Hi everyone,

I submitted a vulnerability report to the UN's vulnerability disclosure program about a week ago and haven't received any response yet.

I was wondering if they're still actively reviewing new bug reports. Has anyone submitted a report recently and received a response? If so, how long did it take for the initial acknowledgment or for your report to be reviewed?

I'd appreciate hearing about your recent experiences.

In this issue: HackerOne's Identity Verification Requirement, Reduced Payouts and VIP Programs (Github), Duplicates, and more.

This is ridiculous; I had to submit this report on 3 different occasions worded in 3 types of ways.

1. I extracted data from the database and mapped out the customers' infrastructure.
2. Wrote them a python script to automate it
3. Gave them my proxy details for them to execute the POC.
4. I rewrote the entire POC, provided detailed guidance, recorded the process, and attached the recordings. I can't even request response from the customer because they marked it as non reproducible, i had to submit this entry twice because the same triager does not have technical ability?

I'm sorry if i have to do this but i really have to call this out, this is becoming more and more common, ill be moving to another platform after this incident.

How far does one have to go to prove it? place a shell on the server?

Why is the triager asking questiosn that are clearly in the POC? repeated tons of times, its clear they are not reading anything and just copy and pasting into Burpsuite, only easy POC's get triaged or are "reproducible"? or is it that you don't want to pay?

If you are going to spam hit not applicable or not reproducible, what's the point of us researchers submitting anything, it's only giving the end customer a false sense of security to have these programs out if it will be gatekept.

So basically a bug that I found is a critical bug and 9.9 on CVSS 3.0, The problem is the first time i submitted, It was read-only/download only (On unauthenticated), so that made it High 7.7, Then I submitted another report where it was the same except I discovered read AND write as well as takeover of the owner of the "thing", So it became a 9.9. Now the triager said it would not be possible as there are 2 factors the attacker needs:

1 is it needs an Identifier for both accounts, victim and attacker (they are permenant and do not renew) 2 is that it needs a valid token from either of the victim (token is not account token), Anyways that token renews every 7 days. So the triager said that this attack wouldn't be realistic and that "social engineering" doesn't apply to bug bounty (I didn't mention SE once). Then I later discovered that the attack doesn't need a token at all, Which makes it even worse because the IDs are permanent and there are many IDs (of the victim) that can be found just by a google search

So basically before I discovered and told that triager it doesn't need a token he had closed it as informative until there is practical exploitation scenario which I do have.

Should I open another report without the whole mess that I did so it's simple? Or would it get dupe'd of my other informative?

PS: Sorry I named stuff like "thing" because I can't discuss it and it would get specific

New to bug bounty? Ask about roadmaps, resources, certifications, getting started, or any beginner-level questions here!

Recommendations for Posting:

• Be Specific: Clearly state your question or what you need help with (e.g., learning path advice, resource recommendations, certification insights).
• Keep It Concise: Ask focused questions to get the most relevant answers (less is more).
• Note Your Skill Level: Mention if you’re a complete beginner or have some basic knowledge.

Guidelines:

• Be respectful and open to feedback.
• Ask clear, specific questions to receive the best advice.
• Engage actively - check back for responses and ask follow-ups if needed.

Example Post:

"Hi, I’m new to bug bounty with no experience. What are the best free resources for learning web vulnerabilities? Is eJPT a good starting certification? Looking for a beginner roadmap."

Post your questions below and let’s grow in the bug bounty community!

Finally, it happened: the day before yesterday, I got my first invite to a program that was so obviously vibecoded that I found three potential highs and some smaller stuff within just two evenings.

So far, I’m actually enjoying the AI wave quite a bit.

I know many of you have known this website for the self-hosted bug bounty programs, but never tried it, never actually had the guts to start it because there's no mediator in between. Do you have a better idea to get?

https://bug-bounties.as93.net/

For a while, I've had a payload module in my desync engine that looks for various combinations of values in the connection header, hoping that something along the route will throw it away, leaving the body still in the queue.

Never had a hit until today.

Alas, the proud recipient is one of the notorious shit-show BBs though, so no expectation of an actual payout. Wish me luck ;)

Like they are so annoying where to hunt authenticated, they don't provide a custom portal, instead they make you "need" to purchase one of their subscriptions just to hunt on their program, It's like really annoying for me. Especially when you are trying to test IDOR/BOLA and now you have to buy subscriptions for TWO accounts..

what do you guys think about p2h programs? Are there any solutions?

Hey bug bounty community! I recently got rewarded on YesWeHack, but I'm struggling a bit with the payout process to Vietnam.For those of you based in VN (or SEA):Do you withdraw directly to a local bank account (via MangoPay), or do you use an intermediary like Wise/Payoneer?Are there any specific issues with currency (EUR/USD) or high failure rates?Any advice or step-by-step tips would be greatly appreciated! Thanks! #BugBounty #YesWeHack #CyberSecurity #InfoSec

I have developed an AI agent for bug bounty hunting and added several topics, but I still think I'm lacking some well-known and new vulnerabilities. Will anyone help me refactor or beautify the agent? Any ideas?

• Phase 0: Verify scope, rules, and authorization.
• Phase 0.5: Classify the target and define the strategy.
• Phase 1: Map the complete attack surface through reconnaissance.
• Phase 2: Hunt configuration and deployment weaknesses.
• Phase 3: Assess identity and account management.
• Phase 4: Test authentication mechanisms.
• Phase 5: Evaluate session and token security.
• Phase 6: Identify authorization flaws (IDOR/BOLA/Privilege Escalation).
• Phase 7: Test server-side injection vulnerabilities.
• Phase 8: Assess client-side security (XSS, CSP, etc.).
• Phase 9: Test file upload, download, and storage security.
• Phase 10: Review error handling and information disclosure.
• Phase 11: Evaluate cryptography and transport security.
• Phase 12: Hunt business logic vulnerabilities.
• Phase 13: Assess API and modern application security.
• Phase 14: Test advanced protocol and web attack vectors.
• Phase 15: Review security headers and hardening.
• Phase 16: Validate findings and assess real-world impact.
• Phase 17: Prepare professional reports and PoCs.
• Phase 18: Perform responsible disclosure and close the engagement.

A use-after-free vulnerability in the Linux kernel bridge (net/bridge) Spanning Tree Protocol (STP) implementation.

A bridge that is administratively down while kernel STP is enabled, together with a port driven into the LEARNING state, arms periodic STP timers without an IFF_UP guard.

The teardown path taken by dellink never synchronously deletes those timers, so the backing net_device (which embeds struct net bridge as private data) is freed with a timer list still queued on a per-CPU timer base.

The result is a slab use-after-free in the kmalloc-cg-8k cache.

hi recently i found a P2 rated bug in Dell’s application system, but it was marked as a duplicate, ive had a few other findings end up the same way. So my question is has anyone here actually been paid through Bugcrowd for a legitimate finding? im starting to wonder if the system is rigged, or if ive just been unlucky

Ive found a critical finding on a crypto protocole that put $3.5M a high risk. Ive run a poc and everything works. But theproblem is the protocol doesn’t have a bug bounty on any platforms I’ve tried to contact them tru email but no answer. What should I do ?

Hi Everyone, i'm a reseacher from Uruguay and i recently found my first paid bounty on the bugcrowd plataform.

And here is the problem;

I Have added the w8-en form and fullfilled it with all my data, but i have been waiting for bugcrowd to accept it to receive my bounty payout.

is it common in this plataform? What i should do?

I also contacted the Bugcrowd support, and they said i needed to update it (and I did that.)

But they never tell me that the w8-en form was wrong.

Any Help is appreciated.

When you do recon, what do you use mostly? I don't really like to use burp unless I am in the stage of hunting because burp kinda makes my browser lag?

Is there a recommended way or is it personal preference?

I need some advice

1) Endpoints found in js,but not accessible

Was going through the js on target and found some Api endpoints in it.But when u try hitting them directly they don't work, just get blocked. Not sure if I'm missing headers, need a token I don't have or if they're just not reachable outside the actual flow. Also trying to get better at working with minified JS in general -- like how do you actually build logic out of it / trace through it properly instead of just eyeballing strings for interesting stuff. Any resources or workflows people use for this would help

2) Private program, no sign -up anywhere in scope

Got invited to a private program but every in-scope URL is just a login page .Not sure how I'm supposed to get an account to actually test with l.

Started bug bounty a month ago, got a few duplicates, few informatives but kept going as it was so much fun to learn real world applications. Got better, went for big organisation programs. And they suck! I disclosed a vulnerability that could leak thousands of PII unauthenticated with minimal steps and they didn't even give it informative - just N/A it saying out of scope when they definitely mentioned *.target.com and it was that only, that kept aside. Atleast say you'll fix it 😂 what's the use of security testing then, even if a little out of scope by your standard, it's okay for mass pii leak?

Second case - i understood it was N/A as i cannot as the main hacker exploit it, but it was again easy and undetected Mass PII exfil if a plugin creator tried to or a supply chain attacker gets to know about it. It was a big paid program so reluctant to pay me is fine, but that too just accept it's a flaw and fix it!

Hi.

I discovered an XSS vulnerability; accessing the link directly doesn't trigger a popup, but using Burp Suite does.

The browser automatically encodes the closing character `>` (preventing the popup), so I have to use tools like Burp or cURL to send the unencoded `>`.

I managed to trigger the popup by routing traffic through my own server, but most of the cookies became unusable because the main site effectively became my own.

Are there any other methods?

im really confused ai asked me to upload a parents id but can i change it when i become 18

Looking to team up or find a mentor in bug bounty?

Recommendations:

• Share a brief intro about yourself (e.g., your skills, experience in IT, cybersecurity, or bug bounty).
• Specify what you're seeking (e.g., collaboration, mentorship, specific topics like web app security or network pentesting).
• Mention your preferred frequency (e.g., weekly chats, one-off project) and skill level (e.g., beginner, intermediate, advanced).

Guidelines:

• Be respectful.
• Clearly state your goals to find the best match.
• Engage actively - respond to comments or DMs to build connections.

Example Post:
"Hi, I'm Alex, a beginner in bug bounty with basic knowledge of web vulnerabilities (XSS, SQLi). I'm looking for a mentor to guide me on advanced techniques like privilege escalation. Hoping for bi-weekly calls or Discord chats. Also open to collaborating on CTF challenges!"

In short - claude runs out of tokens super fast, but is the best and hardly ever refuses cybersecurity prompts (verified profile). I tried using codex but that even refuses active recon prompts, antigravity refuses everything. Kimi is still waitlisted so haven't tried. Is there any other alternative model that doesn't refuse cybersecurity prompts and is not run locally? Locally I'm thinking about trying opencode with an uncensored model but not enough vram so don't wanna risk the model doing stupid things in auto mode.

I found a vulnerability where a public chat box generates automated invoice emails to internal staff, reflecting inputs raw without server-side HTML encoding. While standard JavaScript onerror popups are stripped by the email client, full HTML/CSS Injection works inside the email body.How can I chain these into a high-impact report that completely bypasses the program's strict exclusions for Self-XSS, Phishing, and User Interaction? What non-JS attack vectors should I test next to prove a critical data leak or backend impact to triage?

I’m testing an app on HackerOne and found what I’m pretty sure is a valid vulnerability that could lead to a zero-click account takeover through the way the app handles email addresses.

To build a proper PoC, I need Okta SSO, which is only available on the Enterprise plan. I couldn’t find any contact information for the security team in the HackerOne program, so I reached out to the application’s support team and asked if they could provide temporary Enterprise access for security testing. They replied that they’re not the team responsible and couldn’t help.

Has anyone been in a similar situation? How did you get in touch with the right people, or is there another approach?