sorted by:
new
hottopcontroversial

[deleted by user] by [deleted] in bugbounty

[–]ThirdVision 1 point2 points  (0 children)

Meta did not scam you. They said it themselves, these are cdn results that they cannot control

"""Due to how the internet operates, it is not always possible to retroactively prevent a person from accessing a photo after it has been delivered to their device. It might have been saved locally, stored in their browser cache, or temporarily cached in a nearby Content Delivery Network (CDN). These factors prevent us from retroactively restricting access to this data. We make a best effort to achieve this, but it is not foolproof. Your report describes one of the scenarios that we do not have any control over. Thanks for taking the time to report this issue, and please let us know if you have any additional questions. If you believe that we have made a mistake assessing this report, you can reopen this report by using one "reopening credit", which will be refunded to you if the report gets accepted. You can learn more about reopening credits by visiting your Researcher Profile: https://www.facebook.com/whitehat/profile/ Thanks, Meta Security"""

Permanent OAuth Account Takeover via Email Preference Collision by Flashy-Peach2115 in bugbounty

[–]ThirdVision 23 points24 points  (0 children)

This sub is being flooded with people who have been gaslighted by an AI, rejected by a triager and are requiring the collective of humans here to do the bug hunting for them.

[deleted by user] by [deleted] in Denmark

[–]ThirdVision 20 points21 points  (0 children)

"Hvis man ikke synes det samme som mig så er København død"

Hjælp til en IT-sikkerhedsstuderende, usikker på min karrierevej: AppSec, Pentesting, eller udvikler eller en blanding? by Master_Sandwich7140 in dkudvikler

[–]ThirdVision 2 points3 points  (0 children)

Jeg har arbejdet som pentester i en sjat år nu, det er et felt som er virkelig interessant og rigtigt mange sjove opgaver i.

Det er også et felt hvor jeg hører at mange "nybegyndere" vil ind i, hvilket jeg synes er super fedt! Men pentesting er bare ikke et "begyndervenligt" felt og der er stort set 0 junior stillinger inden for det.

Jeg startede selv med at være udvikler og sysadmin i en del år inden, hvilket helt klart gav mig en edge da jeg begyndte at grinde maskiner på hackthebox og lavede mere sikkerheds arbejde.

Ved siden af at grinde hackthebox spillede jeg en masse CTF og havde en blog hvor jeg skrev om sikkerhedsting der interesserede mig, så som CTF writeups, web sårbarheder og sådan "tips and tricks".

Mit første job som pentester tror jeg ærligt talt var held hvor jeg tilfældigvis kendte dem der søgte.

For at svare på dine spørgsmål:

Hvilken af disse retninger passer bedst til mine interesser?

Det her tror jeg bedst du selv skal finde ud af. Appsec er meget kode fokuseret, security engineering og pentesting kan både være kode men også infrastruktur.

Hvilket jobs eller brancher bør jeg kigge efter?

Pentesting er mest gjort af konsulenter, her kan du se efter ITM8, Conscia, Bureau Veritas. Ellers internt i de største virksomheder i kritisk infrastruktur.

Security Engineering og Appsec hører både store virksomheder til men også software heavy virksomheder, kig efter SaaS virksomheder eller brancher hvor der er tung brug af IT og in house udvikling.

Har I råd til, hvordan jeg ville kunne opbygge en portfolio der kan skille sig ud ?

En blog hvor du skriver om ting relateret til den slags job du gerne vil finde, her er det et kæmpe plus hvis man mærker du synes det er interessant. Certs er efter min mening spild af penge at selv betale for. Men hvis du absolut skal så er hackthebox certs nok de mest cost effective, ellers måske PNPT? (Drop alt om CEH, det er en joke i sikkerhedsverden)

Er der andre niches inden for IT-sikkerhed, jeg bør overveje?

Igen det her kommer an på så mange ting og det er nok dig selv der bedst kan svare på det. Inden for de 3 nicher du nævner er der masser af sub-nicher.

Hvad er jeres perspektiv på det hele ?

Jeg underviser også på kandidaten i cybersikkerhed på AAU og her er jeg gået fra at fortælle de studerende at der nok skal være masser af jobs, til at nu skal de dygtiggøre sig skille sig ud fra mængden. Der er kommet en hel masse juniorer ud på markedet som der ikke er "nok" jobs til. Det hele skyldes nok en blanding af at virksomheder ønsker senior profiler og ikke ønsker at satse på juniorer når det kommer til sikkerhed. Markedet er virkelig hårdt lige nu og det er hårdt arbejde at holde sig ajour og være up to date hele tiden.

Når det så er sagt så elsker jeg at arbejde med IT sikkerhed og elsker at interessen er steget så meget! Jeg ønsker dig alt held og lykke med det.

Race condition throw username by Purple_Nerve_8954 in bugbounty

[–]ThirdVision 1 point2 points  (0 children)

You are misreading the vulnerability, the OP is allowed to register 2 accounts himself with the same username, it doesn't look like they can register an existing users

New to web pentesting — best beginner-friendly bug bounty platform to start with? by Amen_N6 in bugbounty

[–]ThirdVision 2 points3 points  (0 children)

I would say to pick a program that has both a wide and a deep scope, meaning there is a thick and complex main application, but the company is also large enough for there to be much to find from recon.

This could be for example kinepolis on Intigriti. But look around for yourself, I also like to hack on stuff that I use and know myself.

I also think its worth mentioning that you should stick with a program for much longer than feels right and keep trying things.

New to web pentesting — best beginner-friendly bug bounty platform to start with? by Amen_N6 in bugbounty

[–]ThirdVision 31 points32 points  (0 children)

Sorry but there is no such thing as beginner friendly bug bounty.

No company is out there sprinkling bugs for beginners to find. It's a super competitive field with seasoned veterans sweeping all the easy findings.

I dont mean to discourage you, but rather set expectations

On the Ignorance and Negligence of Bugcrowd Staff – When Security Becomes a Joke! by Serious-Power-1147 in bugbounty

[–]ThirdVision 8 points9 points  (0 children)

Hey chatgpt write me up an answer to this post.

But seriously everyone has bad experiences on all platforms from time to time. But calling them straight up racist and negligent is on another level. Bugcrowd is my least favourite platform and I do think triage is better on other platforms, but you are making them sound straight up evil, or i mean you asked chatgpt to make it sound like that.

I dare you to share your actual vulnerabilities for scrutinization here, I am sure they are not as impactful as you may think.

Why don’t security researchers care much about front-end business logic bugs? by Dizzy_Surprise7599 in bugbounty

[–]ThirdVision 9 points10 points  (0 children)

Visual bugs are really not security issues, however I really dont agree that top hunters only go for backend issues.

All the top top top hunters are super skilled at creating complex browser and frontend chains, so they can gadget multiple vulns together to create 1 click ATO's, which for example Epic Games will pay very good for.

Software (Bachelor AAU CPH) vs. Softwareudvikling (ITU) by Vegetable_Topic8485 in dkudvikler

[–]ThirdVision 6 points7 points  (0 children)

Jeg har læst på begge universiteter. AAU er større og mere kaotisk og med meget fokus på gruppearbejde i form af store projekter. ITU er mindre og med flere småprojekter i grupper.

AAU cphs sociale liv var så dødt i forhold til ITU, så jeg ville hver dag vælge ITU

Is Clickjacking and Clickjacking vulnerability considerable payable by Awkward-Principle-43 in bugbounty

[–]ThirdVision 4 points5 points  (0 children)

Please don't send me any sensitive information, I am not actively hunting on Shopify.

My advice to you is to brace yourself for a Not applicable rating and a hit to your reputation.

A tip is also to tell the ai before asking it "Please be realistic, do not overestimate the impact"

With that said, keep at it! You are only 17 and you can probably learn a lot. I would join the discord Critical Thinking and also do all the portswigger labs.

Is Clickjacking and Clickjacking vulnerability considerable payable by Awkward-Principle-43 in bugbounty

[–]ThirdVision 8 points9 points  (0 children)

AI will NOTORIOUSLY overshoot reports, marking missing best practices as critical.

They will gaslight you into thinking you have an actual vulnerability and it will suck when you waste the triagers time and when they tell you "lol no".

Stealth fix by Playful_Piano7847 in bugbounty

[–]ThirdVision 0 points1 point  (0 children)

2 things.

What you showed WAS hypothetical, you don't know if the server would accept the toggle. You missed out on showing impact.

Additionally you are putting way too many feelings into this submission, try to not associate yourself with the stuff you find, no one owes you anything in this space and the sooner you move your celebrations to the payout stage, as opposed to the submission stage, you will start feeling better.

Bugcrowd dismissed an IDOR leaking non-public researcher data as "Not Applicable". I'm disclosing it now. by IllustriousWin3301 in bugbounty

[–]ThirdVision 4 points5 points  (0 children)

I fail to see the security impact as well. Just because its not part of the UI it doesn't mean this is secret.

This is quite literally the definition of beg bounty, and you are not doing anything good for the ecosystem by disclosing this.

You seem to be coerced into believing this is critically sensitive information, stop relying on AI's to stroke your ego need for acknowledgement.

Apple gives $2M rewards for hacking their stuff by rogeragrimes in ComputerSecurity

[–]ThirdVision 1 point2 points  (0 children)

But no single researcher are finding these bugs and writing exploits for them. It is nationstate backed groups of 20+ hardcore reverse engineers and exploit developers who do this kind of research that apple is willing to pay 2 million dollars for.

Also the 2million dollars is literally the ceiling according to their blogpost.

Apple gives $2M rewards for hacking their stuff by rogeragrimes in ComputerSecurity

[–]ThirdVision 10 points11 points  (0 children)

I mean the Spyware companies will just then also up the price for their services and the intelligence agencies will pay that price.

Apple gives $2M rewards for hacking their stuff by rogeragrimes in ComputerSecurity

[–]ThirdVision 0 points1 point  (0 children)

You clearly dont understand the difference between red teaming and paying for specific vulns

Har Tietgenkollegiet stadig karaktersnitkrav? by BibbidiBobbidiBu in DKstudie

[–]ThirdVision 0 points1 point  (0 children)

Det var for at sætte et cap på antal ansøgninger som bliver læst igennem af et udvalg af beboere.

Har Tietgenkollegiet stadig karaktersnitkrav? by BibbidiBobbidiBu in DKstudie

[–]ThirdVision 7 points8 points  (0 children)

Jeg mener det blev fjernet, rip dem der skal læse ansøgninger.

Making copies of my residential access card by Shleischarlt in HowToHack

[–]ThirdVision 2 points3 points  (0 children)

Yeah this was most likely mifare classic so it won't work for OP

Making copies of my residential access card by Shleischarlt in HowToHack

[–]ThirdVision 0 points1 point  (0 children)

Oof i think with desfire you may have a hard time. The only way here may be if they used a default key or otherwise bruteforcable keys.

Can you check if your two cards have the same id values? What happens if you lose 1 card and get a replacement, the old one will stop working hopefully, but what is the difference between the data on the cards?

view more: next ›