the corporate assets are good one. And
8:16obviously have mobile apps and things like that. Even looking at the highs are really good because yeah, maybe I was just, you know, I'll find a couple of highs. I spent 40 hours and I get 6,000. That's still worth it to me, you know, even if for a week because I'm still doing something that I like. So, this is
8:30number one thing. I look at it and I go, "Wow, the bounties are great. I'm going to hack on this program." Then you have your You want to make sure they pay that bounty range though. You want to make sure if this company says, "We're going to pay $25,000." Have they put their money where their mouth is? Like, are
8:44they actually paying that, right? So, you look here and they have. They have paid $25,000 before. You know they're they're good for it. And it it matches. It says 2,000 to 25,000 and that is the range. And the fact that people are still getting paid in the last 90 days of $50,000 is a good indication that they are deploying
9:00things very regularly and there are bugs out there if you're putting the hours in, you know, you're looking for the right assets and things like that. So, that's what I look at. And then obviously, you know, when was the was the average time to bounty and things like that used to be visible. You want to make sure they're responding. All
9:14this looks great. Then it becomes, all right, do I actually like this company? I love Netflix. I'm sure you're watching Netflix too and it's something that everybody uses, I think, at this point. So, the passion is there. I like their company. I think they're it's it's a cool product that I like to use as well. So, I'm going to hack on it. Then it's
9:31the scope. And their scope is massive. You can see there's a open source for I've no idea what Zul is. We can take a look at it. but they have that in scope. So, if you find a bug, this is a critical in scope, that means they would give you the critical severity, right? So, that means up to 25,000 versus some
9:45of these are if they're marked as none or, you know, high, that means the max severity is that level that we looked at. That is massive scope, man. Like, this is great. I could just pick this company and go hack on it. And the cool thing with their program specifically is that if you look here, it says primary
10:00targets are netflix.com user experiences, their mobile apps, then they have corporate corporate targets. These are their corporate sites. So, they they take everything that's exposed documents. That could be some trade secrets that you find that, you know, some person on their team leaked a Google Doc and has some, you know, corporate document, they pay for that. Uh the secondary target is any public
10:20Netflix web application that's not related to netflix.com. So, every movie that has a promotional website becomes a target for Netflix. So, Netflix spins up, uh I don't know, let's say I don't know, it's uh Stranger Things. Right? It comes out, there's a you can go put your you can make an avatar with your Stranger Thing logo on there. You can
10:41pop that. We had somebody pop that that a couple months ago. It was some random movie's file upload thing, and then they just chucked the PHP file in there, and they had a web shell. So, because those are being sent to a third-party marketing agency they created, and security is not top of mind. They have this, you know, giant series that's
10:57coming out that's to be advertised. So, you have all of these things. This is like thousands and thousands and thousands of subdomains and domains they can go after, and with the possibility of making up to 25,000 dollars. So, that would be in a nutshell like how I would go picking a target, looking at if it's worth it for my time, do I want to hack
11:14on it, and then also is the target scope worth it, too. I don't know why I like just had the epiphany, but what you said was like, oh look, you know, the company the organization could still be like actively deploying new things. And I don't know why I never like had that fit in my mind cuz I thought, oh hey, the
11:32company's been listed for however long, there's probably just nothing left, right? Everyone's already ripped through and done all the bug hunting that could have been done. But, no, I mean, there there's constantly new things. And that's probably my next question to you is that how do you then approach it? I know you're big on recon, right? But, is
11:49it looking for subdomains? Is it just trying to find as wide of an attack surface as possible and then seeing what's weird or odd? >> [laughter] >> So, here's a really funny thing. So, there's a company that I don't think I can name. I don't know if they're private or not, but I hack on them religiously. So, if you all are watching
12:05this, they know what I hack on. They can guess. Um I have subscribed to every annoying marketing email on that company's web application. This company is massive. They have They have different, you know, they have like maybe 80, 90 different core apps within just one subdomain and that has different functionalities, right? Every single one of those I have
12:26subscribed to becoming to getting updates. So, every time I see a new email from, you know, so-and-so from this company. Like, let's say the new dashboard release for this application. I go and look. There was a time when they emailed me they launched this brand new AI-powered thing that they're doing and we got an email for it. And me and my
12:43buddy went through and looked at it and we found some SSRF in there, right? Like, >> [laughter] >> that's one of the the ways that I stay subscribed or up-to-date with a lot of these, but then you have your reconnaissance, too, right? You can do some subdomain enumeration where, you know, if you can set some, you know, a
12:58cron job, for example, where you run this every day and look at the diff, what has changed in those diffs. Let me know if something new has came up. Then you go and look at those. I've still taken a massive step away from doing reconnaissance because I love data and I catch myself just look at the data
13:13instead of hacking on that data. So, I said, enough is enough. I'm just going to do recon once in a while when I need it and then, you know, just go and hack on that company when I have my recon data. One thing I remember you showing me, and let me like totally make it clear for everyone tuning in, viewers
13:29and folks watching and listening like now Ben has been to my house, you know, we're buds, we're friends, we genuinely hung out. You were showing me like look dude, you were scrolling through whatever you just had worked through over the week and he's like look, I just dropped an XSS payload here and another one and another one and like everywhere
13:45you go, you're always putting some test. Like every single input field, every single opportunity Dropbox entry, input, whatever, you put a payload just to see what happens. Will it ever come back and will it hit? I have [laughter] a funny story about that. So I worked at HackerOne for 7 years. For 7 years my laptop's name was
14:04a blind cross-site scripting payload, >> [laughter] >> right? It was a closing script tag, it was a closing bracket, you know, double quote closing, closing script tag and then script SRC my domain, right? For 7 years, on the last year I was at HackerOne, it finally freaking fired. It fired in some device management device that the device management
14:23service they were using. I think Airbnb was the maintainer for it at the time and it fired after 7 freaking years. So yeah, everything, my phone, my laptop, my name at this point, if I could legally get my name changed to a cross-site scripting payload, I absolutely would. It's just That was going to be my next question for you
14:41though, like what is the craziest thing that you've done for a bug? >> [laughter] >> I had to sit down and legally launch a part of my company's LLC that I cannot say what it was, but I had to sit down with a bunch of lawyers for a couple of hours, submit a bunch of documents just so I can unlock a specific product from
15:00this company which required you to have as a legal entity. And this is uh it's it's weeks of work, man. It's like you have to submit documentation, proof. It helped me on the on a business side, too. It was like a, you know, kill two birds with one stone thing, but it was massive. Me and a buddy of mine were
15:17thinking about you can buy a specific service from this company, you pay like, you know, $100,000 and you become a part of their business by doing services for them. And we're considering doing it. And we're like, "Okay, we'll just hire a couple of guys. If the business takes off, we'll make some money. If not, we'll make that
15:33$100,000 in bug bounty, hopefully." It's a massive investment. It We didn't do it because it We When it came down to it, $100,000 is a very big investment for something like this. But you have to be like that though, man. Like a lot of these companies that are that you want to hack on, you can't just be a basic
15:49consumer. You have to be able to figure out how do the real users use this? Right? You can become a uh user of GitHub by just browsing through projects, but that's not the key use case for a GitHub, right? Like there's so much that goes behind the scenes of using GitHub with Git that you have to know at the core.
16:07And that is the the biggest thing is that you you have to understand that company's threat model. And every threat model is different. You know, a threat model for Netflix is a lot different than an Instagram or TikTok. Right? Like private videos on TikTok is a lot different than if you find some videos on Netflix. They don't care. Like
16:25it's Oh, wow, you found the trailer that's going to come out in a couple of months. Whoopty whoop, right? But on Instagram, people people pay to subscribe to you to watch your private videos that you have on there. Like your subscriber's video, right? So that the threat modeling is when you understand, okay, this company cares about these
16:38things specifically. How do I go after them? How do I go after the third parties that have access to those? And there are a lot of people that go after third parties specifically because it's easier to hack on them. And they have a lot of data on it. So it's just you have to really sit down and
16:52understand what is a threat model for this company? What do I do? Where do I go for? Is there anything that I don't know, you tend to see more often than not? Is it Is it XSS? Is it CSRF? Is it IDOR? Is that still everywhere or some way, somehow? Like I would love to Oh, find a local file inclusion or
17:08something. I feel like that'd be super cool. But I don't know, getting technical, getting tactical, do you have any anything you could pull out of a hat to see like, "Oh, no, we really saw this. It's still around kind of thing. I think that it comes down to the company. A lot of the modern companies that are
17:22relying on modern frameworks, Yeah. it's different. You don't see, you know, that people have some library that they use for IDORs, XSS, and things like that. But, these massive companies that are been around, you know, for decades, like they've been around since the '90s, 2000s, like look at Amazon as one. Look at I always use Netflix as one. Look at
17:40some of these old companies like John Deere as a VDP. These companies have been around for so long, it's really hard to convince developers to switch from those old apps to new ones, and when they do there's some sort of a gap in the middle because they still have to make it work with the old database. Yeah.
17:53>> Transition. Yeah. So, to answer the original question, maybe you don't see very straight-up IDORs anymore. Maybe there's a lot of UUIDs involved now, or the IDORs happen when you do some patch reversal because there is some, you know, it's being proxied to another internal API, and they didn't think about authentication or authorization, all right? You see that still to this
18:13day. XSS are still very common, and especially with, you know, Google Chrome, it's one of my favorite things that I've done. Big shout-outs to like Alex Chapman, he's been a massive uh part of doing that with me. We got $100,000 for just finding XSS IDORs like that on Facebook. But, that's because there is exploits for Google Chrome that
18:29comes out on a regular basis, and someone like Alex is on top of it. He's got he's a broker for those things now that you can go after. And you still see XSS a lot. Blind XSS has been massive for me. I also got to give a shout-out to Zeeshan for bringing me to that world, of reminding me that like blind
18:42XSS is still a thing. But, yeah, man, there are vulnerabilities out there. It's just having the patience to comb through thousands of requests, thousands of end user input fields, and making these assumptions of like, okay, if my name is being shown in an input form, where is it going to show up? Is it going to be in an input form? Is it
19:00going to be in a text area? Is it going to be in a title? Because if it's in a title and you have a script tag, it's not going to fire. You have to close the title tag, right? So, if you make those assumptions of like, I've seen this enough to know my name is going to show
19:12up in these definite HTML formats for the blind XSS to fire. Um so as you can see all those vulnerabilities, but one thing that I have that can also kind of walk you through, hopefully I can actually do it live and not ruin the demo, is I did a I can actually Let me share my entire screen to make it
19:26easier. Uh I found this vulnerability and it's one of my favorite bugs because of the fact that I had to do the recon, which, you know, it's a part of the game, and then on top of that, I had to find a vulnerability that was kind of interesting and then it gave me a RC on Red Bull. So, I'm going
19:45to walk you through it, but before I do, let me talk about one quick concept. Can you see Woxy here? I can. Yeah. >> Okay, perfect. So, Woxy allows you to do reverse whois lookup. So, if you type in something like Red Bull, it will do a whois on that and it will show you the information that comes with it, and
20:00based on that information, you can find similar domains that exist for that company, right? So, Red Bull is very unique because they love to register all their emails to domain at redbull.com. So, if you have a Woxy account, which I do, but I'm not going to log in to right now, you click on this, it is going to I actually
20:16works. It gives you a list of all of their domains that they own. So, every domain now here becomes a target. And if you look at when it was registered or created, the older the better. Well, it's not better better, the older the better because that means they have used this for something massive at some point and there are some legacy apps on it.
20:33So, 2001 is great. Uh Red Bull Radio, I'd probably look at that if I was hacking right now. Motorsports is one of the biggest things they have. The Hangers are big. But you can see some of these are really old, so there's probably massive infrastructure behind it. So, I did this and I ran a bunch of these through Subfinder. I have a couple
20:48of uh good sources with Project Discovery, for example, their Chaos is pretty good. I have Census, Shodan, uh tools that you can use, cert.sh, and it gives me a bunch of subdomains when you do pictures and you do things like getting the title and getting the technology using HTTPX. I'll skip all that stuff, they're just open source
21:04tools that you you do, but I just want to show this. This is my number one thing when I'm hacking on a big program is I go into here and I look at the company registration name and I look at the domains under that. And then same thing here. And if there is something like a name that's specific that allows
21:17me to query for it, I query for that and just you get a massive list. And you can hit their API if you want to automate this. So, you can hit their API will give you all this data. So, that's like the step number one if you're looking at a big company like your Netflix, your Red Bull, Yahoo, Google. They all have
21:32this. Obviously, the bigger like Google, the more data you're going to get and it's a needle in the haystack at this point where you have to find a domain to hack on. So, that was the number one thing. I found this domain on Red Bull and it came up with this thing. I'm going to try very hard to see if I can
21:45think of a solution for this cuz it's been a really long time. But, it was a website and all it did was, you know, some marketing website and down below was a login for the staff. So, I know we all joke haha hehe we're going to try admin admin here. I tried that. That's it's worked before a bunch of
22:02times. Well, when you do admin password admin admin and it works. Uh luckily for them this time that didn't work. But, trust me to this day I can't stress how many times I've seen admin admin and admin password and things like that work. Uh but, they didn't work. But, the cool thing is with bug bounty hunting the biggest thing is
22:19paying attention to small details. Little tiny anomalies that happen in the behavior of a web application could be massive for what you see. So, if I send a 404 page here, we have an engine X, right? Uh the web root is an engine X 404. Nothing fancy. If I go into here, if I open up this image for example,
22:36it's 404. Nothing, right? But, if we go to the other app where the staff app is, if we look at the image, it's still in Now, it's in staff image.png. And if I send it a 404, which is something very different. We're seeing that this website is routing the path to a different application on the back end, but just
22:56doing a web proxy, right? It's proxying the application to hit different internal apps in there. So, this is where it gets interesting because a lot of times people love filtering Java applications just as a string. You don't think about anything else. You just go, "I want it to just show stuff." So, if it was admin, you can do something like, you
23:13know, admin like this. And sometimes it will work. So, you look at different bypasses like, "Hey, can I find some dashboarding tool? Can I, you know, brute force for it or not?" But there's always this this ongoing meme orange side that this talk, I want to say 8 9 years ago that is still valid to this day is you can actually hit a lot
23:28of these Java apps with a dot dot semicolon slash, right? And that just bypasses everything. And uh sometimes you can do a percent 2F, but this one doesn't work. You know, you can see it gives a bad error. But, you know, you you can all you can do these different encodings and sometimes the slash is filtered and sometimes it isn't. But,
23:46the cool thing with it is that now you have this access here and you have a server manager, host manager, and things like that. Obviously, if you want to hit those, you got to continue to do it with your path traversal using the dot dot uh semicolon slash. So, I can do manager. It was something that was really good
24:00tool, but either way, this was There we go. And you can do things like admin admin and see if you can log in, but that wasn't the case. The cool thing for this one was I found Jolokia on here. So, uh Jolokia has a lot of different paths that you can hit. And sometimes you can find, I think, the heap dump and
24:14things like that. But, there's also a Jolokia CVE. Let me see if I can find it really quick. So, there's a ton of exploits where if you hit the right endpoint, you can either hit a flag or you can get a What was it that you were asking earlier? A local file read on a on a server. Yeah, local file inclusion.
24:31Yeah, so in this one, let's see, local file Here we go. So, there's a file read, file write, file write RCE. Uh there's all these different Tomcat creds that you can get. You can get the pass for them. I'm just trying to see if I can find this exploit live. I'm just going to do the local file inclusion
24:47part for this. Uh just to show you how Obviously, this didn't This took me a long time to do it because I had to put all these pieces together. But, there we go. Like, we can easily get a ETC password because again, while the JBoss instance wasn't publicly accessible, it was publicly accessible through the reverse proxy. By doing the dot dot slash, people have
25:07outdated stuff on the internet, man. They don't up This server is supposed to be internal. Why they going to update it and break things, right? And that's the case here. And with this one specifically, I think I ended up brute-forcing some credentials for Tomcat. I don't remember what the path is for this, but it was, you know, it's
25:23one of the default path. You hit the XML file for it, and there's a Tomcat username and password on there. You grab it, and you just go back to right here, and you log in, and you deploy your WAR file for it. That's so cool. I know that like it was 11 minutes or 12 minutes of me showing it, but I promise you didn't
25:37take me 11 minutes because there's so many of these different pieces of like I got to find the domain. I got to find the subdomain. Now I got to find the subdomain the needle of the haystack that I want to hack on. And then, you know, I have to accidentally get the 404 for Nginx, and then get the 404 for
25:54uh Tomcat to realize, "Wow, there is something different here, and maybe I should do the dot dot slash and see if it works." And luckily, it worked. >> But what you showed me here is one of the hacking hub labs like that recreates the exact same bug you saw and you found on Red Bull, right? >> [laughter]
26:10>> And that was actually I went to a F1 race in summer because of that vulnerability. I think that was the reason why I got in. They got me to go to Austria. They got me to an F1 race so I can enjoy the races on them, and they don't pay bounties. They send you massive jugs of Red Bull. I think they
26:25sent me six cases of Red Bull for that bug or eight cases of Red Bull. Hell yeah. Uh but massive shout-out to them. So, it's a fun, you know, you have these programs that I want to also talk about that really quickly. You have all these little programs that don't pay you, but they pay you in their product. So,
26:40United Airlines doesn't pay you, but they pay you in miles. You get 250,000 miles for the smallest the lowest bug. And you can get up to a million or maybe even more miles for something critical. So, John, if you go and find a good bug on United and you want to fly first class through Europe or you want to go
26:56to first class to Japan, it's doable, man. I My first time going to Europe was one of United Airlines, you know, business class flight after years of going there. I hadn't been in years. I went to see my family. It was because of the miles that I found by I found some leak credentials on GitHub 10 years ago.
27:11Wow. And they gave me 250,000 miles for it. Well, thank you, Ben. I mean, this feels at least a little bit more tangible for me right now cuz like logging in, okay, HackerOne, jumping on the directory, trying to see what programs are available, even if that just gives you the company name, no matter what it is, right? If it's if it's Netflix, if it's
27:29something, I don't know, mom-and-pop, like Joe Schmo, East Cupcake Community, right? I could still then give that to Huxley, Wuxley, whichever one of those uh hey Wuxley >> Wuxley, how do you >> [laughter] >> dump a lot of those potential domains that are associated with it, run that through Subfinder, Assetfinder, a lot of the project discovery tools, and then at
27:48least start to poke around on what isn't oh, the I don't know, upfront apparent, the thing that everyone has already seen. I I feel like I would just have more luck in in those corners and crevices uh to see and find, yeah, those weird oddities that are just still left out on the internet. So, that's cool. That's
28:07that's super cool. Thank you, Ben. >> Yeah, the other thing is to keep in mind is like you don't have to go wide recon like that with assets, either. You have companies like I use Expensefy as an example. I don't know if they have a bug bounty program, but you have something like this for receipt management and
28:19like reimbursing people, right? Those have so many different things you can test for. You have different user roles, different functionalities, different right? So, you can also go wide in that sense of finding an application that has these different user roles that you can test for authentication, authorization issues, different functionality for each different user types and things like
28:34that. So, don't limit yourself into like I have to go and find a program that has thousands of subdomains and companies within it. You also have these companies that are like the Airbnbs are a good example. You have the corporate Airbnb, you have can can a host, you can be a guest. Those are all the different places you can hack on. And then, you
28:49know, Amazon has the massive, massive amounts of apps underneath there, too. So, you have all these different ways you can go wide with recon that is not just domain and subdomain based. Sweet. I think if there is anything that I know I've learned over time running through different CVEs or like, oh, hunting up and seeing exploits kind of in the wild
29:06for even just real job, it's like, look, you you will find bugs. It's just a matter of looking in the first place. Like, hey, stuff exists that you wouldn't even realize and just cuz no one's looked. Uh but cool. This is some sweet motivation for me to go explore, go hunting. I mean, speaking of CVEs, man, you have someone like Versel Versel
29:26that's paying wild bypasses for the the recent CVE that dropped with >> Oh, Next.js, right? >> Next.js. They they I think they paid like millions of dollars for just finding wild bypasses for a CVE. So, there's a there is a there is a literally there's an avenue for everything that you can make funny money from with funny internet points is what
29:45I call it. >> [laughter] >> Hell yeah. Excellent. Well, hey, anything else, Ben, or is that the sweet crash course? I think we covered a lot of ground here. I think that's it. If you like this video, like and subscribe to this man right here. I think it's going to be to my right. >> way it is, yeah.
30:01>> [laughter] >> Yeah, thanks for having me, man. It's been great to collab with you. I think we have done a lot of smaller collaborations and to come and doing this with you, it's very cool. Yeah, this is super cool and you all in the crew are doing incredible stuff over at Hacking Hub just as well. So, it's sweet
30:14to have a playground for a lot of the things you can learn in and out of bug bounty. So, thank you again and again, Ben. Awesome. Thanks, dude.