hacking: security in practice
Seeking opinions on Bug Bounties and whether they are 'good' for society/'bad' for society/inbetween/why?

Bug Bounty looks like a good way to earn money.

I'm more interested in wondering about the 'societal goals' of bug bounty work. And where the 'industry' ends up in 10-20 yrs.

For example: you could say bugs have, in the past, been a way to either 'fuck the system', or at least to say 'the system can be fucked' or 'look how fucked the system can be'. And most of bug bounties is helping out already rich-and-powerful corporations, which some could argue already have too much wealth, too much power. Maybe even so much power that the largest companies help maintain power over everyday citizens. The idea that: corporations are just as, or more powerful than governments, or work in tandem with governments to maintain the power i'm talking about.

On the other side, I imagine, people could say "well if you find bugs in software through a bug bounty system: you are protecting the everyday computer user from being exploited by data-breach etc."

Can bug bounty be generalised into one of these two camps? Are you more on one side of the fence than the other? I ask because I do not know all that much about this and am not sure what side of the fence I am on. I am mostly wondering about bug bounty as a phenomenon, and where it goes in 20 yrs time? do all corporations in 20 years time essentially 'own' all the top bounty hunters? do they put them up in big mansions and employ the bounty hunters just for their own company? might be a bad question but i wonder where the bug bounty system goes. It is helping massive corporations out isnt it. do they need the help? or is it helping everyday users? can such a generalization be made?

So I am wondering if anyone has a strong opinion about Bug Bounty? In terms of value to society or whatever your value system may be.

submitted by /u/Adept_Ad_8458
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

OTP Bypass {step to step}
https://technicalsurendra.medium.com/otp-bypass-step-to-step-c81f1a6a40f5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Learn how OTP can bypass and report it to company's to get bounty |Continue reading on Medium » (https://technicalsurendra.medium.com/otp-bypass-step-to-step-c81f1a6a40f5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Google Dork Series !!
https://infosec-helper.medium.com/google-dork-series-1acd2b09a37b?source=rss------bug_bounty-5

I am Parshwa Bhavsar and I am starting new series of Google Dorks in which , I’ll mention some useful dorks.Continue reading on Medium » (https://infosec-helper.medium.com/google-dork-series-1acd2b09a37b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

OTP Bypass {step to step}

Learn how OTP can bypass and report it to company's to get bounty |Continue reading on InfoSec Write-ups »
Read more...

Google Dork Series !!

I am Parshwa Bhavsar and I am starting new series of Google Dorks in which , I’ll mention some useful dorks.Continue reading on Medium »
Read more...

Hacking on Medium
OTP Bypass {step to step}

https://cdn-images-1.medium.com/max/900/1*-D0eLo1NNn4-Sx44N-qo1Q.jpeg
Learn how OTP can bypass and report it to company's to get bounty |

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Google Dork Series !!

I am Parshwa Bhavsar and I am starting new series of Google Dorks in which , I’ll mention some useful dorks.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Roadmap to become an Ethical hacker

https://cdn-images-1.medium.com/max/1815/1*1fbaXSDe9h4Dtmy_ufQSWA.png
INTRODUCTION

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The curse of the p-value

https://cdn-images-1.medium.com/max/2500/0*M44NayJzFmq8pqB1
For decades, the quality of statistical results has been measured using the p-value.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

4-ZERO-3 - 403/401 Bypass Methods + Bash Automation

>_ Introduction 4-ZERO-3 Tool to bypass 403/401. This script contain all the possible techniques to do the same. NOTE : If you see multiple 200 Ok/bypasses as output, you must check the Content-Length. If the content-length is same for multiple 200 Ok/bypasses means false positive. Reason can be "301/302" or "../" Payload DON'T PANIC. Script will print cURL PAYLOAD if possible bypass found. >_ Preview >_ Help root@me_dheeraj:$ bash 403-bypass.sh -h >_ Usage / Modes Scan with specific payloads: --header Support HEADER based bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --header --protocol Support PROTOCOL based bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --protocol --port Support PORT based bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --port --HTTPmethod Support HTTP Method based bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --HTTPmethod --encode Support URL Encoded bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --encode --SQLi Support MySQL mod_Security & libinjection bypasses/payloads \*\* New \*\* root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --SQLi Complete Scan {includes all exploits/payloads} for an endpoint --exploit root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --exploit Prerequisites apt install curl DebianDownload 4-ZERO-3
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Unknown Process Running Express Server on port 49670
https://www.reddit.com/r/Pentesting/comments/r43gjp/unknown_process_running_express_server_on_port/

I found a node process running in Activity Monitor. It has the following files open cwd / txt HOME/.nvm/versions/node/v16.6.2/bin/node txt /usr/lib/dyld 0 ->0xa2975ade53f9c9ca 1 . . . 20 /dev/null 21 localhost:49670 It's parent process is java (880) which in turn was started by Code Helper (Renderer) which I think is Microsoft's visual studio. I scanned port 49670 with service discovery and got this PORT STATE SERVICE VERSION 49670/tcp open http Node.js Express framework |_http-title: Error Never noticed this process and curios if I should be worried about this or not, thanks :) submitted by /u/nova_outis (https://www.reddit.com/user/nova_outis)
[link] (https://www.reddit.com/r/Pentesting/comments/r43gjp/unknown_process_running_express_server_on_port/) [comments] (https://www.reddit.com/r/Pentesting/comments/r43gjp/unknown_process_running_express_server_on_port/)

___________________________
@hacking_Attack
@Hacking_Video

4-ZERO-3 - 403/401 Bypass Methods + Bash Automation
http://www.kitploit.com/2021/11/4-zero-3-403401-bypass-methods-bash.html

___________________________
@hacking_Attack
@Hacking_Video

>_ Introduction 4-ZERO-3 Tool to bypass 403/401. This script contain all the possible techniques to do the same. NOTE : If you see multiple [200 Ok]/bypasses as output, you must check the Content-Length. If the content-length is same for multiple [200 Ok]/bypasses means false positive. Reason can be "301/302" or "../" [Payload] DON'T PANIC. Script will print cURL PAYLOAD if possible bypass found.
>_ Preview

___________________________
@hacking_Attack
@Hacking_Video