Random BB Thoughts

25/04/2024:

I will have vacation tomorrow. Today, while riding scooter to the market. I think to myself it would be nice if i can find at least one bug today. A few hours later, I find a bug. That is a nice moment in bug bounty.

07/12/2023:

I re-test an attack scenario that I tested 1 year ago. I found a bug this time. Funny thing is that 1 year ago, I believed this feature is quite bug free. Glad that my skills have grown in this one year. The interesting thing is that I doesn't feel that my skills have grown this much, I rarely read articles, reports or hacking techniques in this year. I can't point to any piece of knowledge, information and say that my skill is up because of it.

So all the new things I learned this year are from actual hunting. Many of them come in forms of intuitions, rather than knowledges which can be easily spoken and passed around. The downside of this is the ego will feel uncomfortable, thinking it knows nothing new, because ego relies on certainty, consistency, but intuitions are rarely consistent. Maybe that's why religion talks so much about having faith.

Every time I test a new website. I still have little ideas how am I going to find bugs on this. It feels uncomfortable. But I will hunt anyway and have faith that my intuition will give me some good attack scenarios to test while examining the website.

30/10/2023: Connecting unexpected dots

I tend to find motivation in finding evidence that I bugs are important. I often hunt for logic bugs. I just recently found 1 more evidence for it. The interesting thing is I find it in 2 blog posts and when I read them, I didn't expect to see anything related to logic bugs here. These are:

1. https://blog.isosceles.com/an-introduction-to-exploit-reliability/, Ben Hawkes says that exploit reliability is very important for a bug impact. And logic bugs usually has extremely high exploit reliability.

2. https://www.youtube.com/watch?v=c0cS4R0ja-I, 1:42s Recapping Pwn2Own 2023 Vancouver, Abdul Aziz Hariri found a 6 logic-bugs chain. The narrator emphasis "works out of the box, no problem, no memory corruption necessary, pretty much typical <don't know what that is>, very great".

These two points are important, it shows how nice logic bugs are. But more importantly it shows that I can find gems in unexpected places.

18/10/2023: Making some improvement

I just went through several months without seeing my skill getting improved. Recently, It just improves!. 

My situation is that my skill stops improving after hunting for a few months, but I keep hunting, because it produces money, it feels better than just learning and earning no money. Plus, I want to improve my hacking skill via hunting alone. But it doesn't improve anymore, because I keep hunting the same old way. Recently, I try to dig deeper in a target that I have familiar with, and I see my skill improve again!.

To summarize, we can constantly improve our skill via mostly hunting. But we have to adjust our hunting style a little bit. For example, dig deeper, try hunting a new bug type for a week(expects a downward income this week), try hunting for several hours without stress (this is possible), try a new recon, hunting strategy.

It seems that in the end, everything comes down to get out of comfort zone a little bit, which simply means, do something we didn't do before. It doesn't need to be a grand action, just a small adjustment on how we usually hunt is good enough.

03/08/2023: Contemplation

In Vietnamese, the word Experience is "trải nghiệm". if we break it down, "trải" means "went through", "nghiệm" means "to contemplate". That's mean, if you want to have Experience, you have to go through something, then contemplate about it. In bug bounty, it means, if you want to gain experience in bug bounty, you have to hunt first, then contemplate about what you have been through. Or read an article, and think about it.

When we do/learn bug bounty and have some doubts, we are very fast to search for answers for our doubts online (or even worse, ignore the doubts.). We let "online experts" contemplate for us. This may save us a little bit of time right away. But in the long run, we lose our ability to contemplation. Furthermore, online answers are usually generic, it can't answer our doubts completely, so we are actually settling for lesser answers. Finally, contemplation helps us develop unique answers and ideas that will help a lot in building our unique hunting style.

I see this image in a video talking about Bruce Lee. The teaching fits very well in this blog post.
appear in 8:00 in this video: https://www.youtube.com/watch?v=vVC5jP-68-I

24/05/2023: Inspiration from a garbage man

The garbage man in my neighbor is very consistent. He always collect garbage at 5am to around 3pm, everyday, his collecting-streak usually last for a month, without taking any day off. There is one day that he takes a day off. But the next day, he told my wife that his vehicle is broken down instead. His work ethic is amazing, and somehow, it inspires me to hunt regularly and consistently too. So indirectly, I help me to earn several thousands dollars more. Living a good life can help other people in ways we can't possibly imagine. I will also give him some tips in holidays, as a way to payback. I think that's how emitting good energy to the world eventually get back to you with positivity.

But how does it relate to bug bounty?. With this kind of work ethic, he can success in anything he does. If you decide to do bug bounty and put as much effort as he does right now, he will be a successful bug bounty hunter. 

29/01/2023

Today, I just decide to write better bug reports, comprehensive and concise, also faster. Interestingly, Just making this decision helps me somehow, I instantly write reports faster. I also think they are clearer, easy to understand. It is interesting that just having an intention can do this much.

10/01/2023

When reading self-improvement books, I keep seeing the quote "Ask and you shall receive". In my early 20s, I didn't pay much attention to this quote. However, recently (late 20s), I think it is quite true. When I let other people know my intentions, people tend to let/help me achieve them.

For example, several months ago, I was hunting bug on a private bug bounty program. One of my report in this program is resolved, I noticed that they made a mistake, they marked it as resolved without fixing the bug, or forget to commit code?. It wasn't worth to create a new report and get a new bounty, so i just let them know and asked if they can reward me with any bonus. They replied they will send me a pair of socks as a swag. Damn, sending a single pair of socks from the US to Vietnam, I believed that the delivery fee will top the socks themselves. So I asked if they reward me with money instead? the comment I sent is "If it is not against your program policies, can I get a monetary bonus instead? Even $50 or $100 is better than swag to me.". So they let me do the retest for this report, which earned me $50. The good thing is they keep letting me do retests for my other reports too. Eventually, speaking my intention clearly has earned me nearly $1000, just in this case.

28/12/2022

Back to hunt bug after 1-week-off. Find nothing, in the afternoon, my quick nap turns into 90 minutes nap because of procrastination. I feel haste when while hunting. I think it is because I haven't got any new bug in the past week, so I want to catch something right away. This mentality only makes things worse. I will hunt again tomorrow, and this time, I will drop my haste mentality. It is ok for me to spend one more week without new bugs.