Posts

Showing posts from May, 2024

Avoid burning out

Image
- Taking some weeks or months off always help. After months of doing bug bounty, you usually develop liking to something other than bug bounty. This is a good time to do it. Try to train like a pro-gamer in a game you like for a month is also a good option. - If you are burning out, there is a good chance that you are having many items in your bug bounty todo list. Just creates a file call archive.txt and move all these items to this and move this field to the deepest place in your computer. It will light up your head instantly. - Realize that there is no must-do, have-to-do, ought-to-do, should-do things in bug bounty (in life as well). You do them because they feel right for you, because they are interesting to you. And if they are not feel right for you, you don't need to do them. The worst that can happen is you lose some bounties. But you just save yourself from a lot of stress and burning-out. If you stick to this principle, your mind is clear and light. Hunting bugs with thi

Pay more attention to details

An elite hacker, a normal hacker, a no-bug hacker hunt on a Survey feature on a website, the 1st one can notice 40 unique details about this feature, the second one notices 20, the 3rd one notices 8. Let assume 2 out of these 40 details are:    - Survey Editor cannot see survey result when settingA is enabled.    - When settingA is enabled, survey result will be sent to a redefined receiver list instead.    - Survey Editor can add more people to the receiver list (via direct API call) after the survey start. Combine these 3 details, the elite hacker just finds 1 logic bug. The no-bug hacker cannot even imagine that there are 40 unique details in this Survey feature. He tests the the feature very fast, at a first glance, this feature seems simple and straight forward, looking through the API calls the feature makes, nothing seems out of place. He concludes this feature is hardened and move to the next feature until all features in the target program are tested. He looks at the program s