Opens profile photo
Follow
bugcrowd
@Bugcrowd
The leading provider of crowdsourced cybersecurity solutions purpose-built to secure the digitally connected world...Unleash Ingenuity™
Technology-Security CompanySan Francisco, CAlinktr.ee/bugcrowdJoined September 2012
6,548 Following
145.5K Followers

bugcrowd’s posts

bugcrowd
@Bugcrowd
┏━━┓┏━━┓┏━━┓┏━┓ ┗━┓┃┃┏┓┃┗━┓┃┗┓┃ ┏━┛┃┃┃┃┃┏━┛┃ ┃┃ HACK THE PLANET ┃┏━┛┃┃┃┃┃┏━┛ ┃┃ ┃┗━┓┃┗┛┃┃┗━┓ ┃┃ ┗━━┛┗━━┛┗━━┛ ┗┛
8
801
bugcrowd
@Bugcrowd
🎉 100k Giveaway 🎉 Hackers walked so Bugcrowd could run. Thank you for being part of our community! 🏃 💯 To show our appreciation, we're giving away swag all day! 😎 To enter 🎟️ ⤵️ 🔁 RETWEET 🧡 LIKE ✅ Drop your fave Bugcrowd memory below👇 #ItTakesACrowd
Embedded video
0:29
350
725
bugcrowd
@Bugcrowd
Found a Wordpress site? The easiest place to find bugs is in the plugins. 1. Find the installed plugins with WPScan 2. Set up your own WP instance and install the same plugins 3. Hack your own instance 4. Report your bugs! The most common bug you'll find with this method is XSS
14
609
bugcrowd
@Bugcrowd
🎁 Merry X(SS)MAS! Hackers!🎄 Beginning today we are doing 12 swag-ful days of giveaways and challenges. Today's challenge is simple: spread the cheer of #XSSMAS with a retweet of this tweet to be one of 12 researchers to get today's exclusive swag! ☃️
46
575
bugcrowd
@Bugcrowd
┏━━┓┏━━┓┏━━┓┏━━┓ ┗━┓┃┃┏┓┃┗━┓┃┗━┓┃ ┏━┛┃┃┃┃┃┏━┛┃┏━┛┃ HACK THE PLANET ┃┏━┛┃┃┃┃┃┏━┛┃┏━┛ ┃┗━┓┃┗┛┃┃┗━┓┃┗━┓ ┗━━┛┗━━┛┗━━┛┗━━┛
6
496
bugcrowd
@Bugcrowd
If you're hunting for low-hanging bugs in source code, grep and regex can help you to identify hotspots. For example, you might find basic rXSS in PHP with something like this: grep -r "echo.*\$_\(GET\|REQUEST\|POST\)" .
3
456
bugcrowd
@Bugcrowd
What's your favorite part of this hacker setup? 💻👇 We would share ours, but we can't choose just one. 👀 It's. Too. Cool. 😈 😎 Thanks for sharing!!
@aditi_singghh
Image
51
455
bugcrowd
@Bugcrowd
XXE's are still quite common, and they're usually a P1! Here are places that you can look for them, comment if you have any other ideas! Thread 👇.
6
402
bugcrowd
@Bugcrowd
Here are a few ways to make the most of an XSS. Comment if you can think of some other ideas or resources! Thread 👇.
18
396
bugcrowd
@Bugcrowd
Did you know: The term 'bug' (as it refers to computers) was first coined in 1947 when a group of computer scientists found an actual moth causing malfunctions in a computer.
14
365
bugcrowd
@Bugcrowd
Looking to quickly dump URLs from a webpage using curl and some regex magic!? Try: curl -s https://www.bugcrowd[.]com | pcregrep -o "(http:\/\/|https:\/\/).*?(?=\"|'| )" | sort -u
Image
3
347
bugcrowd
@Bugcrowd
New to bounties? We've created this page containing links to everything you need to know including free educational resources, researcher docs, how to find bugs, beginner resources, how to get private invites, and more. Login to view! bugcrowd.com/welcome #BugcrowdTipJar
bugcrowd.com
Managed bug bounty programs, a better approach to security
Bugcrowd's bug bounty and vulnerability disclosure platform connects the global security researcher community with your business. Crowdsourced security testing, a better approach! Run your bug bounty...
2
326
bugcrowd
@Bugcrowd
"For me, the ninth month of the Islamic calendar, Ramadan, is the month to think about the blessings Allah has casted on me and my family, reflect on the year and act towards becoming a better Muslim." - Murtaza Haizji (Senior Manager Demand Gen) Ramadan Mubarak 🙏
Image
24
341
29.4K
bugcrowd
@Bugcrowd
What's something a non-hacker wouldn't understand? We'll go first: congratulating each other for finding bugs 🐛
65
319
bugcrowd
@Bugcrowd
XSS is the most common bug class! It pays to be good at finding them. In the latest how-to blog post,
@hakluke
covers what XSS is, different discovery methods, contexts, filter bypasses, weaponized payloads, and more.
bugcrowd.com
The Ultimate Guide to Finding and Escalating XSS Bugs | @Bugcrowd
What is XSS? Cross-Site Scripting (XSS) is the most common vulnerability discovered on web applications. It occurs when an attacker is able to execute client-side JavaScript in another user’s...
3
319
bugcrowd
@Bugcrowd
What are the best resources for beginners? What do you recommend to hackers who are just starting out? We're all 👂👂👂
35
296
bugcrowd
@Bugcrowd
When you find an XSS, at minimum, use alert(document.domain) over alert(1). This helps to demonstrate the context that the JavaScript is executing in. Even better, escalate the XSS to perform an account takeover! Don't forget to share your own XSS tips using #BugBountyTipJar
8
293
bugcrowd
@Bugcrowd
Researchers, ⊂_ヽ 　 ＼＼ we 　　 ＼( ͡° ͜ʖ ͡°) 　　　 >　⌒ヽ 　　　/ 　 へ＼ 　　 /　　/　＼＼appreciate 　　 ﾚ　ノ　　 ヽ_つ 　　/　/ 　 /　/| 　(　(ヽ 　|　|、＼you! 　| 丿 ＼⌒) 　| |　　) / ノ )　　Lﾉ (_／ Have a great weekend. 😎
7
269
bugcrowd
@Bugcrowd
Researchers ⊂_ヽ 　 ＼＼ we 　　 ＼( ͡° ͜ʖ ͡°) 　　　 >　⌒ヽ 　　　/ 　 へ＼ 　　 /　　/　＼＼appreciate 　　 ﾚ　ノ　　 ヽ_つ 　　/　/ 　 /　/| 　(　(ヽ 　|　|、＼you 　| 丿 ＼ ⌒) 　| |　　) / ノ )　　Lﾉ (_／ Have a great weekend 🧡
2
253
bugcrowd
@Bugcrowd
A quick one-liner that will gather + crawl all subdomains, then convert to a custom wordlist unique to that organisation based on discovered URLs! subfinder -d bugcrowd[.]com -silent | httpx -silent | hakrawler -plain | tr "[:punct:]" "\n" | sort -u
252
bugcrowd
@Bugcrowd
🚨CHALLENGE TIME🚨 Can you popup an alert?😉 Rules⤵️ 📣DM us a screenshot once complete 📣100 likes & we'll release a hint 15 winners⤵️ 🥇5 winners: hoodies 🥈5 winners: t-shirts 🥉5 winners: stickers + glasses GO 👉 bgcd.co/3PKAefZ Challenge by
@MRCodedBrain
Image
29
251
bugcrowd
@Bugcrowd
If you had to put together a "Hacking for Beginners" starter kit, what is one item your kit absolutely can't exist without? 😎
72
238
bugcrowd
@Bugcrowd
Changes are coming to Bugcrowd Vulnerability Disclosure Programs. Starting Monday, Points will no longer be awarded on VDP submissions. Find out why we are making this change in our latest blog post here 👇
bugcrowd.com
How Bugcrowd sees Vulnerability Disclosure Programs and Points | @Bugcrowd
Starting June 1st at 17:00 Pacific Time (UTC-7), points on VDPs will be disabled.  If you have already obtained points on VDPs, they will not disappear.  Vulnerability Disclosure: It’s very important...
30
219