Critical Thinking - Bug Bounty Podcast

Episode 35: King of Collaboration: Douglas Day

Sep 7, 2023

Renowned bug bounty hunter, Douglas Day, shares his unique methodologies and collaborative spirit. Topics discussed include finding new endpoints, exploiting Intercom widgets, collaboration preferences at live hacking events, justifying hobbies, and finding enjoyment in the bug hunting process.

01:25:24

Creator website

Episode guests

Douglas Day

AI Summary

AI Chapters

Episode notes

Podcast summary created with Snipd AI

Quick takeaways

Douglas Day focuses on quickly finding bugs in smaller programs and assesses user management and complex permission structures to maximize his time.

Douglas Day highlights the value of collaboration in bug bounty hunting, emphasizing idea sharing, bug discovery, and balancing individual bug hunting with teamwork.

Douglas Day shares specific techniques like booting intercom widgets with different emails and using match and replace rules to find new endpoints and critical bugs in various applications.

Deep dives

Approaching a Target: Small Programs and Quick Assessments

Douglas Day focuses on smaller programs and aims to find bugs quickly. He spends around 30 minutes on a new target, assessing the user management and looking for complex user permission structures. If no bugs are found within three hours, he moves on to other programs to maximize his time.

Introduction

3min

Collaboration and Communication in Bug Bounty

31min

User Management, Authentication Matrices, and Business Logic Errors

3min

Approach to Hacking New Targets

12min

Exploring the Vulnerability of Intercom Widget for Identity Verification

3min

The Value of Learning from Failures and Enjoying the Bug Bounty Journey

17min

Finding Bugs That Can't be Fixed

16min

Episode 35: In this episode of Critical Thinking - Bug Bounty Podcast, we're thrilled to welcome Douglas Day, a bug bounty hunter known for his unique methodologies and collaborative spirit. We talk about his approach to finding new endpoints in applications, his ingenious technique of exploiting Intercom widgets, and collaboration preferences and tips at LHEs. We also touch on the struggle of justifying hobbies that don't generate income and the importance of finding enjoyment in the process.We hope you enjoy this episode as much as we did!

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

Today’s Guest:

https://twitter.com/ArchAngelDDay

https://hackerone.com/the_arch_angel

https://bugcrowd.com/arch_angel

100 Short Bug Bounty Rules

https://twitter.com/ArchAngelDDay/status/1661924038875435008