1 of 72

BUG BOUNTY WORKSHOP

FUNSHOP

2 of 72

AGENDA

Intro
Bug Bounty Definition
How to select a target
Passive Recon Techniques
Hacking with Burp Suite
Importance of understanding an application flow
Better Bug Bounty Report
Keep up with all the new trends
Live Burp Suite Session
Recap | Wrapping up

3 of 72

Intro

4 of 72

#whoami

Prateek Tiwari - @prateek_0490
Security Lead @ Zomato
Security Consultant, Occasional Bug Bounty Hunter
Email: prateek0490@gmail.com

5 of 72

Hey you! What’s Bug Bounty?

6 of 72

What’s Bug Bounty?

Bug Bounty is a reward offered to individuals who identifies and report bugs or security vulnerabilities in a computer program/system or software.
The reward could be in any form - from goodies to hard cash or just acknowledgement.

7 of 72

How to select a target?

8 of 72

How to select a target?

Assets in scope:

Priority to wildcard {*.example.com}
Mobile Apps

Paying attention to out of scope / exclusions list:

XSS
CSRF
Subdomain Takeovers

Meh “really? Do you even care about Security 🤔”

9 of 72

Diving deep into the target, Passive..sh Recon

10 of 72

Diving deep into the target using passive..sh Recon

Find all the **ASSETS** that belongs to that organisation. Assets?

Domains?
Subdomains?
3rd Party Services used by Organisation (GitHub, Jira, Trello, Jenkins, GitLab, etc...)
IP Ranges?
iOS / Android Apps?
Doesn’t ends [n number of assets] ..….

11 of 72

Subdomains | Asset(s) Identification

Subfinder [https://github.com/subfinder/subfinder]
VirusTotal [https://www.virustotal.com/#/domain/domain.com]
Certificate Transparency [https://crt.sh/?q=%.domain.com]
Censys [https://www.censys.io]
Google - site:example.com -www [Other Search Engines - Bing, DuckDuckGo, Yahoo]
Google Certificate Transparency [https://transparencyreport.google.com/https/certificates?hl=en]
Facebook Certificate Transparency Monitoring [https://developers.facebook.com/tools/ct]
CSP Headers? Anyone? That’s interesting isn’t it? Well that has given me couple of criticals and a nice payouts. Never miss!
GitHub, Gist, Gitlab, Trello, Jira, etc…

12 of 72

CSP Headers

13 of 72

gist.github.com

14 of 72

gist.github.com

Cost of Human Errors :(

15 of 72

Trello, Jira, Gitlab ...

Even though if an organization's Jira instance has an auth, administrators set up "public" projects, they forget “public” means public for everyone. This could sometime give you keys to kingdom.

16 of 72

Trello, Jira, Gitlab ...

Thanks Ed :)

17 of 72

fofa.so - chinese version of shodan

18 of 72

shodan.io

19 of 72

IP Ranges

https://bgp.he.net/search?search%5Bsearch%5D=Smule&commit=Search

20 of 72

IP Ranges

https://whois.arin.net/ui/query.do

21 of 72

IP Ranges

Sir, I’ve found the IP Space now what?

22 of 72

IP Range - now what?

Fire NMap and run NSE Scripts on those discovered IP Ranges
Perform content discovery (file/folder bruteforcing) on every discovered asset

BurpSuite
Dirsearch, Dirbuster
Wfuzz

23 of 72

Oh the mobile apps are in scope, what should I look for?

Did you know? You can find leakage of sensitive data in mobile apps without even installing them on your phone. Howwww?

24 of 72

Oh the mobile apps are in scope, what should I look for?

Short Cut:

25 of 72

Oh the mobile apps are in scope, what should I look for?

Long Route:

Download the apk, you can do it from https://apkpure.com/
Upload the apk at https://apkscan.nviso.be/, run the Scan and wait for the results.

26 of 72

Oh the mobile apps are in scope, what should I look for?

VIRUSTOTAL

27 of 72

Hacking with BurpSuite

Setting the right Scope

28 of 72

Hacking with BurpSuite

29 of 72

Hacking with BurpSuite

Keeping an eye on these issues list, always handy and helps a lot!

30 of 72

Hacking with BurpSuite

BURP SPIDER

Turn off Passive Scanning
Set Forms to auto submit
Set scope to advanced control and use a target name instead of regex (something like zomato instead of .zomato.com or .*\.zomato\.com$), you will be surprised to see the results and after effects of it 😲
Browse all URLs, make all requests POST/GET/PUT whatever, then spider all hosts recursively
Profit (More Targets)!

Will cover up in Live Session

31 of 72

Hacking with BurpSuite

Did you know? You don’t always need an automated Script to demonstrate the impact of any data leak [PIIs].

Intruder for the win!

32 of 72

Hacking with BurpSuite

Using “Repeater tab” to find:

XSS
SQLi
Privilege Escalation
IDOR(s)
More Bugs

33 of 72

Hacking with BurpSuite

Using “Repeater tab” to find XSS, SQLi, IDOR(s), Privilege Escalation
Catch a Request which accepts user input and throw it into a repeater tab.
Start Fuzzing the parameters.

34 of 72

Hacking with BurpSuite

SQLi(s)�id=1’

id=1‘’

id=1’-sleep(10)-’

id=1"

id=1"“

id=1"-sleep(10)-”

id=1/sleep(10)

35 of 72

Hacking with BurpSuite

IDOR(s) are always easy, playing with the id parameters. Manipulate the create requests.

id=1 > id=2 > Easy Money

36 of 72

Hacking with BurpSuite

Easy Privilege Escalation with Repeater

Have 2 different user accounts, one low privileged user and other one with some level of permissions.
Catch the request in BURPSUITE, throw them into a “Repeater tab” replace the cookies of a high level privileged user with low level privileged user, see if it’s a success!

37 of 72

Hacking with BurpSuite

JS for the WIN

Feeding these in tools:

https://github.com/GerbenJavado/LinkFinder

38 of 72

Feeding these in tool

python linkfinder.py -i /Desktop/z.burp -b -o cli

39 of 72

Shooting in Dark? Understand the application flow to find bugs

40 of 72