/Hive Five #75 · Jun 20, 2022
InfoSec: The Good, the Bad and the Ugly
/The Bee's Knees 🐝
The headline picks from this issue. The full issue has more.
-
Pentesting vs. Bug Bounty vs. Pentesting ???
What is the difference between Pentesting and Pentesting? There are different jobs that can be described as "pentesting" and LiveOverflow wants to talk a bit about it. This should also help you to better organize your own learning, as you better understand your goal.
Watch : Pentesting vs. Bug Bounty vs. Pentesting ??? -
Bug Bounty Redacted #4 - Writing to S3 buckets & Insecure JWT Implementation
Welcome to AssetNote's series called Bug Bounty Redacted! In this series they will be going through reports they have submitted to bug bounty programs over the last five years.
Watch : Bug Bounty Redacted #4 - Writing to S3 buckets & Insecure JWT Implementation -
Bug Bounty 101 #23 - From $0 to $150,000/mo - Hacking Methodology & Mindset
$0/mo to $150,000/mo. If you are struggling to find any bugs in bug bounty, maybe it's time to change a thing or two. In this video, Z-Wink discusses what he believes are the most important factors to being successful in bug bounty hunting as laid-out in an easy to follow multi step formula.
Watch : Bug Bounty 101 #23 - From $0 to $150,000/mo - Hacking Methodology & Mindset -
The ugly side of collaboration in bug bounties
TL;DR when money is involved, things can get ugly. Your best bet is to be clear about the terms up-front and stick to the 50/50 rule. Don't share information with people you don't have the privilege to.
Read : The ugly side of collaboration in bug bounties -
Hacking 6.5+ million websites => CVE-2022-29455 (Elementor)
It all started during the Hackerone ambassador WorldCup. While scanning their selected target websites they found an interesting wordpress website. After a quick scan for known plugins we found a wordpress plugin installed named "Elementor".
Read : Hacking 6.5+ million websites => CVE-2022-29455 (Elementor)