I get request for tips for getting started in bounty hunting- so I group an answer here. This is what have worked for me and my primary focus is on Windows and filesystems. An area that I think is underrated as there is explosion in minifilters that have to all interact securely
-
Show this thread
-
Files are relevant for many security sceneraios and NTFS is often poorly understood. I recommend thinking up edge cases, what would happen if? Then test and see if it is exspected. Read about obscure edge cases- read disassebly , look at NTFS.sys
2 replies 3 retweets 35 likesShow this thread -
do your own tooling- that is how you learn. test ideas, try stuff, come up with hypothetical exploitable scenarios, see if you can find them. Make solutions for arb file create to code exec. read, test, try stupid stuff- sometimes you get surprised. Forget assumptions, verify
2 replies 8 retweets 54 likesShow this thread
There is new exploit class I call "trusting what is learnt under impersonation"- when a service do actions based on things learned under impersonation- like read a .config file. If read under impersonation and instructs it to load a dll- it is exploitable. You can find those
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.