 is the leading digital payments, rewards and financial services platform in Indonesia, used on 115 million devices. Acquired by Singaporean super app 

 in 2021, the platform offers services ranging from e-wallet payments to peer-to-peer lending, investments (stocks, commodities, mutual funds, etc.) and insurance products, all in the same app.

The Indonesian unicorn embarked on the Bug Bounty adventure in 2020, with a local self-hosted program. Eager to reach an international community of researchers, they reached out to 

 in 2022 to launch a private Bug Bounty program. Today, OVO wishes to take its collaboration with the community a step further by launching 

!Let’s take a look at their program and its specificity!

OVO’s main product is a mobile application (Android/iOS) with many features related to wallet management and online payments. Although the main target is their app, the scope of the program also includes most of OVO’s external-facing web assets. Whether you’re into mobile app testing or web recon, or both, you shall find an interesting asset to dig.

Regarding its infrastructures, OVO recently migrated from on-premise/multi-cloud environment to GCP (Google Cloud Platform). Making sure this new environment is hardened and secured is one of their top objectives with this public bug bounty program.

It’s also good to note that their team works with a short development cycle, which allows them to add new features to their applications (web or mobile) on a weekly basis, and as a hunter you might find brand-new stuff to test and new scenarios to exploit from one day to the next.
Language-wise, for most of the online services, OVO uses Golang (BE), React JS (FE), Python (BE) and also PHP.

OVO being a fintech company, the security team wants to put the focus on specific security scenarios that represent direct threats to their customers’ data or online payment services.

Any vulnerability allowing an external entity to obtain unauthorized access to PII under their web application, mobile application or any assets, is likely to be awarded a nice bounty.

To be more specific, OVO operating a payment solution, they are very keen on identifying attack scenarios that can demonstrate a serious impact on its core-business features, in particular:

“We care about the safety of our customer data and like security, just like you! OVO’s (app)security team is run by a small group of dedicated people from multiple countries (Indonesia, India, and France). We’re all excited to see what hunters can come up with. Please don’t pwn everything, we need to keep our jobs.”

Founded in 2015, YesWeHack is a global Bug Bounty and VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting more than 45,000 cybersecurity experts (ethical hackers) across 170 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

In addition to the Bug Bounty platform, YesWeHack also offers: a creation and management solution for 

, a Pentest Management Platform, a learning platform for ethical hackers called 

 and a training platform for educational institutions, 

Indonesia’s Largest Fintech OVO kicks off its Public Bug Bounty program on YesWeHack

) which is the well-known European Union’s annual campaign dedicated to promoting cybersecurity among EU citizens and organisations, is coming to an end.

 wishes to contribute it not only with the usual statements on the importance to be aware of the cyber risk but with a concrete move: the release of our turnkey VDP solution as open-source tool to get responsible vulnerability disclosure more widespread.

Cybersecurity as a “public good” and recent positive policy trends

As the risk of cyberattacks linked to the exploitation of vulnerabilities will invariably increase with digital transformation of our life and the ever-expanding attack surface of new digital technologies, a different approach to cybersecurity is needed.

First, security is all about transparency. Every organisations should be as transparent as possible about security issues that come to light. This will help building trust and reputation with users of new technologies. When it comes to cybersecurity, the key message is to ensure that all users have access to the expected level of robustness and security of digital solutions. These elements should be adequate to the purpose of the deployment of new technologies.

, would imply that costs are shared equitably among all the relevant stakeholders. As for other public goods like streetlights and national defence, the public sector could set standards or shoulder some part of the costs and the users will contribute by paying taxes.

Finally, approaching cybersecurity as a public good would also trigger and encourage more shared responsibilities among the different stakeholders, and fostering collaboration.

Over the last years, some international and inter-governmental organisations have taken relevant actions promoting the issue of 

 (VDP) as a public policy topic and providing a strong political commitment toward that end.

, with its working group on Security in the Digital Economy, has promoted the topic of encouraging responsible vulnerability treatment among its members. The CyAN Global Coalition to Protect Cyber Researchers is also an important step to push for consistent legal immunities for bona fide zero day researchers. Then, the European Union has put in place several regulatory initiatives promoting the use of VDP: the 

 are all encouraging Member States and private organisation to design and deploy VDP to facilitate the reporting, detection, and remediation of vulnerabilities.

It is without no doubt that international public stakeholders acknowledge the appetite and need for a more transparent way to report vulnerability. Even more important, all these initiatives highlight the need for a regular institutional dialogue that would give the chance for all stakeholders, including ethical hackers, to participate in an inclusive and transparent manner. However, CVD programmes are still facing important challenges: users’ lack of knowledge of the rules of engagement managing these activities, the fact that some companies are still insufficiently aware of the need to patch vulnerabilities detected in their software, and to the heterogeneity of the processes specific to each organisation. Finally, CVD policies are not yet generalised or harmonised. Given this context, what are the means and best practices for generalising the implementation of these programmes?

” released today is a simple and turnkey website allowing anyone to host their own VDP. As for our commercial offering, YesWeHack will continue providing a fully managed and integrated solution for managing vulnerability reports at scale in a seamless manner.

Our initiative reflects our decade of security expertise in Europe and long-term investments and a deep commitment to CVD approach, ethics, transparency, and compliance with European laws.

Since wild disclosure or not reporting a vulnerability due to a lack of communication channels puts users at risk and can impact the reputation of the provider, CVD is the only way to turn these liabilities into opportunities and build trust.

, a unique and comprehensive online repository that continuously crawls the web to reference existing vulnerability disclosure policies. 

 exists since 2015 with the primary purpose of allowing security researchers to find disclosure policies of any kind, be it Hall of Fame or 

 programs paying monetary rewards. So far, 

 harbours close to 25,000 VDPs, making it the world’s most complete VDP directory.

While global giant tech players have a commercial interest in contributing to “EU’s digital decade” and marketing non-European solutions during the ECSM, the release of MyOpenVDP constitutes a simple but far-reaching move for a long-term approach to cybersecurity as a public good.

Finally, for those who want to scale and industrialise the VDP, they will always be able to upgrade the solution to the 

 which remains customisable and integrated into the YesWeHack platform. This will allow the entity to manage and control all their vulnerability reports taking advantage of the features of our platform. For more information, 

Conceiving cybersecurity as a public good would be decisive for the attainment of the global economy and society prosperity, for it will help to improve the overall security of our societies and their stability. Our commitment to collaboration and innovation has always inspired our action: we will continue providing concrete tools and action-oriented proposals to promote the widespread use of CVD by all organisations.

Founded in 2015, YesWeHack is a global Bug Bounty & VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting more than 45,000 cybersecurity experts (ethical hackers) across 170 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

Turnkey VDP Open Source: making a difference in enhancing cybersecurity as a “public good”

A web application firewall (WAF) is a program specially designed to filter, monitor and block 

The WAF filter and detection department is dependent on two primary configurations. The 

. These configurations make it possible for a WAF to determine if a request contains malicious content.

In this article, we will discuss different ways a WAF can be bypassed when a vulnerability has been discovered.
The topic will focus on how to take advantage of the configurations and normalisation that could affect the way a payload is being handled in the transport. We will show different scenarios and examples of manipulations that lead to a successful bypass.

Regex stands for regular expression and is a method or sequence of characters to detect patterns inside its given content. In simple words, regex can be used to detect patterns from a source and makes a huge advantage when developing filter mechanisms for web application firewalls.

An example of how a regex could be used to find all words starting with the uppercase “

If you want to dig deeper and practice custom regex, you can do so 

Let’s setup a simple filter that is intended to protect against 

 which are used mainly in HTML and Javascript.

The last payload looks almost identical to the first but it’s not detected by the regex. Why?
This is because the regex is not configured to detect patterns unless it ends with a 

 in this case. Imagine how precise the regex has to be to be able to detect a pattern.

This is one of the many examples how web application firewalls are being bypassed.

This is bypassable because we take advantage of two techniques. First, the regex looks for a payload that starts with 

 and secondly it looks for any onload statement followed by an equal sign 

.
The last payload in the image takes advantage of the 

 symbol that the regex is searching for as a prefix. The payload splits into two pieces with the help of a 

 symbol and triggers the regex to start its pattern search. Then, when we add the newline to the payload, the regex is broken. The regex breaks because the 

Lastly, we add our final piece to the payload that includes the 

 part. The regex won’t detect the onerror statement since it’s not starting with the 

 symbol, which is needed to trigger the regex. It results in a successful bypass.

A WAF also uses different word lists to detect payloads by searching for words inside the request. If it detects a word within the given blacklist in the request, the request will be blocked by the WAF. The opposite type of list is the whitelist. This word list contains words which are allowed to be used or that are strictly needed within an input.

Let’s upgrade the regex filter and add all previous bypass methods to fix bypasses related to newlines.

 part at the second last payload. This results in a WAF block but in a real world scenario you would have gotten a 

 page without being aware of the fact that half of your payload was successful.

That’s a reason why it’s very important to take one step at a time when crafting a payload (

So how did the latest payload bypass the regex?

This is because we have configured the regex to detect 

I think you get the point. It is very difficult to configure a firewall to detect all kinds of patterns. Because the payload is so extremely flexible, the payload is always one step ahead.

It’s important not to mix up firewall filters with frontend and backend filters

. You might be able to bypass the firewall but that doesn’t mean you actually found a vulnerability within the system itself. Remember that the firewalls purpose is to have an extra protection and detection for malicious requests.
If the frontend and/or backend do not filter/escape properly, this would likely instead be a vulnerability. This isn’t the case if it’s within the web application firewall filters since the firewall do not protect an actual input handler.

. Payload bypassed: WAF transfer the request to the backend code

: Web application firewall bypass and vulnerability exploited. Resulting in 

In this case, the firewall was bypassed and the backend was vulnerable to an XSS injection because it didn’t escape the actual user input handling for dangerous chars.

), the result would be that the WAF was bypassed but the input itself was not vulnerable to XSS.

 Web application firewall bypassed but search parameter wasn't vulnerable.

 important to first determine how the frontend/backend filter works before attempting to exploit it. 

If the entrance is not vulnerable, what is the point of bypassing the firewall?

In many cases, frontend, backend and/or technologies such as proxies cause not only normalisation but also filter collisions. A filter collision occurs when there are two or more filters that have a similar task in common.

Image that we use a payload as following: 

 and then transfer it to the web application firewall.

The WAF sees no suspected content and the payload continues to the frontend.

The Javascript that runs on the frontend decodes the payload and escape it with a backslash.

5. The backend deletes all quotes in the input to avoid quotes altogether. (

6. When the payload reflects in the frontend response, it will appear as 

The end results. You are now able to take advantage of this collision for a lot of different payloads. Since the quotes are deleted and leave the 

 alone, you could use them to bypass URL verification or escape backslash itself with 

Take advantage of all the different behaviours of the target when bypassing the web application firewall.

Example custom payloads related to the collision

The main challenge when trying to adapt a bypassable payload is to determine how the payload is understood by the web application firewall. Since a WAF only responds with a forbidden page or lets the payload pass, we need to take small steps forward to build up a payload.

The payload should contain only the characters that are necessary for the type of vulnerability you are trying to exploit. This will provide a better understanding of how the payload is managed and changes during the process.
There are lots of different ways to customise a payload. Besides, depending on the vulnerability, there are different characters that are particularly important to include for a successful payload.

 if the firewall does not protect against the HTML tag 

 and there is no need to use the symbols 

 or > if we infect within an HTML tag.
The same goes for 

 or other types of vulnerabilities that need a payload to be exploited properly. 

Create and adapt a payload from the location where it is placed.

There are some good payloads out there, but if you want to be able to bypass WAFs at an advanced level, most of these payloads are not the solution. However, taking notes from them and storing 

Web application firewall bypass

, the global Bug Bounty & VDP platform, held its first Singapore Live Bug Bounty event on 25-26 August 2022. We partnered with 

, Southeast Asia’s leading eCommerce platform, to host these two days of concentrated hacking at 

Founded in 2012, Lazada Group is Southeast Asia’s leading eCommerce platform and the regional flagship of Alibaba Group. With a presence in six countries – Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam – it connects this vast and diverse region through its technology, logistics and payments capabilities. Today, it has the largest selection of brands and sellers, and by 2030, it aims to serve 300 million customers.

Being in the fast-paced eCommerce industry, Lazada must always be ready to evolve its security environment to prevent cyber-attacks. For this very reason, and with its commitment to building a safe and trusted platform for its customers and brand partners, Lazada has chosen to launch a 

“Our work environment is very fast-paced. We launched our Bug Bounty program two years ago to prevent problems from being introduced to our secure environment. We actively work with the security researchers community to ensure that we can use the feedback and findings that we receive from them to continuously improve our internal process.

👣 Lazada’s journey with Bug Bounty throughout the years

Lazada first embarked on its Bug Bounty journey with us in January 2020. From there, it launched a private Bug Bounty program and engaged a selected pool of 20 security researchers at launch, which grew to 100+, to discover security vulnerabilities in its IT environment.

 that invited over 40,000 researchers to hack into its systems under specific scopes and rules, with attractive bounties up to US$10,000! An exclusive, remote, invite-only Live Bug Bounty event with 40 handpicked researchers was also held just before the public program’s launch.

The Lazada security team had received many insightful vulnerability reports over the years, allowing them to continuously improve the security posture of Lazada. Researchers’ findings had also helped Lazada’s security team members grew in their own skill sets. Lazada, however, wished to reach even greater levels of security and meet face-to-face with the researchers they had been communicating with remotely for years. As a result, in August 2022, they organised Open My Heart, an in-person 30-hour Live Bug Bounty event, inviting researchers from Europe, APAC, and all over the world to visit Singapore to participate.

Rather than communicating remotely, researchers could ask questions directly to the Lazada and 

 teams on-site. The researchers also met with one another and discovered new vulnerabilities and exploitations faster by combining their knowledge and skills. 

You could speak with the Lazada team every time, at the venue. Every question you had, everything you needed to know, they would help you right away

“Having some of the best security researchers in the world in the same room as us was an exceptional opportunity to learn and exchange.”

, who leads the Red Team & Security Testing Team at Lazada

❤️ Lazada really opened its heart to the researchers

The Lazada team went all out for the event! To allow the participating researchers of the Live Bug Bounty to fully enter their systems and extensively test their applications, they voluntarily disabled a number of essential security mechanisms for them during a specified period during the event. Researchers were also given access to bypass Web Application Firewalls (WAF), allowing them to hack into Lazada’s sites and services.

Lazada’s scope was a huge playground. Besides the fact that I enjoy hacking on a complete eCommerce ecosystem, from buyer to seller with all of the little apps surrounding it, having the freedom to choose your target in such a huge scope is really great

“Accomplishing a live program on this scale demonstrates Lazada’s commitment to security and progressive stance towards bug bounties. By engaging with the broader community, the eCommerce giant is placing an unprecedented level of trust in ethical hackers to better strengthen their security, transparency, as well as data privacy and protection. We are delighted to be able to contribute to yet another successful collaboration with Lazada.”

A healthy (and fierce!) competition among researchers

🏆 A fierce battle towards the very last minute

A few researchers had already gathered on the event site to get ready for the Live Bug Bounty’s launch on Thursday, 25 August, at 10:00am SGT.

, with fifteen submissions within an hour! 

 followed closely behind throughout the event, and it was a fierce battle between the three players. As the event drew to a close on 26 August, Friday, 4:00pm SGT, Doomer’s late but exponential ascent with several bugs chains, earned him the top title!

And here are the top three researchers of Open My Heart!

“I already had the chance to participate in a previous private event with Lazada and kept an awesome memory of it. I just LOVE how YesWeHack always manages to organise top-tier events, but most importantly, gets the right clients in a well-managed live hacking. There were quite some known hackers at the event and it’s always fun to meet and challenge each other and share knowledge and awesome techniques! To be honest, I was scared when I saw the huge early rush of Assetnote! But I stuck to the magic solution: Enjoy the moment 🙂 There are always a lot of bugs to be found, even on public, hardened scopes and it’s cool to see others making it to the top. So basically, forget everything and just hack with a positive mindset! These 30 hours were really fun. You know, at BZHunt, we always wanted to keep Bug Bounty and live events as a part of our daily activities. It is quite a unique feeling to be able to “forget everything” and just enjoy the pure pleasure of hacking, the adrenaline of the event and the pleasure to share this moment with others. It was also quite cool to see some new names participating in the event. Glad to see newcomers participating and finding bugs, and happy to see how YesWeHack expands and popularises ethical hacking in SEA.”

“It was a lot of fun, and I enjoyed working with Lazada. They were excellent to work with and had been very responsive to our feedback. It was great hanging out with all the people from YesWeHack and all the Bug Bounty hunters.”

“This was my first ever Live Bug Bounty with YesWeHack (unfortunately virtual) and I was lowkey nervous about it because I did see a few big names from the community whom I regularly follow and look up to. The bunch of test accounts that were provided to us were pretty much a good scope for me to toy around with little to no sleep. Yes, I absolutely had fun. 😄”

It was interesting to meet the hunters in person for the first time at the Live Bug Bounty event. In addition to seeing our friends from the researchers’ community, we also met a lot of new talents. The researchers had provided us with a lot of interesting and unexpected feedback and findings after this event. Fresh ideas are always welcome. I personally learned a lot from the Live Bug Bounty. It broadens our perspective to meet so many smart hunters. To evolve Lazada’s security posture, we can once again count on the researchers for new feedback.

, Senior Associate, Application Security and Security Testing, Lazada Group

In total, 115 vulnerabilities reports were submitted.

Would you like to learn more about Open My Heart – Live Bug Bounty event? We captured all highlights and moments in an exciting video.

Founded in 2015, YesWeHack is a global Bug Bounty and VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting more than 40,000 cybersecurity experts (ethical hackers) across 170 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

Lazada Group is Southeast Asia’s pioneer eCommerce platform. For the last 10 years, Lazada has been accelerating progress in Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam through commerce and technology. Today, a thriving local ecosystem links about 160 million active users to more than one million actively-selling sellers every month, who are transacting safely and securely via trusted payments channels and Lazada Wallet, receiving parcels through a homegrown logistics network that has become the largest in the region.

With a vision to achieve USD100 billion annual GMV, Lazada aims to serve 300 million shoppers by 2030, and be the best at enabling brands and sellers in digitalizing their businesses.

In 2022, the Lazada Foundation was set up to empower youths and women for the digital future, close the gender digital divide and uplifting communities by creating positive impact. More information can be found here 

Want to discuss crowdsourced security with our experts?

Walk me through Open My Heart – Live Bug Bounty event with Lazada

EU Cyber Resilience Act & Coordinated Vulnerability Disclosure Policy

It’s important when you buy a product that the product doesn’t have known vulnerabilities. That’s not the case today

) and now the Internet of Things. These are the three scopes covered by the European legislative power to “address the cyber threat, but also to become a leader in cyber security” according to 

Ursula von der Leyen, President of the European Commission

Last 15th September, the Vice-President Margaritis Schinas and Commissioner Thierry Breton presented the proposal of the 

 a Regulation to define common European cybersecurity standards for products with digital elements that are placed on the EU internal market. This can be considered as the final element of wider regulatory strategy to protect European citizens and business against cyber-attacks.

The proposed legislation aims to impose new cybersecurity requirements on hardware and software products such as smart toys and fridges and security cameras that are placed on the single market, whether they are produced in the EU or not and throughout their whole lifecycle.

“Insecurity-by-design” as main market failure

The main market bottlenecks addressed by the proposal is the low level of cybersecurity, reflected by “widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them”.

Over the last years, cyber-attacks such as Mirai, WannaCry, NotPetya and SolarWinds have underlined the exploitation of vulnerabilities in digital products attacks. These attacks showed that the successful exploitation of a vulnerability in a single product can paralyse global firms and lead to billions of euros in damages.

While our digital society derives clear benefits from the Internet of Things – for example, lower operating costs, new consumer insights and the possibility of process optimisation – the attack surface of Internet-enabled products continue to increase and as such the 

urgency of vulnerability disclosure management.

For that specific challenge and to improve 

 on security of hardware and software products, the European regulator has proposed a set of requirements for all internet-connected products in the European single market – regardless of whether they were manufactured here or not – and applies to their entire life cycle.

Among them, Art-10.6 of CRA requires manufacturers to “have appropriate policies and procedures

, including coordinated vulnerability disclosure policies […]

, to process and remediate potential vulnerabilities in the product with digital elements reported from internal or external sources”.

The CVDP as cornerstone of the vulnerability management

, we have been working fiercely to raise awareness of the positive impact of ethical hackers in finding and reporting vulnerabilities and to guarantee a secure and accessible communication channel with well-intentioned security researchers.

Curious about the feedback on the application of our solution from one leading European IoT company?

Therefore, we consider the proposed CRA a significant step towards implementing a harmonised pan-European approach to mandate the use of VDP.

 which creates a framework for EU certification schemes referred to CVDP as an important tool to support Member States’ efforts to enhance cybersecurity; early this year, the recent update of the Network and Infrastructure Security Directive encourages Member States to design CVDP to facilitate the reporting, detection, and remediation of vulnerabilities.

For sure, the European Union is gradually taking up the subject of CVD and facilitating its broader adoption in the Member States. However, some important topics remain to be further examined and harmonised

 at European and global levels (e.g., definition of what constitutes illegitimate access to an information system, universal minimum protection for ethical hackers, complement the amendments of the Cybercrime Directive, information sharing with ENISA and Member States…).

YesWeHack is already actively engaged with European partners and customers to foster the dialogue on such critical topics and to make Europe safer and competitive on the global market. In that scenario, the ethical hackers have and will continue to play a fundamental role to our digital life.

Eager to know more about Vulnerability Disclosure Policy?

Founded in 2015, YesWeHack is a global Bug Bounty & VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting more than 40,000 cybersecurity experts (ethical hackers) across 170 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

Let’s get the IoT landscape less vulnerable for all

, the global Bug Bounty & VDP platform, organised a Live Bug Bounty during the 

, held in Lille, France. This year, it was 

‘s — the giant sports and entertainment retailer — turn, with its Technology team, to participate in these two days of intensive hacking!

Operating in over 70 countries, addressing the needs of 500 million users of its products and services and with a community of over 100 million members, 

 is a major digital player with high visibility and exposure to cyber risks.

Decathlon’s cybersecurity teams deploy numerous resources and tools to ensure the security of the company’s activities in the 70 countries in which it operates. Among the actions carried out by the company’s cybersecurity teams in order to remain at the cutting edge of innovations, 

Decathlon has been in a private Bug Bounty program for a year on the

“Bug Bounty is challenging and engaging for us. When researchers detect a vulnerability, they submit a report. And when this vulnerability is critical, we set a deadline to fix it. This reactivity is essential in our commitment to security. It allows us to maintain the high level of requirements that characterises us at Decathlon, and keeps both the bug hunters, and our teams, motivated

, Information Security Manager at Decathlon.

With their participation in this Live Bug Bounty, Decathlon has gone one step ahead in its efforts to collaborate with ethical hackers.

For corporate security teams, it’s a unique and invaluable opportunity to discuss their findings with researchers, and better understand security bugs. For hackers, it’s an easy way to ask live questions to program managers and YesWeHack’s teams to get more information about the programs and thus go even further in their research. Furthermore, researchers may collaborate with each other to pool their skills and expertise and thus go further in the hunt for new vulnerabilities and exploitation.

“This is the first time that we are embarking on a Live Bug Bounty. It allows us to meet the hunters, to discuss with them, and then, to go further in the search for vulnerabilities.”

During these two days, the Decathlon teams offered exclusive scopes to the researchers attending the event. They wanted to test the robustness of their “OneShop” solution; it is an E-Commerce solution, based on PrestaShop, used by about thirty countries in the world (

Moreover, in order to test the E-Commerce platform from end to end, Decathlon Technology also wished to include its authentication solution called “Login” and its loyalty solution called “Account” in the scope of the test.

Decathlon Technology’s technical teams were on hand to ensure the rapid assessment and remediation of the reports submitted by the hunters. And what speed! The team had an average response time of only 1 hour 06 minutes during the event 👏

The Live Bug Bounty started on Wednesday 08 June at 10:00. A few dozen hunters were present at the booth and were eagerly awaiting the launch of the program. The Live Bug Bounty was also open to participants of the 

, an ethical hacking competition using eSport codes dedicated to students!

The first submission (aka “first blood”) was submitted by 

, only 1 hour after the start of the event! 

 then quickly took the lead, thanks to several IDOR (Insecure Direct Object Reference) discovered on the scope, followed closely by Zax and Effrite.

As the day progressed, the rankings changed with several reports from the hunter 

After 30 hours of Live Bug Bounty, the overnight research efforts of the BZHunt team (

) finally paid off. The hacktivity revealed a RCE (Remote Code Execution) as well as an SQL injection and some other vulnerabilities, reported by Zax. This allowed him to take the lead and keep it until the end of the event.

And here is the podium of the Decathlon Live Bug Bounty:

“I really enjoy participating in live Bug Bounty events, it’s really great to meet the community as well as the program managers! During these 30 hours, it was possible to interact with the Decathlon team, who came in numbers. Being able to talk directly with the Decathlon teams allows us to show our PoCs, to have real-time feedback and therefore to go even further in the impact.

As for my team, BZHunt, we are exhausted but delighted. We pushed on until the last few minutes of the event and managed to grab the lead on the podium, carefully held by Hisxo throughout the event. A big thank you to YesWeHack for this great organisation!”

A successful first experience for Decathlon

“After just over a year in private Bug Bounty program, we wanted to reach a new level by running a Live Bug Bounty. Despite some apprehension due to the fact that we were going to test the robustness of one of our E-Commerce platforms with real conditions on the production environment, the event was a great experience for us and a real success on all fronts:

✅ There were no disruptions to the production (the hunters took into consideration the rules of the program which forbade carrying out tests that could cause possible service interruptions)

✅ The allocated reward budget was respected and we were able to pay all the hunters during the event

✅ Our on-site teams did a remarkable job, notably with the qualification of the 64 reports submitted by the hunters before the end of the event and with an average response time of only 1 hour 06 minutes

✅ Our mobilised teams accepted 27 reports, including 3 critical reports, and the first patches were being built even before the end of the event and are currently being deployed throughout the affected area

✅ The proximity with the hunter community was very much appreciated, as it allowed for smoother interactions and the opportunity to be confronted with new approaches to security

In addition, our communications teams enjoyed co-organising the event in partnership with YesWeHack and the result highlighted both our companies through this action.”

The next Live Bug Bounty organised by YesWeHack will take place at 

 Paris, on June 24th and 25th 2022! Be ready, it’s going to be intense! More info 

The YesWeHack Blog

Indonesia’s Largest Fintech OVO kicks off its Public Bug Bounty program on YesWeHack

Turnkey VDP Open Source: making a difference in enhancing cybersecurity as a “public good”

Web application firewall bypass

Indonesia’s Largest Fintech OVO kicks off its Public Bug Bounty program on YesWeHack

Walk me through Open My Heart – Live Bug Bounty event with Lazada

Let’s get the IoT landscape less vulnerable for all

Back to Decathlon’s Live Bug Bounty

Walk me through Open My Heart – Live Bug Bounty event with Lazada

DOJO CHALLENGE #17 Winners!

The French government’s digital identity application under Bug Bounty program on YesWeHack

YesWeHackVR, an immersive hacking game

DOJO CHALLENGE #17 Winners!

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us