Going full-time bug bounty, privilege escalation bugs and more with Douglas Day
Aug 15, 2024
auto_awesome
Douglas Day, a former professional turned full-time bug bounty hunter, shares his journey and innovative bug hunting methodology. He discusses the financial and personal sacrifices involved in making this transition. Listeners will be intrigued by his informal note-taking strategies and the organized approach to privilege escalation testing. Douglas also emphasizes the power of collaboration in hacking, revealing how teamwork can enhance vulnerability discovery. With insights on automation and UUID vulnerabilities, his tips are invaluable for anyone in the cybersecurity space.
Douglas Day transitioned to full-time bug bounty hunting after financially preparing for years, demonstrating the importance of planning before making significant career changes.
His focus on specific vulnerability types like privilege escalation highlights the need for targeted strategies in effectively identifying and resolving security risks.
Collaboration with other hackers enriches the bug bounty experience, emphasizing the value of teamwork and shared knowledge in uncovering vulnerabilities.
Deep dives
Douglas Day's Journey into Bug Bounties
Douglas Day began his bug bounty journey in October 2018 while working at New Relic, a company with a HackerOne program. Initially, he was tasked with triaging reports from external hackers and quickly became intrigued by the real-world vulnerabilities he encountered. After earning his first bounty in December 2018 for a simple rate limit bypass, he realized the potential for substantial income through bug bounties. By 2019, he matched his engineering salary purely through bounty hunting, ultimately leading him to quit his day job in July 2024 to pursue bug bounties full-time.
The Transition to Full-Time Bug Bounty Hunting
Douglas waited until he had a solid financial foundation before making the leap to full-time bug bounty hunting, which took him a couple of years to develop. He specifically prepared by saving four months' worth of living expenses in a safety net to ensure financial stability during slow months. Additionally, he worked on consulting projects to create a steady stream of income while transitioning to a full-time bounty hunter. This careful planning was crucial, as he had to balance the risks involved in leaving a well-paying job to pursue an inconsistent income source.
Hacking Style and Favorite Vulnerability Classes
Douglas enjoys focusing on specific vulnerability classes, particularly privilege escalations and IDORs, accounting for a significant portion of his findings. He finds that privilege escalations are challenging to defend against and require careful per-endpoint fixes rather than holistic solutions. Recently, he has explored areas like payment bypasses, where he seeks to exploit loyalty and reward systems within applications to obtain free products. His approach involves a treasure-hunting mentality, where he targets specific impactful outcomes, such as leaking sensitive user data.
Collaboration and Community in Bug Bounty Hunting
Collaboration plays a significant role in Douglas's hacking endeavors, as it enhances the experience and allows for the sharing of ideas and findings. He prefers partnering with hackers whose skillsets complement his own rather than simply forming teams based on maximizing financial returns. Douglas emphasizes that the fun of hacking often comes from working with friends and making discoveries together during live events. His collaborative approach fosters a sense of camaraderie and allows for greater collective success in uncovering vulnerabilities.
The Concept of Embedded Hackers
Douglas introduces the concept of embedded hackers, suggesting that programs could select trusted hackers to bypass the triage process, streamlining vulnerability reporting. Many times, hackers possess deeper insights into an application than the triage team, leading to unnecessary delays when they have to explain functionality or replicate issues. By allowing certain hackers direct access to report findings, programs could expedite vulnerability resolution and reduce the workload on triagers while ensuring that credible reports are swiftly acted upon. This approach could ultimately enhance the overall efficiency of bug bounty programs and promote faster fixes for critical issues.
📧 Subscribe to BBRE Premium: https://bbre.dev/premium ✉️ Sign up for the mailing list: https://bbre.dev/nl 📣 Follow me on Twitter: https://bbre.dev/tw 📣 Follow Douglas on Twitter: https://twitter.com/ArchAngelDDay In this interview, we're talking with Douglas Day about his bug hunting methodlogy, about quitting his job to become a full-time bug bounty hunter and many more. BBRD podcast is also available on most popular podcast platforms: https://open.spotify.com/show/6tLoJ5foOoZPPELwrHPBO4 https://podcasts.google.com/feed/aHR0cHM6Ly93d3cuc3ByZWFrZXIuY29tL3Nob3cvNTA3Mzc4MS9lcGlzb2Rlcy9mZWVk https://podcasts.apple.com/us/podcast/bug-bounty-reports-discussed/id1583400215?uo=4
Timestamps: 00:00 Intro 0:29 Going full-time bug bounty 9:12 Douglas' bug bounty methodology 28:13 Bug Bounty tools you need 43:04 The benefits of collaboration in bug bounty 54:23 How to deal with having a similar bug on many endpoints? 1:11:37 How to select a bug bounty program?
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode