Ethical Hacking And Bug Bounty: Reporting Out-of-Scope Vulnerabilities

In the world of ethical hacking and bug bounty programs, discovering vulnerabilities is only half the battle. The other half is ensuring that these vulnerabilities are reported effectively, even when they fall outside the scope of a program. A recent example highlights the importance of this approach, where a critical bug was reported directly to the company, resulting in a $2500 bounty despite being out of scope.

The Scenario:

A security researcher discovered a critical (P1) vulnerability in a domain that was listed on Bugcrowd’s Bug Bounty Program (BBP) but was marked as out of scope. Instead of ignoring the finding, the researcher decided to report it directly to the company. The company acknowledged the impact and rewarded the researcher with a bounty.

Key Takeaway:

If you find a bug that is out of scope, it’s worth reaching out to the company directly. Many organizations value the security of their systems and may still reward you for your findings, especially if the vulnerability is critical.

You Should Know:

1. How to Report Out-of-Scope Vulnerabilities:

Step 1: Document the vulnerability thoroughly, including steps to reproduce, potential impact, and any proof-of-concept (PoC) code.
Step 2: Identify the correct contact point within the organization. This could be the security team, a CISO, or a dedicated vulnerability reporting email.
Step 3: Craft a professional email explaining the vulnerability, its impact, and why you believe it should be addressed despite being out of scope.
Step 4: Follow up if you don’t receive a response within a reasonable timeframe.

2. Essential Tools for Bug Hunting:

Nmap: For network scanning and discovering open ports.
```
nmap -sV -sC target.com
```
Burp Suite: For web application testing and intercepting requests.
SQLmap: For automated SQL injection detection and exploitation.
```
sqlmap -u "http://target.com/page?id=1" --dbs
```

Metasploit: For exploiting known vulnerabilities.

msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS target.com
exploit

3. Linux Commands for Security Researchers:

Check Open Ports:
```
netstat -tuln
```
Monitor Network Traffic:
```
tcpdump -i eth0 -w capture.pcap
```

Analyze Logs for Suspicious Activity:

grep "Failed password" /var/log/auth.log

4. Windows Commands for Security Testing:

Check Active Connections:
```
netstat -an
```
List Running Processes:
```
tasklist
```
Scan for Open Ports:
```
netsh interface ipv4 show addresses
```

What Undercode Say:

Ethical hacking is not just about finding vulnerabilities; it’s about responsibly disclosing them to ensure the security of systems. Reporting out-of-scope vulnerabilities can sometimes lead to unexpected rewards, as demonstrated in this case. Always document your findings thoroughly and communicate them professionally. Tools like Nmap, Burp Suite, and Metasploit are indispensable for bug hunters, while Linux and Windows commands provide the foundational knowledge needed to navigate and secure systems.

Expected Output:

Nmap Scan Results:

Starting Nmap 7.92 ( https://nmap.org ) at 2023-10-01 12:00 UTC
Nmap scan report for target.com (192.168.1.1)
Host is up (0.045s latency).
Not shown: 995 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open https

Burp Suite Interception:
Intercept requests and modify them to test for vulnerabilities like XSS or SQLi.
Metasploit Exploitation:
Use exploits like EternalBlue to test for known vulnerabilities in Windows systems.

By following these steps and using these tools, you can enhance your bug-hunting skills and contribute to a safer digital world.

URLs:

References:

Reported By: Basavanagoud S – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Listen to this Post