Abstract: Bug bounties are evolving faster than ever. With a surge in new researchers and a maturation in existing programs, new methodologies are needed to further strengthen the security of companies. In this presentation, I will outline existing incentives in bug bounties and how hackers can best adapt their hunting to align with these incentives. In short, this results in finding more impactful vulnerabilities that companies care about. I will present an overview of recent bug bounty innovations and present my own strategies for continuing to find bugs in long-running bug bounty programs. I will stress the need for comprehensive testing and familiarity with a company’s systems. As a demonstration, I will show a tool I have developed, released at THOTCON, that further aids reconnaissance by continuously monitoring changes in websites. Additionally, I will present vulnerability types that are often overlooked by researchers. Finally, I will give insight as to where I see the bug bounty field evolving in the future and how researchers can gain a leg up.

1. LEVELING UP: BUG BOUNTY
METHODOLOGIES IN A
MATURING ECOSYSTEM
JACK CABLE
@JACKHCABLE

2. Bug Bounty Programs

3. Bug Bounty Programs
Find bugs, get paid

4. Bug Bounty Programs
Find bugs, get paid
Hundreds of bug bounty programs
launched in 2017

5. Bug Bounty Programs
Find bugs, get paid
Hundreds of bug bounty programs
launched in 2017
> $20 million paid on HackerOne

6. Bug Bounty Programs
Find bugs, get paid
Hundreds of bug bounty programs
launched in 2017
> $20 million paid on HackerOne

7. Company Motivations

8. Company Motivations
More eyes on assets

9. Company Motivations
More eyes on assets
Continuous review

10. Company Motivations
More eyes on assets
Continuous review
Catch bugs in new features

11. Incentives

12. Incentives
New features are more vulnerable

13. Incentives
New features are more vulnerable
New program launches

14. Incentives
New features are more vulnerable
New program launches
Bugs do still exist in older software

15. Expanding Attack Surface

16. Expanding Attack Surface
Subdomain enumeration

17. Expanding Attack Surface
Subdomain enumeration
Google searches

18. Expanding Attack Surface
Subdomain enumeration
Google searches
Directory brute forcing

19. Expanding Attack Surface
Subdomain enumeration
Google searches
Directory brute forcing
JavaScript files

20. JavaScript Files

21. JavaScript Files
Often contain API endpoints

22. JavaScript Files
Often contain API endpoints
API keys and secrets

23. JavaScript Files
Often contain API endpoints
API keys and secrets
Insight into functionality

24. JavaScript Files
Often contain API endpoints
API keys and secrets
Insight into functionality
Jobert Abma - relative-url-extractor &
GerbenJavado - LinkFinder

25. JavaScript Files
Often contain API endpoints
API keys and secrets
Insight into functionality
Jobert Abma - relative-url-extractor &
GerbenJavado - LinkFinder

26. Coinbase Commerce

27. Hidden Functionality

28. Hidden Functionality
https://commerce.coinbase.com/static/js/app.1e74cb13.js

29. Hidden Functionality
https://commerce.coinbase.com/static/js/app.1e74cb13.js

30. Webhooks

31. Webhooks

32. Webhooks

33. Continuous Monitoring

34. Continuous Monitoring
FileChangeMonitor monitors JavaScript files
for changes

35. Continuous Monitoring
FileChangeMonitor monitors JavaScript files
for changes
Track dynamic file names

36. Continuous Monitoring
FileChangeMonitor monitors JavaScript files
for changes
Track dynamic file names
Sends email when relative urls are updated

37. Continuous Monitoring
FileChangeMonitor monitors JavaScript files
for changes
Track dynamic file names
Sends email when relative urls are updated

38. Benefits

39. Benefits
Be the first to find new features

40. Benefits
Be the first to find new features
Find hidden + undocumented content

41. Benefits
Be the first to find new features
Find hidden + undocumented content
Methodically test all API endpoints

42. Closing Words

43. Closing Words
Bug bounties are more efficient,
competitive

44. Closing Words
Bug bounties are more efficient,
competitive
Automation is key

45. Closing Words
Bug bounties are more efficient,
competitive
Automation is key
Bug bounties may become more
concentrated - open-sourced tools are
powerful

46. Links
https://github.com/cablej/FileChangeMonitor/
https://filechangemonitor.io
Twitter: @jackhcable