Bug Bounty Hunting Essentials Quick-paced guide to help white-hat hackers get through bug bounty programs Carlos A. Lozano Shahmeer Amir BIRMINGHAM - MUMBAI Bug Bounty Hunting Essentials Copyright © 2018 Packt Publishing All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews. Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the authors, nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book. Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information. Commissioning Editor: Gebin George Acquisition Editor: Shrilekha Inani Content Development Editor: Abhishek Jadhav Technical Editor: Mohd Riyan Khan Copy Editor: Safis Editing Project Coordinator: Jagdish Prabhu Proofreader: Safis Editing Indexer: Tejal Daruwale Soni Graphics: Tom Scaria Production Coordinator: Shantanu Zagade First published: November 2018 Production reference: 1301118 Published by Packt Publishing Ltd. Livery Place 35 Livery Street Birmingham B3 2PB, UK. ISBN 978-1-78862-689-7 www.packtpub.com mapt.io Mapt is an online digital library that gives you full access to over 5,000 books and videos, as well as industry leading tools to help you plan your personal development and advance your career. For more information, please visit our website. Why subscribe? Spend less time learning and more time coding with practical eBooks and Videos from over 4,000 industry professionals Improve your learning with Skill Plans built especially for you Get a free eBook or video every month Mapt is fully searchable Copy and paste, print, and bookmark content Packt.com Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.packt.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at [email protected] for more details. At www.packt.com, you can also read a collection of free technical articles, sign up for a range of free newsletters, and receive exclusive discounts and offers on Packt books and eBooks. Contributors About the authors Carlos A. Lozano is a security consultant with more than 15 years' experience in various security fields. He has worked in penetration tester, but most of his experience is with security application assessments. He has assessed financial applications, ISC/SCADA systems, and even low-level applications, such as drivers and embedded components. Two years ago, he started on public and private bug bounty programs and focused on web applications, source code review, and reversing projects. Also, Carlos works as Chief Operations Officer at Global CyberSec, an information security firm based in Mexico, with operations in USA and Chile. Shahmeer Amir is ranked as the third most accomplished bug hunter worldwide and has helped more than 400 organizations, including Facebook, Microsoft, Yahoo, and Twitter, resolve critical security issues in their systems. Following his vision of a safer internet, Shahmeer Amir is the founder and CEO of a cyber security start-up in Pakistan, Veiliux, aiming to secure all kinds of organizations. Shahmeer also holds relevant certifications in the field of cyber security from renowned organizations such as EC-Council, Mile2, and ELearn Security. By profession, Shahmeer is an electrical engineer working on different IoT products to make the lives of people easier. About the reviewers Sachin Wagh is a young information security researcher from India. His core area of expertise includes penetration testing, vulnerability analysis, and exploit development. He has found security vulnerabilities in Google, Tesla Motors, LastPass, Microsoft, F-Secure, and other companies. Due to the severity of many bugs, he received numerous awards for his findings. He has participated as a speaker in several security conferences, such as Hack In Paris, Info Security Europe, and HAKON. I would specially like to thank Danish Shaikh and Jagdish Prabhu for offering me this opportunity. I would also like to thank my family and close friends for supporting me. Ajay Anand is the Director and Founder of CTG Security Solutions®, Amritsar, Punjab in India. He has been running this Infosec Company since May 25, 2008 and deals in both Infosec Services and Training. A few of his franchise offices operate in various parts of India like Delhi, Bareilly, Hyderabad, and Bangalore while the head office is based in Amritsar. He manages all the company activities online and also supports his students with jobs. Many of his students have been placed in reputed companies after their infosec training. His company he runs has a team of 50 plus people. He has worked on many national and international infosec projects (Web Application Security Testing, Network Penetration Testing, Secure Code Review, Mobile Security Testing, and so on) as well. Packt is searching for authors like you If you're interested in becoming an author for Packt, please visit authors.packtpub.com and apply today. We have worked with thousands of developers and tech professionals, just like you, to help them share their insight with the global tech community. You can make a general application, apply for a specific hot topic that we are recruiting an author for, or submit your own idea. Table of Contents Preface 1 Chapter 1: Basics of Bug Bounty Hunting 5 Bug bounty hunting platforms 6 HackerOne 7 Bugcrowd 7 Cobalt 7 Synack 7 Types of bug bounty program 7 Public programs 8 Private programs 8 Bug bounty hunter statistics 9 Number of vulnerabilities 9 Number of halls of fame 9 Reputation points 9 Signal 10 Impact 10 Accuracy 10 Bug bounty hunting methodology 10 How to become a bug bounty hunter 11 Reading books 12 Practicing what you learned 12 Reading proof of concepts 12 Learning from reports 13 Starting bug bounty hunting 13 Learning and networking with others 13 Rules of bug bounty hunting 13 Targeting the right program 14 Approaching the target with clarity 14 Keeping your expectations low 14 Learning about vulnerabilities 14 Keeping yourself up-to-date 15 Automating your vulnerabilities 15 Gaining experience with bug bounty hunting 15 Chaining vulnerabilities 15 Summary 16 Chapter 2: How to Write a Bug Bounty Report 17 Prerequisites of writing a bug bounty report 18 Referring to the policy of the program 18 Table of Contents Mission statement 18 Participating services 19 Excluded domains 19 Reward and qualifications 19 Eligibility for participation 20 Conduct guidelines 21 Nonqualifying vulnerabilities 21 Commitment to researchers 22 Salient features of a bug bounty report 22 Clarity 22 Depth 23 Estimation 23 Respect 23 Format of a bug bounty report 23 Writing title of a report 24 Writing the description of a report 24 Writing the proof of concept of a report 25 Writing exploitability of a report 26 Writing impact of a report 26 Writing remediation 27 Responding to the queries of the team 27 Summary 28 Chapter 3: SQL Injection Vulnerabilities 29 SQL injection 29 Types of SQL injection vulnerability 31 In-band SQLi (classic SQLi) 31 Inferential SQLi (blind SQLi) 32 Out-of-band SQLi 32 Goals of an SQL injection attack for bug bounty hunters 32 Uber SQL injection 33 Key learning from this report 34 Grab taxi SQL Injection 35 Key learning from this report 36 Zomato SQL injection 37 Key learning from this report 38 LocalTapiola SQL injection 38 Key learning from this report 39 Summary 39 Chapter 4: Cross-Site Request Forgery 40 Protecting the cookies 42 Why does the CSRF exist? 42 GET CSRF 43 POST CSRF 43 CSRF-unsafe protections 44 [ ii ] Table of Contents Secret cookies 45 Request restrictions 45 Complex flow 45 URL rewriting 45 Using HTTPS instead of HTTP 45 CSRF – more safe protection 46 Detecting and exploiting CSRF 46 Avoiding problems with authentication 48 XSS – CSRF's best friend 49 Cross-domain policies 49 HTML injection 50 JavaScript hijacking 51 CSRF in the wild 51 Shopify for exporting installed users 51 Shopify Twitter disconnect 52 Badoo full account takeover 53 Summary 55 Chapter 5: Application Logic Vulnerabilities 56 Origins 56 What is the main problem? 57 Following the flow 58 Spidering 58 Points of interest 61 Analysis 62 User input 63 Out-band channels 63 Naming conventions 63 Keywords related to technologies 63 Analyzing the traffic 64 Application logic vulnerabilities in the wild 65 Bypassing the Shopify admin authentication 65 Starbucks race conditions 66 Binary.com vulnerability – stealing a user's money 69 HackerOne signal manipulation 70 Shopify S buckets open 70 HackerOne S buckets open 76 Bypassing the GitLab 2F authentication 78 Yahoo PHP info disclosure 79 Summary 86 Chapter 6: Cross-Site Scripting Attacks 87 Types of cross-site scripting 88 Reflected cross-site scripting 88 Stored cross-site scripting 89 DOM-based XSS 91 Other types of XSS attacks 91 [ iii ] Table of Contents Blind XSS 92 Flash-based XSS 92 Self XSS 93 How do we detect XSS bugs? 93 Detecting