Generous bounties, technically stimulating scopes and the feel-good factor of helping to secure critical infrastructure that underpins a free and open internet – sound appealing, bug hunters?

You can enjoy these benefits by hunting on the seven (so far) public Bug Bounty Programs operated by the Sovereign Tech Fund (STF), which invests in open digital infrastructure to ensure a resilient and sustainable open source ecosystem.

Your hacking skills, together with support from the STF, are particularly invaluable to these volunteer-run open source projects, given their vital role infrastructurally or for critical dependencies. Just consider the downstream impact of the 

 to see the importance of effective vulnerability management in this realm.

The location of Log4Shell, the Log4j Java logging framework, is now among the STF’s Bug Bounty Programs, alongside ntpd-rs, GNOME, systemd, OpenPGP.js, Sequoia PGP and CycloneDX Rust Cargo.

All seven programs are currently offering rewards up to 

 for critical vulnerabilities. High-severity flaws command bounties up to 

The generous bounties – among the highest on YesWeHack – reflect the unusual and challenging nature of many of the targets. Scroll down and check out these programs to see if the scopes align with your hacking expertise.

Tara Tarakiyee, a technologist at the STF, comments: 

“Our societies increasingly rely on open source software as critical infrastructure, and it takes a lot of effort to keep that infrastructure safe. Which is why STF is committed to fostering the community of security researchers looking to use their skills to secure the open source ecosystem in the public interest through programs like the 

Open-source Bug Bounty Programs from the Sovereign Tech Fund

These seven public Bug Bounty Programs are currently active. With the Sovereign Tech Fund having numerous active investments – also including Drupal, PHP, Fortran, GNU libmicrohttpd and Python Package Index – and on the lookout for more, the organisation may well be a source of new hunting opportunities in the not-too-distant future.

The site of arguably the most significant vulnerability of all time – Log4Shell – owing to its severity and the ubiquity of this Java logging framework. 

 comprises an API, its implementation, and components to facilitate deployment for various use cases.

Qualifying vulnerabilities (at the time of writing): 

log injections, log event loss, memory safety, remote code execution, deadlocks, DoS.

 for up-to-date scopes, qualifying/non-qualifying vulnerabilities and other rules.

 is an open-source implementation of the Network Time Protocol written in Rust, with support for the Network Time Security protocol and a focus on exposing minimal attack surface.

Qualifying vulnerabilities (at the time of writing):

 Remote code execution; remote denial of service (excluding protocol limitations); privilege escalation; misuse of cryptographic primitives; and arbitrary clock modifications, using only NTS sources, controlling at most a minority of the NTS sources.

 is a project to read, write and generate CycloneDX SBOMs. It comprises cyclonedx-bom, a Rust library for reading and writing CycloneDX SBOMs from/to Rust structs, and cargo-cyclonedx, a Rust application that leverages cyclonedx-bom to generate CycloneDX SBOMs for Cargo-based Rust projects.

 Remote code execution, remote denial of service, local and unprivileged denial of service, privilege escalation, memory safety issues, sandbox or security boundary bypass, arbitrary file read/write operations, code injection vulnerabilities, insecure deserialization, cryptographic implementation flaws, integrity check bypass, dependency resolution vulnerabilities, exposure of sensitive information in logs, compromise of signed SBOMs (e.g., signature verification failures), manipulation of SBOM content leading to incorrect or incomplete data, misconfiguration vulnerabilities, and insecure handling of command-line arguments and environment variables.

Fully featured desktop environment and application platform for Linux. Used with the likes of Ubuntu, Fedora, RHEL and Tails and in security-critical contexts by activists, journalists, corporations and governments, among other users. The 

 Bug Bounty Program began with two critical scopes, GLib and libsoup, but there is enormous scope for growth with the GNOME desktop consisting of hundreds of modules.

Memory safety issues, denial of service, undefined behavior leading to a security vulnerability, race conditions, missing validation of untrusted inputs, privilege escalation, cryptographic problems, exfiltration of confidential material, and supply chain issues.

A suite of basic building blocks for a Linux system. Among other features, 

 provides aggressive parallelisation capabilities, socket and D-Bus activation for starting services, on-demand starting of daemons, tracking of processes using Linux control groups, maintenance of mount and automount points, and implementation of transactional, dependency-based service control logic.

UEFI SecureBoot bypasses, remote code execution, remote denial of service, local and unprivileged denial of service, privilege escalation, sandboxing bypass, login prompt/password check bypass, disk encryption keys leaks, misuse of cryptographic primitives, leaking user logs to other unprivileged users, and signed dm-verity compromise.

 is a JavaScript library implementing the OpenPGP standard for message encryption and signing. OpenPGP is typically used for end-to-end encrypted email, signing of git commits and software releases, and encrypted file storage, among a variety of other applications.

 Where OpenPGP.js: incorrectly encrypts a message, causing (part of) it to be decryptable by an attacker; uses an insecure algorithm (by default) to encrypt a message, causing (part of) it to be decryptable by an attacker; incorrectly decrypts or signs the message, causing (part of) the private key to be extractable by an attacker; returns unauthenticated data (by default), potentially causing EFAIL-style vulnerabilities; incorrectly verifies an invalid signature; fails to parse a compliant OpenPGP public key, possibly causing the application or user to send the message in cleartext instead.

 provides secure communication and authentication in the OpenPGP arena. “We are committed to protecting the privacy and security of our users with a particular emphasis on the most vulnerable people in our society: activists, journalists, lawyers and their clients,” reads the program introduction.

Memory safety issues, denial of service, undefined behaviour leading to a security vulnerability, injection attacks into human-readable and machine-readable output, authentication bypasses, creation of cryptographic artifacts using high-level interfaces that break or undermine the properties of cryptographic algorithms, invalid reasoning about OpenPGP certificates, exfiltration of confidential material, diversion of packet streams with respect to another major OpenPGP implementation, improper use of cryptographic primitives, and improper handling of secret key material.

 invests in open digital infrastructure projects in order to strengthen open source security, resilience and technological diversity. Founded in 2022, the fund is financed – to the tune of €17 million for 2024 – by the German Federal Ministry for Economic Affairs and Climate Action.

 in 2023 to help time-poor open source maintainers prevent and patch vulnerabilities through technical debt reduction, secure code audits and Bug Bounty Programs managed by YesWeHack. 

, meanwhile, saw an initial three successful applicants – developers, contributors or maintainers – given €300,000 to spend on creating or improving developer tooling, production security mechanisms and project documentation for their Free and Open Source Software (FOSS) components over a four- or eight-month period. The Sovereign Tech Fund is also piloting a 

 under which overworked and hitherto unpaid maintainers of critical open source components will be paid for their work.

These are important initiatives when you consider how, according to 

, 96% of codebases contain open source, applications have 526 open source components on average, and 84% of codebases contain at least one open source vulnerability.

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

Covid-19 lockdowns gave people unprecedented amounts of spare time to reconsider their careers and try out new hobbies.

Among those to pursue their dreams was 19-year-old ethical hacker 

, who discovered the joys of breaking into applications for legitimate reasons while still at school.

In our latest bug hunter Q&A, the US-based Israeli – alias ‘RL’ – also reflects on how long it takes to learn Bug Bounty and why going straight into Bug Bounty might not be the wisest first step.

RL ON HOW COVID LOCKDOWN SPARKED HIS INTEREST IN HACKING…

I was 15, it was quarantine and we had no school. I honestly had nothing to do, so I kind of picked up hacking for some reason.

I played a little bit of Hack The Box and then a few months later I moved on to Bug Bounty. I found my first bug, which was a reflected XSS. After that was triaged, I picked it back up again and started hacking even more – and that’s pretty much it.

My browser! Burp Suite is the one that I use 24/7. [It also depends] on what program I’m hunting on and what I’m currently doing.

ON THE UNDERAPPRECIATED VALUE OF DOCUMENTATION…

Documentation is highly underrated in my opinion.

If you’re working on WAF bypasses, which I do a lot, [it gives you] a strong understanding of whatever you’re hacking. For me, it would be JavaScript usually or little browser quirks. [Documentation is] a goldmine of information in my opinion.

When I approach a target I don’t have much of a methodology, but I try to see what’s going on in the website, how it works, all of the different technologies, all of the weird stuff that happens in it – specific things like parser confusion, things that I really like looking for.

And when I find a lot of these weird little pieces of the puzzle, I kind of put it together and eventually create a really cool bug. And that is, I think, the most fun part about it.

Sometimes I also have the documentation by my side and just scroll through the documentation if I’m trying to find a WAF bypass or something.

So: a lot of documentation-reading, a lot of trial and error and a lot of putting pieces of the puzzle together.

ON HIS MOST IMPRESSIVE BUG FIND SO FAR…

My most interesting bug was not necessarily my most critical one, but was a cache poisoning vulnerability in Glassdoor. It was pretty interesting because it abused the URL parser confusion between the front-end server and the back-end server.

So I was actually able to use an uncacheable header XSS and trick the CDN into caching it by abusing a caching rule and the path traversal, and pretty much get a stored XSS through there.

ON THE THREE WORDS THAT BEST DESCRIBE HIM AS A HACKER…

I think I’m creative – I always like finding new ways to abuse vulnerabilities or find them; lazy – I don’t have much of a set methodology, but in some ways it actually helps me; and motivated.

HIS ADVICE FOR HUNTERS STARTING OUT IN THEIR ETHICAL HACKING CAREER…

The biggest mistake that I think I see people make – well, there are a few – but the biggest one is expecting results immediately and not staying consistent. It took me a year to find my first bug, maybe two years to get my first paid bug, so it takes time.

Meanwhile, what you want to do is, instead of getting frustrated with Bug Bounty, don’t start out with Bug Bounty. You can, but it’s hard.

What you do instead is play CTFs, do hacking labs, stuff like that, and, honestly, just have fun with it. You won’t be making money – you likely won’t be making money for quite a while – so just have fun, learn, challenge yourself, stay consistent.

Stay consistent – consistency is very important. Make sure you actually have fun and enjoy what you’re doing. If you don’t enjoy what you’re doing – and I think that goes with anything – you probably won’t be very good at it.

So you really want to enjoy it. The more you enjoy it, the more you’ll want to do it; the more you want to do it, the more consistent you will be. So the more you do it, the better you’ll get. I think that’s my biggest advice. Also, [do] CTFs!

Learn more about hunting through YesWeHack

, or learn about the latest hacking tools and techniques 

‘Hunters’ biggest mistake? Expecting immediate results’: ‘RL’ on building a Bug Bounty career

The archetypal hacker is a solo freelancer who sits alone at their laptop trying to induce software into misbehaving – but this does not tell the full story.

Because some seriously impressive vulnerabilities have emerged from cooperation between ethical hackers (not least at 

 that are as much about collaboration as competition).

YesWeHack spoke to a pair of hunters about the merits of pooling hacking expertise with trusted peers, as well as the importance of perseverance in a process that is intrinsically about trial and error.

’ – aka Esdras Dago and William Le Berre of French cybersecurity firm BZHunt – also reflect on their favourite vulnerability finds so far and offer some invaluable tips to aspiring and inexperienced hunters.

Their advice carries no little weight given their presence on the 

: Chackal currently in 12th position, Serizao in 21st (note: their positions were different when the interview was conducted).

SERIZAO AND CHACKAL ON HOW THEY GOT STARTED IN BUG BOUNTY…

 thanks to a co-founder of YesWeHack, who came to give courses at CentraleSupélec [an elite engineering school in France] about finding vulnerabilities in applications. All the reports were made on YesWeHack. After meeting him, I decided bug hunting was something I liked and tried to dig into.

I started Bug Bounty with a friend, and we spent every evening bug hunting together, but we couldn’t come up with much because we didn’t have a good methodology.

Then I was lucky enough to meet Serizao and 

 as well as other bug hunters from the YesWeHack platform, with whom I started to collaborate, and since then we’ve continued talking about Bug Bounty and doing more of it.

ON WHAT THEY LIKE MOST ABOUT YESWEHACK…

 What I like most about YesWeHack is how close it is to the community. It doesn't matter what you want to talk about: as long as it has something to do with Bug Bounty, you'll find someone on the other side who will understand and even give you ideas.

In particular, it’s not unusual for me to talk to [hacker and YesWeHack R&D engineer] 

 about certain bugs where I sometimes get stuck, in order to progress and achieve a successful exploitation. Sharing is caring!

I like hunting on YesWeHack because the platform is pretty cool, pretty simple and I'm a very simple person – so I like when the options are straightforward and there aren't 50 sub-menus!

ON THE THREE WORDS THAT BEST DESCRIBE THEM AS HACKERS…

 Resilient, passionate and, once again, passionate – because you have to be resilient.

I'd define myself as patient and persistent because I like to stay on the same targets for a long, long time, which allows me to find bugs that some people won't find because they haven't spent as much time on the target.

And lastly, passionate, because without passion it would be impossible to stay on these targets for so long.

I like everything that involves recon, so the tools I use include 

 of course. But there are other tools that I’ve created that correspond to my needs.

Mainly, I use Burp Suite because it allows me to inspect requests, especially Burp Suite with the 

 plugin, which allows me to quickly see differences between requests and therefore between the privilege levels used for the test accounts I create.

 to try and quickly see the technologies associated with a target I’m attacking. And if I need to do a bit of recon because we have quite a wide scope, I use the wonderful tools that William [Le Berre] and Jomar have developed, like ‘EyesInTheSky’, 

I start by reading the description very scrupulously, because I know that many people sometimes go over it quickly – despite the fact you can learn a lot, especially if there’s a link to the application documentation.

Then, as I’m very focused on vulnerabilities relating to access control, I try to understand the application as much as possible, so that I can spot any behaviour that isn’t normal and could lead to a security problem.

. I search in the JavaScript and in the JavaScript files, looking for new parameters, new endpoints… something to build on what I initially saw of interest in the application – like other parts of the application or platform that I didn't see at first glance.

ON THE VULNERABILITIES THEY ARE MOST PROUD OF…

 With a certain bank [application] I discovered that it was possible to make negative transfers – which meant that instead of taking money from my account and paying it to a third party, it took it from the third party and put it in my account. So the reaction of the internal team was funny!

It’s a fairly simple vulnerability: a blind XSS present in an account deletion feature.

To delete your account, you were asked why you wanted to delete it, so in that field I injected a payload that gave me access to the administrator section, which normally isn’t accessible to a normal user of the site. This gave me access to the underlying functionality of this section, as well as any personal data it could contain.

THEIR ADVICE TO WOULD-BE AND NEWBIE HUNTERS…

 Above all to be very patient, to get to know as much as possible about the applications you're going to target, and to try and understand how the platform has designed its functions.

Based on my own experience, I’d say you need to be surrounded by people who want to teach you, which makes it easy to share ideas and go a bit further than you might have otherwise thought possible.

And secondly, you need to find a program with a huge number of features, so that you can stay on it as long as possible and get to know the application well. This way you can spot potential features that will lead to the discovery of vulnerabilities or behaviour that shouldn't be there – and enable you to dig even deeper.

Interested in emulating Chackal and Serizao? 

‘I stay on targets for a long, long time’: Chackal and Serizao on passion, persistence and partnerships in Bug Bounty

Customisation is key when it comes to unearthing code vulnerabilities, according to Bug Bounty hunter ‘Brumens’.

, who is also researcher enablement analyst for YesWeHack, shares his Bug Bounty tips and tricks for beginners, and reflects on his own experiences as a successful ethical hacker.

Among other things, we asked the 23-year-old (22 when the interview took place) to reflect on his defining qualities as a bug hunter, about how he chooses his hunting targets and for his preferred hacking tools.

When I was young, I always mixed with a lot of computers. I did a lot of networking, learning, and when I grew up I liked coding, so I started to build some code. And then I also started to learn how different things worked and I think that’s how I got into hacking.

 on YesWeHack with a little bit of background about programming and IT security. I started hunting on a 

, and I managed to find my first vulnerability there. From that point, I got some private invites and started my journey on YesWeHack and continued to do hunting.

The triage is amazing. When you report something, the triage is done in a really short amount of time, so that’s a huge benefit about the platform.

And also, the way that you’re able to structure your report and communicate with the company, it’s amazing.

I always go for the functional ones that have a lot of functions, and from there I just like to discover and use the website or the programs as a regular user. And from there, I take the interesting points or interesting functions and go deeper and try to hack them.

ON THE MOST CRITICAL VULNERABILITY HE HAS DISCOVERED SO FAR…

The most critical vulnerability that I discovered myself was an unauthorised SSRF, also known as 

, that led to a remote code execution on an administration panel in the backend.

I would say creative, persistent and very much patient.

My top three hacking tools that I always use are 

ON THE MOST COMMON MISTAKE MADE BY INEXPERIENCED HUNTERS…

In my opinion, the thing that is very common to new hackers is that they take a lot of tools and they spray them on the target with a default configuration, without any customisation.

I would recommend to new hunters: make your own wordlist, make your own payloads, and understand the technology and adapt it to your target. Not spray and use the same methodology for all your programs, but adapt them to the specific one you are hacking.

MORE ADVICE FOR ANYONE STARTING OUT AS A BUG HUNTER…

Pick a target that you’re comfortable with, that you feel motivated to hunt on – not just a target that everyone is hacking on, but a program that you feel would be fun.

When you have that target, then just discover a function, and do research about how that function works. When you’ve got that information and find a behaviour, just keep digging and, eventually, you’ll probably find a vulnerability.

‘Adapt payloads to your targets’: Brumens’ Bug Bounty tips for newbies

Bug Bounty hunting need not be a full-time pursuit to make a big impact or earn a decent income.

’, is proof positive of this claim. The French ethical hacker has reached 11th on YesWeHack’s 

 (at the time of writing) despite working in the daytime as a pentester for Thales Group.

In this writeup and video, Amel explains how he discovered YesWeHack and Bug Bounty, revisits a pair of particularly impressive LibreOffice exploits, and offers some bug bounty hunting tips for beginners.

ICARE ON ENCOUNTERING BUG BOUNTY FOR THE FIRST TIME…

At the time, I was working for a small IT services company. They were testing a web application, which I tested myself and found some fairly critical vulnerabilities.

Since the application wasn’t managed by the company in question, I contacted the publisher, who thanked me for my work and then offered to let me test the product through a Bug Bounty platform.

I didn’t know what it was, but it was YesWeHack. So I signed up to the platform and that’s where it all started.

ON WHAT HAS IMPRESSED HIM MOST ABOUT YESWEHACK…

I would say the team. They are really nice – like a family! The programs are very interesting.

The platform is really user-friendly: it’s super easy to make a report, you don’t get lost in the tabs, it’s really simple and effective!

ON THE THREE WORDS THAT BEST DESCRIBE HIS APTITUDE FOR HACKING…

ON THE VULNERABILITY HE IS MOST PROUD OF UNEARTHING…

I’m quite proud of that one, because it was one of the first that enabled me to develop my skills on the platform and start sharing with the community. It was in collaboration with 

It was an application where you rendered a document and we did an RCE on it, which was great. There was a CVE on LibreOffice that we took advantage of. We went all the way: performed an exploit and got a reverse shell on the machine. And that wasn’t bad, because it got us a nice €10,000 reward.

This is the most recent one, which I found not long ago. It’s a CVE I found on LibreOffice that lets you execute code without any warning: in other words, you open a document – a CV for example – and open it on your machine with LibreOffice, then I can execute the command I want.

I check out the invitation, see if I like the application, and if I do, I work on it. I just follow my gut feeling.

ON THE MOST COMMON MISTAKE MADE BY NEWBIE BUG HUNTERS…

They’re afraid of the programs. For example, if it’s a public program they think: “Everyone’s been there, I’m not going to find anything” – when in fact you can always find something. You have to carry on.

HIS ADVICE FOR ASPIRING AND INEXPERIENCED ETHICAL HACKERS…

You have to be curious, be persistent, gather information, learn, and understand what the application does and how to bypass it.

‘Be curious, be persistent’: Icare on thriving as a Bug Bounty hunter

In the ever-evolving landscape of cybersecurity, YesWeHack recognises the vital role our hunters play in securing our clients' digital assets and their customers' sensitive data. 

To this end, we periodically send special posters to ethical hackers who have notched exceptional achievements in 

 hunting. These range from claiming maximum bounties to dominating the 

 or crafting imaginative, engaging Dojo challenges. 

Embracing the cosmic expanse of cyberspace, we are thrilled to introduce our latest collection of achievements: the 

These are more than just acknowledgments – they are a testament to the skill, persistence and ingenuity of our highest-performing hunters. With a celestial theme, these achievements are designed to express our gratitude to our community of hunters – and hopefully inspire them to even greater heights!

When and how are the hacker achievements awarded?

These coveted achievements are awarded quarterly. 

Every three months, we assess the performance and contributions of our hunters. Those who meet the criteria for any of the achievements will receive a special email from YesWeHack. 

Along with this recognition, you'll receive a physical poster celebrating your achievement – and serving as a tangible reminder of your hacking prowess!

: each physical poster is sent only once per researcher. So if you win, say, the 'Black Hole' achievement in the first quarter and then again in the third, you will receive the 'Black Hole' poster only for the first of these achievements. 

🌑 BLACK HOLE: The event horizon of criticality

 Attain the maximum reward in any YesWeHack program to claim this prestigious accolade (

this does not apply to reports produced through collaboration

 Top the leaderboard – ranking #1 – for at least three consecutive months.

 Demonstrate unwavering consistency by submitting valid reports every month for a full year (

 Prove your expertise on a specific program with at least 10 valid reports on the same program.

 Sit among the leaderboard’s top 5 for at least three months.

🪐 CELESTIAL PLANNER: Serious staying power

 Stay among the top 5 hunters for a six-month stretch or longer.

🚀 GALAXY VOYAGER: Achieving persistence all-year round

 Demonstrate long-term dominance by staying in the top 5 for at least an entire year.

🤝 COSMIC BLACKSMITH: The community contributor

' achievement is reserved for those who enrich the YesWeHack community, be it through blog contributions or crafting imaginative and engaging 

This is more than just a challenge; it's a journey towards becoming a legend in the cybersecurity space. These milestones can signpost your progress through the vast and growing Bug Bounty universe. 

Each poster is not only a reward, but a symbol of your skill, dedication and contributions to securing the digital cosmos.

So: are you ready to join this select group of world-class hunters, to pwn systems with flair and claim your rewards? Set your sights on these celestial targets and 

YesWeHack hunter achievements: Unveiling the Galactic Guardians series

Ethical hacking can be lucrative but there is no guarantee of income.

As such, inexperienced Bug Bounty hunters must above all practice patience and persistence if they are to reap the potentially significant rewards, according to the subject of our latest hunter Q&A.

‘Xel’ – real name Raphaël Arrouas – is well placed to judge: he’s fourth on YesWeHack’s 

 at the time of writing and boasts an ‘impact score’ (average points per report) surpassed by few others.

But, reassuringly for struggling newbies, even Xel admits full-time bug hunting “was not easy” when he started four years ago.

In the second writeup in this series (other videos are 

), the ethical hacker reflects on the challenges of finding the right work-life balance as a freelance white hat, enthuses about his most impressive bug finds, and offers advice to his fellow hunters.

I’m a cybersecurity engineer and following my studies I worked as a penetration tester. During my time as a pentester, I [became] interested in Bug Bounty Programs and I tested myself. I tested participating in one, in two, in three Bug Bounty Programs.

And eventually I thought: “Wow, this is a great opportunity that I should not miss!” So I quit my job to do Bug Bounty hunting full-time.

I joined YesWeHack’s platform with a very interesting program at the time, Swiss Post. It was very interesting for me because I live in Switzerland, so I invested some time into the program, and then into the platform, and got to meet the team. So yeah, I’ve been a regular of this platform!

ON WHAT IMPRESSES HIM MOST ABOUT YESWEHACK…

It’s always hard to say, but I would say the team. Really, it’s a top-notch team!

They are very friendly and reachable people. What I like is they spend a lot of time explaining their philosophy to their customers, and so it makes the whole process very agreeable.

I like their programs a lot. I think they have expanded their customer base in every continent these last years, so I think it’s more and more interesting to hunt on YesWeHack.

ON THE CHALLENGES OF BEING A FULL-TIME BUG HUNTER…

At first, being a full-time bounty hunter was not easy because, well, I needed to get results and there are no guidelines about how to do that.

So I had to develop my strategy, I had to develop my contact with the platforms, I had to see how it would fit into my schedule, my social life, and then my family life. So it had many challenges, but I would say that these challenges are kind of the same as the ones that entrepreneurs have.

ON THE THREE WORDS THAT BEST DESCRIBE HIS TALENTS AS A HACKER…

I would say curious, persistent and focused.

ON THE MOST CRITICAL BUGS HE HAS FOUND SO FAR…

I think the most critical vulnerability I’ve ever found was an unauthenticated RCE on a firewall orchestrator. I think I would have been able to take control of maybe 50 firewalls or something – I could have caused a lot of damage!

I have [another] vulnerability I was proud of: it was an RCE in an e-banking [application]. I was kind of limited in terms of length, and I had to do a server-side template injection in less than 100 characters or something. It kind of looked like a CTF challenge to me, so I was very proud of this one!

HIS ADVICE ON HOW TO BECOME A SUCCESSFUL BUG BOUNTY HUNTER…

Community

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

‘Hunters’ biggest mistake? Expecting immediate results’: ‘RL’ on building a Bug Bounty career

‘I stay on targets for a long, long time’: Chackal and Serizao on passion, persistence and partnerships in Bug Bounty

‘Adapt payloads to your targets’: Brumens’ Bug Bounty tips for newbies

‘Be curious, be persistent’: Icare on thriving as a Bug Bounty hunter

YesWeHack hunter achievements: Unveiling the Galactic Guardians series

‘Adapt payloads to your targets’: Brumens’ Bug Bounty tips for newbies

‘Proficiency takes time’: Xel on his best Bug Bounty finds and the primacy of patience in ethical hacking

‘The level of automation right now is crazy’: GoDiego on why post-auth vulnerabilities are the future of Bug Bounty

PwnMachine: quick update about fix and new features

‘Proficiency takes time’: Xel on his best Bug Bounty finds and the primacy of patience in ethical hacking

YESWEHACK PROPHILE ON ZAX

PwnMachineV2: a new version of the self hosted pwning environment for Bug Bounty

YesWeBurp 2.0 : A new version of our Burp Suite extension is available

YESWEHACK PROPHILE ON ZAX

Products

Researchers

Resources

Company

Follow us