Collaborating with ethical hackers whose skills complement his own has apparently been pivotal to the success of ‘Nagli’, one of the biggest earners in the world of 

In just a few years of bug hunting, the 26-year-old hacker has achieved more than simply racking up points and bounties from a steady stream of impressive vulnerabilities.

 – has also harnessed automation creatively to scale up vulnerability discovery, and leveraged his Bug Bounty experience in bootstrapping 

, currently also works at Wiz, the cloud security platform.

In the following interview, Nagli additionally recounts how he became a hacker, details his most memorable bug discovery, and offers several golden tips to peers with designs on emulating his success.

I was always into computers and video games – Counter-Strike, Combat Arms, MapleStory and so on… So I was always technical with computers and the field of hacking was always interesting when you play video games and see people gain advantage in an unwanted way, and do those kinds of other things.

So it was always an interesting world. When you’re a hacker you have some superpower… you can do stuff that other people can’t, and you can actually make an impact and conduct some amazing things. So that’s what I’m doing with hacking and that’s what got me to actually explore it a few years ago.

On the secrets of his bug-hunting success…

I think what helped me to become successful is a lot of collaboration, networking with other people. I got the insight that I can’t be the best hacker on every section – like hacking Salesforce products or hacking other components – so just find a lot of people who are experts in what they do and give a lot of dedication. Then, whenever you stumble on a lead, you can just pass it to them and you can explore it with them together.

But basically: just a lot of dedication, not giving up and just constantly looking, investing a lot of hours into finding bugs.

So I had a lot of interesting and pretty critical bugs. It can be code executions… but the one I most like was a few weeks ago, on my birthday actually: there was one portal that suddenly became alive and there was tons of production data of a company – like years of development, internal communications… it’s very hard to configure all your SaaS products to make sure they are always configured to have authentication, to have a login panel.

So, every time you have a bug, it allows you to see the PII of customers, of a lot of customers, so every customer of a company; or just to see a lot of internal discussions from the past. It’s a goldmine for attackers so it’s a good thing on your side to report it to the company.

On the importance of staying abreast of fast-evolving tech and techniques…

So we need to evolve and learn for every new technology, like 

, which was introduced a few years ago, APIs, nowadays AI hacking as well. So if you don’t stay on top of the latest trends, latest methodologies, you won’t make it to the top and you won’t be able to do it successfully for a lot of time. So, every time there’s a new technique or new methodology in the manual hacking space or automation, I just like to adapt it as soon as I can into my systems.

On the most productive scopes right now…

A lot of the automation bugs I saw that were very active like one year or two years ago are getting fixed. Like a lot of subdomains takeovers, like on Heroku or Route 53.

Eventually the vendors rolled them out, so you can’t only rely on vendors that have a misconfiguration and use it for your favour so… I think hacking is very valuable if you have credentials, so inside to an inner system, because then it’s constantly evolving, it’s different developers from different companies who don’t know all the security nuances, and then you can find goldmines there.

So definitely focus on manual sides, on companies, getting credentials, getting access, and then, yeah, going deep into the targets.

On founding and running his own SaaS company…

So one year and a half ago, I took my hacking side of automation, which is what I do mostly – automation and participating in live hacking events – into an actual business, a SaaS product. I saw my own vision into a product to help companies as well. It’s called Shockwave, my company.

There’s a lot of other stuff you need to learn, from being a technical hacker to being a businessman. You need to do a lot of sales calls, legal, contracts… it’s pretty challenging but it’s also fun to do and explore.

I’m very much a soccer/football fan. Arsenal is the team I’ve liked for many years. So this season we have a very good season. Watching Netflix shows, playing FIFA [football video game] with friends… so basically around soccer/football/friends is a lot of stuff that I like to do outside of hacking. Also hitting the gym and just maintaining a healthy lifestyle.

His advice for inexperienced Bug Bounty hunters…

My top tip will definitely be: follow everyone on Twitter, ask them questions – like if someone is making a Twitter thread and you don’t understand something, ask him a question.

It’s good to be curious for insights and look for products that you have extra authentication or extra privileges for – like if your bank has a Bug Bounty Program, so you have a privileged account that is not that easy to create, you have an advantage over the other hackers and you could use it to your favour.

Learn more about hunting through YesWeHack

, or learn about the latest hacking tools and techniques 

‘Collaboration helped me become successful’: Nagli on becoming a world-renowned Bug Bounty hunter

 extension that automates the assessment and exploitation of signed web tokens. Supporting various token types, including Django, Flask, and Express, it enables you to edit, sign, verify and attack these tokens. 

The extension features automatic detection and in-line editing of tokens within HTTP requests/responses and WebSocket messages. It includes prebuilt wordlists for default secret keys and salts, plus support for JSON-encoded strings and custom dictionaries. Users can save known keys for future attacks and modify signed tokens in Proxy and Repeater message editors.

Inline editing of tokens within HTTP requests/responses and WebSocket messages.

Includes default secret keys and salts, plus support for custom dictionaries and JSON-encoded strings.

Automates brute force attacks using known keys and different derivation techniques.

Supports multiple bypass attacks, including user claims, and Flask and Express claims.

 Detects and analyses unknown signed tokens using various hashing functions.

SignSaboteur can be installed from the BApp Store. A tab within the Repeater provides easy access to various functionalities, such as "Brute force", "Attack" and "Sign". The plugin settings, such as default implemented wordlists, can be found higher up in Burp Suite itself.

Case Study: Finding Secret Keys for Unknown Signed Web Tokens

Consider a scenario where you are testing an application that uses custom-signed web tokens for authentication. You need to determine the secret key used to sign these tokens to evaluate potential security flaws.

When dealing with unknown signed web tokens, SignSaboteur provides a robust method to identify and exploit potential vulnerabilities.

When you select "Unknown" in the "Enabled signers" menu, the extension looks for patterns that match the size of common hashing functions. Some message payloads might be incorrectly identified by SignSaboteur, and therefore require further manual inspection.

The extension supports various message and key derivation techniques used in brute-force attacks, eliminating the need for manual changes. To find the secret key of an unknown signed token:

Uses a combination of known key derivation techniques for a more efficient search.

 Includes slow hashing functions like Password-Based Key Derivation Function 2 (PBKDF2). Use this mode with caution, and only with small wordlists, as it can be time-consuming.

Account User Claims, Authenticated Claims, User Access Token Attacks

Some frameworks use account wrappers to store authenticated user information, which may require the use of authenticated claims for exploitation. SignSaboteur supports this by implementing 12 well-known authorisation flags.

The ‘User Access Token’ option generates a JWT OpenID Connect ID token signed with the same key and hashing algorithm without key derivation, simplifying the process of forging valid tokens.

These techniques provide multiple vectors for bypassing authentication and gaining unauthorised access to sensitive resources.

Username and Password Claims, Flask Claims, Express Claims Attacks

Applications often store user details using "username" and "password" JSON attributes. SignSaboteur can generate a placeholder token for an admin user using these attributes.

In Flask applications, client-side stored session information typically includes attributes like "

". The extension can create a session token for the first user, usually the admin.

Similarly, in Express applications the "passport" JSON attribute is used to store user details, and SignSaboteur can generate a placeholder for the admin user, facilitating privilege escalation.

SignSaboteur not only saves time by automatically detecting and editing tokens within HTTP requests and WebSocket messages, but also helps identify vulnerabilities that manual inspections might miss. Moreover, by using the extension’s pre-built wordlists to check for common weak secret keys and configurations, you can ensure a thorough security assessment while minimising the risk of server overload.

https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease

 https://portswigger.net/bappstore/e62afa49e12543edbfa9df498363153c

PimpMyBurp #11 – Master Signed Token Exploits with SignSaboteur

A 36-month countdown to compliance with the EU 

Vendors of products with digital elements (PDEs) now have three years to fulfil all the law’s security requirements – which are focused heavily on eliminating vulnerabilities – if they want to sell their devices or software in the world’s largest trading bloc.

Cyber Resilience Act timeline, scope and penalties

 in the Official Journal of the EU on Wednesday (20 November). This means the act enters into force from 10 December. However, to give regulated organisations more time to prepare, most of the act’s provisions will apply from 11 December 2027.

Depending on the gravity of the offence, violations could result in fines of up to €15 million, €10 million or €5 million, or, respectively, up to 2.5 %, 2% or 1.5% of an entity’s worldwide annual turnover (whichever is higher). Offending products could also be banned from sale within the single market.

PDEs are defined as any software or hardware that connects to networks or other devices. That definition covers the vast majority of modern devices, from smartphones, laptops and tablets to smart TVs, cameras and toys. There are certain exemptions for open-source software, and products covered by existing rules, such as medical, aviation and automobile products.

EU CRA focused on tackling ‘widespread vulnerabilities’

 in 2022 to address “a low level of cybersecurity” in digital products, the European Commission set out to tackle certain deficiencies above all. As well as observing a lack of security information provided to users, it noted “widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them.”

As a result, the European Cyber Resilience Act has a big focus on identifying, disclosing and fixing vulnerabilities.

For instance, products must arrive on the market in a secure-by-default configuration (with certain exceptions) and free from “known exploitable vulnerabilities”. Identifying the presence of known vulnerabilities is facilitated by the mandatory creation of a 

 (SBOM), which must cover a product’s top-level dependencies as a minimum.

Vulnerabilities should be addressed and remediated “without delay”, the CRA instructs.

Bug Bounty backed by the Cyber Resilience Act

The CRA requires that coordinated vulnerability disclosure policies (CVD policies or VDPs) are implemented to facilitate the external reporting of vulnerabilities, both directly to the vendor “and where requested anonymously, via CSIRTs”. There should also be a single point of contact to which vulnerability information can be relayed and where the CVD policy can be found.

Bug Bounty Programs are explicitly referenced as a vehicle for fulfilling CVD obligations. “Given the fact that information about exploitable vulnerabilities in widely used products with digital elements can be sold at high prices on the black market, manufacturers of such products should be able to use programmes, as part of their coordinated vulnerability disclosure policies, to incentivise the reporting of vulnerabilities by ensuring that individuals or entities receive recognition and compensation for their efforts,” reads the act. “This refers to so-called ‘bug bounty programmes’.”

The Cyber Resilience Act 2024 also urges member states to protect vulnerability researchers from legal harms by adopting “guidelines as regards the non-prosecution of information security researchers and an exemption from civil liability for their activities”.

Specific Cyber Resilience Act requirements are detailed for “high-risk AI systems”, including accounting for “AI specific vulnerabilities such as data poisoning or adversarial attacks, as well as, as relevant, risks to fundamental rights”.

Security updates should be distributed promptly, securely and free of charge, and be accompanied by security advisories, according to the CRA. Where applicable, they should be automatic or separate from functionality updates.

Once patches have been issued, manufacturers are obliged to publicly disclose remediated vulnerabilities, providing a description and information about impact, severity and remediation/mitigation. However, disclosure can be delayed to give users more time to apply patches where “manufacturers consider the security risks of publication to outweigh the security benefits”.

Manufacturers are also expected to notify Computer Security Incident Response Teams (CSIRTs) and ENISA, the EU cyber agency, about “severe incidents” and the active exploitation of vulnerabilities. These requirements apply in 21 months, from 11 September 2026.

Recognising the complexity of the threat landscape, lawmakers have designed the CRA to increase cyber-resilience both throughout the supply chain and lifecycle of digital products.

Vendors must handle vulnerabilities for a minimum support period of five years, unless the product’s lifetime expires sooner. Longer support periods are prescribed for typically long-life components like microprocessors, network devices and operating systems.

When support periods end, “manufacturers should consider releasing the source code of such products” to the public domain or “other undertakings which commit to extending the provision of vulnerability handling services”.

Other CRA requirements cover areas such as authentication, encryption, minimising attack surfaces, reducing the impact of cyber-attacks, and the collection of personal data.

Irrespective of their place of manufacture, PDEs must be compliant if they are sold in the EU single market, encompassing 27 member states plus Norway, Iceland and Liechtenstein. Alongside safety, health and environmental protection standards, CRA compliance is now a condition of bearing a CE mark.

The CRA forms a key plank of the EU’s recent drive to upgrade its cybersecurity framework. Other notable pillars are 

 (introduced a common certification framework for ICT products), 

NIS 2 (Network and Information Security) Directive

 (wide-ranging requirements for member states and ‘essential’ or ‘important’ services) and the 

 (ICT security rules for financial services firms).

These regulations all prioritise – in common with cyber laws emerging elsewhere in the world – a risk-based approach to understanding and minimising your attack surface, and proactively finding, fixing and remediating vulnerabilities.

YesWeHack crowdsourced security testing and VDP solutions can help you fulfil your compliance obligations in a scalable and cost-effective fashion. In particular:

 that provides agile security testing adapted to your development model, results-based pricing, in-house triage, seamless integration with your security tools and more secure development practices

 of our Bug Bounty and vulnerability management platform.

Cyber Resilience Act: compliance countdown set to start for EU law focused on eliminating vulnerabilities

Attack surface discovery: mapping your exposed vectors with continuous threat exposure management (CTEM)

Mapping an organization’s attack surface is the fundamental first step towards hardening exposed attack vectors.

From web applications to APIs and cloud infrastructure, 

 involves systematically identifying all your internet-facing assets.

Gaps in your inventory of online assets – the ‘known unknowns’ and//or ‘unknown unknowns’ – can exist due to misconfigurations, shadow IT, complex architectures, rapid digital transformation, siloed acquisition of tech, and inadequate asset management processes.

Automated vulnerability scans, pentesting engagements and, in particular, 

 offer effective risk mitigation for tackling your known risks. By definition, they cannot include unknown assets.

But conducting attack surface discovery in an automated and exhaustive fashion, you can then identify, prioritise and fix vulnerabilities across all possible attack vectors, including previously hidden assets.

Yet if the mantra “you cannot secure what you cannot see” is widely understood, far too many CISOs nevertheless have only a patchy overview of their attack surface. More than two thirds of organisations have admitted to having been compromised via an unknown or poorly managed internet-facing asset (IBM report, 2021).

Without the right attack vector analysis tools, InfoSec teams can struggle to identify – let alone secure – their proliferating online assets.

According to TechTarget, 62% of organizations’ attack surfaces have increased over the past two years as organisations launch new apps and websites, store more data in the cloud, add new third-party integrations, use IoT devices and so on. Frequent software updates also heighten the risk of assets going online, or inadvertently remaining online, without security teams realising.

The merits of CTEM in attack surface discovery

So what’s the best way to perform attack surface mapping?

There are many methods and attack surface discovery tools for ascertaining your potential attack vectors: manual network architecture reviews, user access reviews, network scanners, asset management tools, Cloud Security Posture Management (CSPM) tools, attack surface domain discovery tools and Security Information and Event Management (SIEM) systems to name a few.

When it comes to achieving a unified, comprehensive and real-time overview of your internet-facing assets, an increasingly essential model is Continuous Threat Exposure Management (CTEM).

CTEM is a five-step automated process for continuously monitoring an organisation’s environment for new attack vectors, discovering the attack surface’s exposure to vulnerabilities, and remediating the most critical weaknesses first. Implemented well, this can provide a unified, comprehensive and risk-based approach to security testing.

Given your constantly evolving attack surface and the persistent probing of malicious hackers, this continuous and real-time overview of your cyber risks is preferable to periodic ‘point in time’ snapshots.

With digital transformation, accelerating release schedules and tight security budgets demanding an always-on, cost-effective and scalable approach, tech research firm Gartner cited CTEM as a top strategic technology trend for 2024. It forecasts that, by 2026, organisations implementing a CTEM program now could benefit from a two-thirds reduction in breaches.

 enables five operational phases in accordance with the CTEM model. Mapping your attack surface encompasses the first two steps: SCOPE and DISCOVER.

With YesWeHacks’ ASM, you kickstart the CTEM process by ‘scoping’ your assets: declaring your domain names and IP ranges/addresses and letting our solution inventory subdomains, accessible services and associated technologies.

Then our backend scanners can ‘discover’ related subdomains, other domains hidden from the organisation (due to shadow IT for instance), reachable services and associated technologies. Subsequently, they will continuously detect, and notify you of, any newly-surfaced online assets. A value is assigned to each discovered and classified asset according to its business criticality.

The subsequent CTEM phases, which we will cover in future articles, include PRIORITISING the most pressing suspected vulnerabilities discovered across your exposed vectors, through auto-generated priority scores; VALIDATING or rejecting a finding as exploitable in your environment; and MOBILISING by accessing, editing, sharing, assigning and tracking vulnerability reports from all sources to efficiently fix the most urgent security flaws first. In a follow-up article, we will also explore the potential synergy between Bug Bounty Programs and CTEM – with benefits including optimised testing coverage and cost-effective hardening of your exposed vectors.

How the YesWeHack ASM strengthens your security posture

YesWeHack’s ASM product can provide the missing link in your offensive security strategy by providing:

– mapping internet-facing assets and exposed dependencies

Continuous visibility of your organisation’s 

Automated prioritisation of vulnerabilities 

based on an easy-to-understand algorithm – accounting for severity (using CVSS), in-the-wild exploitability (using EPSS) and the related asset’s criticality value (assigned by the client organisation)

Strategised security testing and remediation to 

tackle the most critical vulnerabilities at scale

The turnkey-deployable ASM integrates seamlessly with the existing YesWeHack platform. Vulnerabilities from various security testing channels, including automated scanning by the ASM, Bug Bounty programs, traditional pentesting and Vulnerability Disclosure Policies (VDPs), are therefore consolidated into the same interface. This provides a one-stop-shop for all vulnerabilities – whatever their source and format.

 with YesWeHack today and discover how a risk-based approach can transform your organisation's security strategy.

Our latest ethical hacker roundup leads with a 

new open source tool for understanding how browsers parse HTML

 and uncovering mutated XSS vulnerabilities. 🛠️ The handiwork of our resident security researcher, 

, Dom-Explorer incorporates popular HTML sanitizers Ammonia, Angular, DomPurify, JsXss and SafeValues, while supported parsers include DomParser, Parse5, srcdocParser and TemplateParser. “By using this tool, you can generate this weird behaviour where if your input is not valid, it will change to something that might indicate the potential for vulnerabilities,” says Bitk. The researcher believes Dom-Explorer can simplify, accelerate and send in fresh directions this niche area of security research. 🔥

A client-side exploit chain across various Google services has impressed the InfoSec world. Leveraging Google Slides’ YouTube embed feature to access a victim’s Google Drive file, path traversal, open redirects across YouTube subdomains and oddities in Google Docs’ sharing UI, the discovery has 

netted security researcher Lyra/’Rebane’ an oddly specific bounty of $4,133.70.

 as an exemplar of how exploits can become “easier the longer you spend targeting a single company”, and evidence of an unusual combination of hacking skills. “Most white-hats specialize a bit, website logic shenanigans like iframes or the hardcore code analysis stuff like the link I posted for example. But not this [person, she] seems to have mastered both,” 

In other hacking tool news, ‘Cfreal’, highly respected for his PHP work, has made another significant contribution to this field with the 

, which helps ethical hackers exploit blind file read primitives in PHP. The researcher says the utility transcends most limitations undermining similar tools. 🚀

Speaking of PHP, the star of our YouTube channel’s latest hunter Q&A, Blaklis, also favours PHP targets. As well as discussing his preferred scopes, the prolific hunter, who sits 21st on our all-time leaderboard, reflects on how hacking video games introduced him to bug hunting, outlines his typical working day, and tells us which non-computing-related career he thinks most closely resembles Bug Bounty (watch the video below). 🐞 Similarly, we’ve also published a new 

, complete with related video, starring HakuPiku, in which he declares a fondness for hacking Android apps and open-source code. 📱

HakuPiku’s penchant for open source means he features on our new 

, which tracks the most successful hunters in terms of valid vulnerabilities reported to our open source programs. Top spots are currently held by calehuri, mdisec and foobar0x7 (visualised on the image below). 🏆 Hunters are further incentivised by the fact that any valid bugs reported to our open source Bug Bounty Programs will score hunters some exclusive merch, as well as the usual financial rewards. 🎁 Applicable scopes for this swag include 

’s seven public programs, which offer max €10,000 rewards: Log4j, Systemd, GNOME, ntpd-rs, OpenPGP.js, Sequoia PGP and CycloneDX Rust Cargo. The swag is also available via three programs managed by Open-Xchange: 

. Incidentally, the bounty grid for PowerDNS, an open-source DNS server, was recently increased to a €8,000 maximum. 💰 🎯

As for the general leaderboard, Rabhi, Xel and pocsir currently head both the overall 

Using AFL++, afl-cov and basic custom harnesses to find a libsoup bug

Back to the research writeups: we're spotlighting research from a hunter who also stars on the aforementioned open source leaderboard. In a new blog post, 'Sigabrt' 

 in which he used AFL++, afl-cov and basic custom harnesses to find a heap overflow bug in libsoup on a YesWeHack public program, namely that of 

'Ading2210', meanwhile, has recounted how he 

 for reporting Chromium vulnerabilities that allowed for a sandbox escape from malicious browser extensions with just “a tiny bit of user interaction”.  The potential consequences were grave: “Instead of merely stealing your passwords and compromising your browser, an attacker could take control of your entire operating system,” he wrote. Eek. One redditor called it “

 I've read since The Cuckoo's Egg”. 💰

Multiple vulnerabilities in a Realtek SD card reader, meanwhile, apparently “enabled non-privileged users to leak the contents of kernel pool and kernel stack, write to arbitrary kernel memory, and, the most interesting, read and write physical memory from user mode via the DMA capability of the device”. 💻  An 

 details Realtek’s fixes for what were seemingly highly serious flaws. “If your laptop is equipped with an SD card reader, it is highly likely to be manufactured by Realtek, making it susceptible to these vulnerabilities as well,” 

Our latest white-box penetration testing guide explores 

how to debug for JavaScript vulnerabilities

. In testing a web application vulnerable to prototype pollution within a Docker container, Brumens’, another of our resident hackers, demonstrates how to debug JavaScript inside Visual Studio Code in order to track payloads throughout the code process and learn how security filters can hide vulnerabilities. Relatedly, we’ve also detailed our 

top 5 hacking tools for white-box pen testing

Exploiting trust: Weaponizing permissive CORS configurations

’, Outpost24’s Thomas Stacey reveals the results of a project initiated to answer the question: “Are we underestimating CORS vulnerabilities?”. 🤔 Possibly, it seems, given the application security auditor uncovered multiple CORS (Cross-Origin Resource Sharing) flaws affecting customers, including critical issues including user sessions. He observes that both the detection and exploitation of permissive CORS can be tricky, the latter “due to modern security controls like the “SameSite” cookie attribute, or even modern application architectures like single-page applications”. Mindful of these challenges, he sets out some tooling and methodology advice for finding vulnerabilities in CORS implementations.

Other recent writeups and InfoSec news of interest include “

 of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software”; Sonar showing how to turn a file write vulnerability in a Node.js application into RCE 

when the target’s file system is mounted as read-only

data breach involving France’s second largest internet service provider (ISP) and telephone operator

, affecting more than 19 million customers and 5.11 million IBAN numbers. 😮

Next up, Dojo news. Trick or treating might be over for another year, but our platform’s new dark mode 🖤 – 

 to coincide with the celebration – is here to stay, while our Halloween-themed monthly CTF challenge – ‘

’ – has concluded (congrats to the winners: Atlas_py, qu35t3190 and Fravoi). 👻 The current active challenge is ‘

’, open for submissions until 12 December. Elsewhere on Dojo, another new training module has dropped: 

. And finally, check out our new feature, Talkie Pwnii, a series of videos from one of our researcher enablement analysts, pwnwithlove aka pwnii! In the first video, below, pwnii shows you two alternative solutions to our latest Dojo challenge, '

', and a few technical tips and tricks. 🚀

Over the weekend, we ran a successful live Bug Bounty in Buenos Aires, Argentina.

 across two days, the live hacking event involved targets from Galicia Bank. This was the final top 3:

💉 First Blood: Damián Gambacorta aka g4mb4

💥 Best Impact: 🎩 Alan L. aka soyelmago

A huge thank you to Galicia Bank for their trust and involvement. We also want to extend our gratitude to Ekoparty and Bug Bounty Argentina for their support in making this event a resounding success. 🙏

Highlights from the Ferrero live Bug Bounty

And here is the final podium for another live Bug Bounty that took place at the end of September, with legendary sweet-packaged food brand Ferrero providing the targets:

Watch highlights from this competition, which was Italy’s 

Read this monthly roundup of content aimed at ethical hackers even sooner by subscribing to 

Are you a CISO, other security professional or security-conscious dev? Check out our CISO-focused sister newsletter, 

 – bringing you news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

New tool for finding mutated XSS, $20k Chromium sandbox escape, Live bug bounty results from Ekoparty – ethical hacker news roundup

There’s always vulnerabilities,” said Erik Täfvander, head of cybersecurity at ATG: those you know about, those you don’t know about, and those yet to be created.

When it comes to finding them, he told YesWeHack in the interview below, Swedish betting brand 

 to be more productive than pentesting in multiple ways.

In the video and writeup below, Erik also explains how ATG has optimised its approach to crowdsourced security testing, praises YesWeHack’s customer support and triage team, and assures his peers that they “have very little to lose” by road-testing their own program.

Erik Täfvander on ATG's mission and why security is paramount…

ATG is short for Swedish words – AB Trav och Galopp – and we’re a unique betting company. We’re based in Sweden, and we’re owned by the horseracing industry. We try to offer our customers the world’s best betting experience. And it provides about 30,000 daily jobs in Sweden.

Security is important for us. We need to keep our customers’ trust, and one thing is to make sure that if you bet at ATG, your money is safe and your bet is fair.

On what prompted ATG to launch a Bug Bounty Program…

It was good timing actually. We had been looking into it for a bit. It didn’t really tip over at first, but we did struggle with traditional pentesting. We needed something to keep up [with our needs] – to not only [test assets at] a point in time but continuously get reports.

And what kind of tipped the scale was also the business model: that we reward hunters for providing us with valuable information, and we only reward them when we get the information.

On the program’s evolution since launch…

If I’m not mistaken, we launched in 2021. And we started with a private program with a small, limited scope to see if this was something for us. And frankly, in the beginning, I was a little bit bored, because we had for a couple of weeks not a single report. It was that quiet. And then, something happened – we got an instant 20 reports.

After that, we tried to evolve the program to include new scopes, new assets, improve on our reward levels to keep it attractive. And since, I think it’s two years now, we have been running a public program, which has a wildcard scope – so you’re allowed to basically try anything out that is [one of our digital assets].

On the biggest challenge they’ve overcome so far…

Oh… good question. The first challenge we met was: who will help us to patch these bugs? That wasn’t that clear in the beginning, so we kind of developed our own documentation and developed techniques to find out who’s responsible for what line of code, and it’s been running much smoother after that.

On the value of YesWeHack’s customer support and triage service…

I appreciate that you make me feel like a partner more than a client. I really, really, really want to send some kudos to the triage team. They are on the ball 24/7 almost, really rapidly giving us their insights on reports that we receive, and helping us during the process.

I think it gives you great insights into what’s going on, because you use basically the same techniques for malicious hacking, and we learn a lot from that. Also that we pay a reward to someone who is trying to help us.

And you get fast return on investment. If we get serious vulnerabilities reported to us, it’s worth it all day long to reward the hunter for those vulnerabilities.

On the merits of Bug Bounty versus pentesting…

I would say the political answer is it’s 

 pentesting. But with that said, we have had, I would say, 20 really serious reports that we would never get from a traditional pentest. The collective knowledge that we get from a Bug Bounty Program is huge, compared to a pentest where you hire a couple of researchers or consultants to help you.

On keeping hunters engaged after three years and counting…

We’ve done a lot to keep it attractive but that’s a challenge that we need to work on. It was easier in the beginning – when you started to ramp up scopes, you started to ramp up rewards.

The YesWeHack Blog

‘Collaboration helped me become successful’: Nagli on becoming a world-renowned Bug Bounty hunter

‘Collaboration helped me become successful’: Nagli on becoming a world-renowned Bug Bounty hunter

PimpMyBurp #11 – Master Signed Token Exploits with SignSaboteur

Cyber Resilience Act: compliance countdown set to start for EU law focused on eliminating vulnerabilities

‘Collaboration helped me become successful’: Nagli on becoming a world-renowned Bug Bounty hunter

Attack surface discovery: mapping your exposed vectors with continuous threat exposure management (CTEM)

New tool for finding mutated XSS, $20k Chromium sandbox escape, Live bug bounty results from Ekoparty – ethical hacker news roundup

‘The collective knowledge ATG gets is huge’: cyber chief on Betting brand’s Bug Bounty story

Attack surface discovery: mapping your exposed vectors with continuous threat exposure management (CTEM)

NIS 2 in force, Cyber Resilience Act adopted, CISA hails VDP impact – OffSec roundup for CISOs

Dojo challenge #36 - Shell Escape winners and writeup

‘Happy hunters equal happy customers and vice versa’: YesWeHack vulnerability triage chief Adrien Jeanneau on creating a virtuous Bug Bounty circle

NIS 2 in force, Cyber Resilience Act adopted, CISA hails VDP impact – OffSec roundup for CISOs

DON'T WAIT FOR THE THREATS TO STRIKE

Products

Researchers

Resources

Company

Follow us