Reproducing the Bug – How Your Submission Is Vetted

Without the internal security team being able to validate your findings by recreating your PoC, it's hard to get a reward. You could've spoofed or mocked up findings, or created them during some since-patched edge condition that doesn't represent a significant threat.

The easiest way to ensure that your bug is reproducible is to, from the very beginning, practice reproducing it yourself. If it's a manual finding or semi-automated tool such as Burp Intruder, can you reliably recreate it (it might take a couple of tries to get the right sample size if there's a race condition), and if it's from the tightly-controlled application of a scanner, can you recreate it manually? It's not enough to ...

Get Hands-On Bug Hunting for Penetration Testers now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.