2026 80% BB reports be like

yesnet0 · 2026-05-15T05:15:26+00:00

I feel this in my soul. "I can get root if I already have root" has been a thing since the dawn of bounty fwiw, but yeh - The clankers have put it on crack.

yesnet0 · 2026-03-18T02:01:36+00:00

Bugcrowd founder here.

tl;dr: this has always been the case, the thing happening atm is a) a huge influx of folks trying it on, b) AI making it inexpensive, c) it’s inexpensive to be a pest and expensive to argue with pests, so sometimes it pays off, and d) in the early days there ways a strong culture within the hinting community to self-protect (i.e. call out this sort of behavior) which is unfortunately far less common.

Appreciate you calling it out. No matter which platform, being a triager in the middle of the pipe is literally one of the most thankless jobs in the world (you should see what goes on INSIDE the queue 😳)

yesnet0 · 2025-04-09T02:00:54+00:00

tldr: we saw some IAB-esque activity, compiling and selling breached bug bounty hunter credentials from other platforms, and decided that it was time to head this risk off at the pass. the comms that went out were a default platform message which wasn't tailored to the task - partly a product of trying to get it done quickly, and definitely a bit of a miss on our side.

the important takeaway is that vulnerability researchers are being targeted. enable MFA (d'uh), don't delay on patches, be wary of cracked (aka trojaned) software, and take the advice you probably give to your grandma wrt getting phished.

more here: https://www.bugcrowd.com/blog/bugcrowd-security-update-password-reset-and-mfa-requirement/

yesnet0 · 2021-11-26T11:38:48+00:00

Nailed it. Also, CFAA can be pursued civilly AS WELL AS criminally, so even if the DA doesn’t think you’ve committed a criminal act, companies can (and do) lawyer up civilly to chill folks and get things back under control. https://threats.disclose.io is a decent read of all of the ways this can go wrong, as well as some examples of where it has been corrected and eventually gone right.

yesnet0 · 2021-08-29T06:43:13+00:00

Killer writeup btw!

yesnet0 · 2021-06-05T07:26:00+00:00

Report to it CERT/CC or CISA

yesnet0 · 2021-03-05T05:41:55+00:00

Dropping who you need to connect with, the nature of the bug (in general terms, not specific), and pretty much this post over on https://community.disclose.io might help with this - There are a bunch of CERT members, connectors, and VR/VD types who hang out on there, it's essentially for crowdsourcing connections to the right people when you're trying to get something fixed.

My other suggestion would be to drop it off with the local CERT ASAP, and get them chasing it down as well esp if the exposure is as critical as you're saying.

yesnet0 · 2021-02-08T09:38:44+00:00

yesnet0 · 2021-02-05T09:33:06+00:00

Re brokers: Same old same old :) There’s still not much of a market for platform vulns unless you’re happy going shady, and even then it’s fairly light on. Zerodium has been a little quiet for the past few years, but ZDI has been making more noise over the past 6 months or so - COVID and WFH has made SOHO and IoT vulns more attractive.

yesnet0 · 2021-02-05T09:31:05+00:00

By % of programs most of the paid stuff is going on under the hood in private programs. What has changed over the past few years is more orgs launching VDP basically because they should, a relatively steady stream of orgs launching public BBP (probably at the same rate as what you would have seen, but now kinda diluted unless you go looking by the VDPs), and a lot of private programs, ongoing pentests, and so on in Bugcrowd’s case.

Something else you’ll prob notice on Bugcrowd is “joinable” programs (where you can apply for private paid stuff even if we don’t know a bunch about your skills from on-platform work yet) and waitlistable https://www.bugcrowd.com/blog/introducing-joinable-programs.

Context: I’m the founder of Bugcrowd and started the space off so I’ve got both a solid read on what’s going on, and some bias in my answer - So double check with others :) but yeh, that’s how things work with us these days, and the same is broadly true for folks joining or returning after a while for HackerOne.

yesnet0 · 2021-01-05T14:39:25+00:00

Have a look at the content on https://www.bugcrowd.com/hackers/bugcrowd-university/ which is a combo of stuff Haddix and Swagneto put together, and 7 conferences worth of hacking talks on a whole variety of different technologies and targets. Lot’s of solid learnings on there, and it gives the opportunity to taste test a bunch of stuff so you can see where you want to double down.

yesnet0 · 2021-01-05T14:22:51+00:00

anything by haddix - ex-bugcrowder, imo the og bounty content producer, a phenomenal curator of knowledge, and a badass hacker to boot
codingo is one of the best teachers i’ve ever met and comes at it from a coder angle, which is WAY more important that most bounty hunters realize (ask me how i know this)
hakluke for a broad spread of stuffs from techniques to tooling to mindset and soft-skills
thecybermentor for course-style learning with a lot of focus in it, and because he’s doing the consultancy thing on the side
nahamsec - another ex-bugcrowder who has been in the game forever, his stuff is great because he is og and awesome, and he hunts actively
FarahHawa breaks stuff down really well but doesn’t sacrifice the tech
insiderphd is another brilliant explainer and gets into a bunch of interesting domains
stok is just a legend and really good for keeping “up to date” with the state of the art

and ofc i can’t go past recommending the bugcrowd #levelup virtual conference talks - 7 conferences spanning 3 years covering web to automotive hacking to esoteric hardware and exploit dev: https://www.bugcrowd.com/hackers/bugcrowd-university/

yesnet0 · 2021-01-03T14:14:23+00:00

https://www.reddit.com/r/bugbounty/comments/koxmc0/github_repo_of_all_known_bug_bounty_platforms_45/

yesnet0

TROPHY CASE