O'Reilly logo

Hands-On Bug Hunting for Penetration Testers by Joseph Marshall

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Reproducing the Bug – How Your Submission Is Vetted

Without the internal security team being able to validate your findings by recreating your PoC, it's hard to get a reward. You could've spoofed or mocked up findings, or created them during some since-patched edge condition that doesn't represent a significant threat.

The easiest way to ensure that your bug is reproducible is to, from the very beginning, practice reproducing it yourself. If it's a manual finding or semi-automated tool such as Burp Intruder, can you reliably recreate it (it might take a couple of tries to get the right sample size if there's a race condition), and if it's from the tightly-controlled application of a scanner, can you recreate it manually? It's not enough to ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required