The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
•
32 likes•9,261 views
Frans Rosén has reported hundreds of security issues using his big white hat since 2012. He have recieved the biggest bounty ever paid on HackerOne, and is one of the highest ranked bug bounty researchers of all time. He's been bug bounty hunting with an iPhone in Thailand, in a penthouse suite in Las Vegas and without even being present using automation. He'll share his stories about how to act when a company's CISO is screaming "SH******T F*CK" in a phone call 02:30 a Friday night, what to do when companies are sending him money without any reason and why Doctors without Borders are trying to hunt him down.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (9)
Similar to The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
Similar to The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016 (20)
Recently uploaded
Recently uploaded (20)
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
- 1. detectifyThe Secret Life of a Bug Bounty Hunter Frans Rosén @fransrosen
- 2. detectify Frans Rosén "The Swedish Ninja" Knowledge Advisor @detectify ( twitter: @fransrosen ) Blog at labs.detectify.com HackerOne #6 @ hackerone.com/thanks Highest paid out bounty on H1: $30k
- 3. detectify Rundown 1. Background 2. Approaching a target 3. Free money 4. Automation 5. Browsers 6. End
- 5. detectify THEN I FREAKED OUT osv…
- 8. detectify How it actually started
- 10. detectify SWFs
- 20. detectify Firefox + Prezi… https://prezi.com/redirect/?url=//example.com%0a%2523.prezi.com HTTP/1.1 301 Location: //example.com%0a%23.prezi.com
- 21. detectify Firefox + Prezi… https://prezi.com/redirect/?url=//example.com%0a%2523.prezi.com HTTP/1.1 301 Location: //example.com%0a%23.prezi.com https://www.facebook.com/v2.2/dialog/oauth?scope=publish_actions,email &response_type=token &redirect_uri=https://prezi.com/redirect/%3furl=https://example.com%25250a%252523.prezi.com &client_id=298315034451
- 22. detectify Firefox + Prezi… https://prezi.com/redirect/?url=//example.com%0a%2523.prezi.com HTTP/1.1 301 Location: //example.com%0a%23.prezi.com https://www.facebook.com/v2.2/dialog/oauth?scope=publish_actions,email &response_type=token &redirect_uri=https://prezi.com/redirect/%3furl=https://example.com%25250a%252523.prezi.com &client_id=298315034451 NOO! :(
- 24. detectify Try the app + proxy
- 25. detectify Note during the walkthrough Structure of IDs Numeric? ID hashes visible cross accounts?
- 26. detectify Hashed IDs publicly available Update other users / Get user info ID as hashes, but visible using Google. No check if user was in another company. Bounty $3,000 https://hackerone.com/reports/23126
- 28. detectify 3rd-party scripts k.type='text/javascript'; var m,src=(m=location.href.match(/bkxsrc=([^&]+)b/)) && decodeURIComponent(m[1]); k.src=src||'https://cdn.krxd.net/controltag?confid=HrUwtkcl';
- 31. detectify CSP bypass script-src 'self' https://ajax.googleapis.com https://html5sec.org/minichallenges/3
- 32. detectify CSP bypass script-src 'self' https://ajax.googleapis.com https://html5sec.org/minichallenges/3 <script src=//ajax.googleapis.com/ajax/libs/angularjs/1.0.8/ angular.js></script>
- 33. detectify CSP bypass script-src 'self' https://cdn.mxpnl.com
- 34. detectify CSP bypass script-src 'self' https://cdn.mxpnl.com
- 46. detectify Facebook POST /rest/v1.1/me/transactions?http_envelope=1 HTTP/1.1 Host: public-api.wordpress.com cart[blog_id]=44444444
- 57. detectify Automation – Mr Roboto
- 58. detectify Collect 1. Collect all subdomains 2. Sort by popularity 3. Inject www between pop2 and pop1 4. Use to scan further + deeper 5. Every day. On all targets.
- 60. detectify Collect 1. Make requests to all domains 2. Save both headers + redirects + content timeout 10 curl -sD - "http://$p" -L --insecure --max-time 5 > $x x="streams/stream_pipe_$p"
- 62. detectify
- 64. detectify Safari – the special lil’ snowflake ❄
- 80. detectify Safari <= 8 Mixed Content UXSS 1.Find URL with Mixed Content 2.Use fragment payload to inject clickable link in console 3.SE to get user to open Inspect and click link 4.??? 5.PROFI-XSS-T!!!
- 82. detectify Safari 9 Host Header injection
- 83. detectify Safari 9 Host Header injection
- 84. detectify Safari 9 Host Header injection
- 85. detectify Safari 9 Host Header injection
- 86. detectify Safari 9 Host Header injection
- 87. detectify One more thing "Best X ever"
- 92. detectify Best bug hunting day ever
- 93. detectify Best bug hunting day ever
- 94. detectify The Secret Life of a Bug Bounty Hunter Frans Rosén (@fransrosen) – www.detectify.com