 was rather tricky: you needed to solve an obfuscated XPath request to derive working serials

. The 3 first hunters to solve this challenge are rewarded a prestigious 

 geared towards learning bug exploitation the fun and visual way.

The DOJO is three things in one: a learning tool, training platform and a playground.

The DOJO is the arena where the 4th challenge took place (see the 

We are glad to announce the #4 DOJO Challenge winners list.

 feeds to be notified of the upcoming challenges.

Read on to find the best write-up as well as the challenge author’s recommendations. For this instalment of the DOJO Challenges, we have selected two write-ups as their approaches are distinct and rely on different tools. Read on then!

You have to find the seven valid serials returning the Access granted! string from the XPath query. The $serial input is filtered to restrict the input to the use of digits and hyphen (-) and 19 characters. The serials format is given: xxxx-xxxx-xxxx-xxxx where x is a single digit.

Tricky tricky… there was a hint pointing us to 

, but is that challenge even human-solvable?

We also asked you to produce a qualified write-up report explaining the logic allowing such exploitation. This write-up serves two purposes:

Determine the contestant ability to properly describe a vulnerability and its vectors inside a professionally redacted report. This capacity gives us invaluable hints on your own, unique, talent as a bug hunter.

solve the challenge without the use of any tool

The second valid report is a piece of mastery crafted by 

We were absolutely thrilled by the quality of this session’s reports.

During the testing, I found that we need to find seven valid serials for the provided XPATH query. The format of a serial is defined as: 0000-0000-0000-0000. There are filters applied on the provided serial:

A serial can only contain 0-9 numbers and ‘-‘ character. If any other character is provided, then it will be replaced by ‘0’

I solved this challenge by writing a constraint solver using Z3 theorem prover tool.

 The code is obfuscated and unreadable for me. So I took apart the query in different portions. This way I could easily read the XPATH query and understand it. See below:

 Now, I tried to solve the equations that do not contain the $serial value, by passing the XPATH query in template parameter to endpoint /backend/xpath as shown in the image below:

 Thus, I have solved all the possible equations and put it in the image shown in Step 1 above. It now goes like this:

So, we have minified the XPATH query. Please note the lines 21 and 23 in the image in Step 3:

The line 21 with value 1 is the second argument of first substring function which indicates the starting index of string.

The line 23 indicates the length of that string which is 15.

As we can see, the length of “Access granted!” is same as the length of “Access refused!”, and both equal to 15.

 Now, note the second substring function which takes the output of translate()*42 as its second argument and 15 as third argument. We can thus understand that, if we want to get the “Access granted!” string, then the output of translate()*42 should not be greater than 15.

. substring("abcdefghijklmno", 16 ,15) will output nothing as second argument (

starting of the string) as it is greater than the length of the string.

 Another thing to observe is the arguments of the translate function. We can think of translate as a replace function which does not follow any order.

 translate('abc', 'cb', 'YX') will output aXY 

 ‘c’ is replaced by ‘Y’ and ‘b’ is replaced by ‘X’, although they were in different order.

In our minified XPATH query, we could see the second argument of translate function is uareltsf and the third argument is 01001011. And the conditions (

) from line 3 to 17 eithers outputs true or false. So, this means true will be replaced by 0000 and false will be replaced by 11110.

To fufill the condition in Step 5 above, we need all the values equal to true since after concatenation it will output truetruetrue.... which will be replaced 0000000000.... and Access granted! will be printed out.

However, to realise those conditions, we need to write a constraint solver. I wrote a small script using Z3 to solve it. I have also added comments in the code to make it more self-explanatory.

Requirements: Follow the instructions here:

Run the provided solution script using python: python sol.py

I found the following 7 valid serial keys:

BONUS: MARCOSEN manual solve (well, if brain had fingers)

The problem here is, that only some obfuscated code is used to hide the evaluation of the serial.

The first part was to remove all the “static garbage” from the code. This means to evaluate all the terms that do not contain the serial. I did this by just sending the term I wanted to evaluate and checking the servers answer.

The next step was to replace all the substring-methods just to make it obvious which part of the serial should be evaluate in that part of the code. I replaced it in the code-snippet below with partX.

Looking at the substring with “granted”, we can observe that the translate-method must be 0, so that we get the substring of the beginning of “granted”. These leaves us with the information that the concatenation of the inner terms must be as follows:

For the math, I will replace part1-part4 with a-d. Simplifying the terms gives us seven equations:

Time to solve the equations! I started by just making it all depending on c. This gives us:

Ok, so c = ? How do we get the value of c? We know that c must be dividable by 9. It must also be dividable by 4, because b = c/4. Also b must be dividable by 5. So, we need the least common multiple (LCM) of 5, 9 and 4. This gives us that c must be a multiple of 180. So, for the next steps I will express this with c = 180x.

But that’s not the end of it. The next step was the hardest for me. It’s the step to get the equation for d to be true. By using the multiplicative inverse modulo of 8 we can get the correct values for c:

This gives us the values of x and therefore the seven values for c = 180x. With the equations above the input strings for the admin access are:

 is the Technical Ambassador at Yes We Hack. He also created the DOJO and this challenge.

While Z3 was not required to solve this challenge, it is a nice simple exercice to get started with the library. Z3 or other SMT solver can be really useful when dealing with a large number of constraints.

DOJO CHALLENGE #4 Winners!

Every business needs a vulnerability disclosure policy. Thankfully, a growing number of organisations have one. Yet, those programs are not always a click away. Here’s to a unique plugin for both Chrome and Firefox, because making it easy to report issues need not be much work.

We are all too familiar with the quotidian data breach debacle that organisations go through more often than not. Besides, the initial notice frequently comes from an “anonymous report” or a disgruntled ethical hacker tweeting about your mishandling their repeated vulnerability notifications.

Those are situations we observe, yet many still struggle with preparing for them and the PR mess that inevitably follows. Shooting the messager, coming up with statements that look pretty much like they have been 

 for months, are all symptoms that you are ill-prepared to handle reports from the broader security community.

One robust approach to preventing stinky headlines and loss of trust from customers and partners is a vulnerability disclosure policy (VDP). That policy is a commitment that your organisation will receive, evaluate, and if need be, fix vulnerabilities notified by security folks external to the business.
A VDP also clarifies that you will not go after ethical hackers willing to help you improve the security of your service or product.

For a VDP to be efficient, it needs a few essential elements:

 clearly state what is what, identifying assets that your VDP covers.

 specifically directed at ethical hackers, this bit confirms your commitment to not prosecuting well-intentioned researchers who report a vulnerability. That part is particularly important as legal clarity across organisations and countries is extremely challenging to achieve.

: the precise mechanism your organisation has set up and, ideally, the details you would want to see added to a vulnerability report. The aim here is to make said report the most useful possible to the organisation’s technical team.

: anything you find relevant to smoothen communication.

You get it right: setting up such a policy implies you have thought out roles and responsibilities internally. Rather than a burden, setting a VDP and organising it is a way of developing talent, breaking silos and improving security altogether.

The better news: Showcasing your VDP has never been easier

You have a VDP; you need to feature it prominently on the organisation’s website so it is accessible to anyone who needs it. One way of doing so is creating a dedicated webpage, 

Another way is thanks to a simple tool that comes in handy, namely 

. You fill in the form, download the file and upload it to the business’s website. Your security.txt can contain 

. Indeed, a Bug Bounty programme is a vulnerability disclosure policy with a monetary reward system.

Whichever way you choose, you will want it to be known. Well, now, 

 . Whenever you browse the web, the plugin indicates whether a VDP exists. Because making it easy to report issues does not need to be much work!

Wanna go for a cool – and secure – carpooling service?


We have marked cases where a VDP exists without a security.txt as “room for improvement” to highlight that security.txt is a (draft, for now) standard. As such, it makes locating a VDP policy even easier since one needs no extra browsing to find the contact detail: the security.txt file is always present at www.mywebsite.tld/.well-known/security.txt

Showcasing your vulnerability disclosure policy to the world

Interview with Romain Lods, Head of Engineering,

Why did you decide to launch a Bug Bounty program?

About two years before we launched our Bug Bounty program, we started internal security audits on our code, which had never been done before at Deezer. These tests allowed us to make a first pass and fix some obvious vulnerabilities.

Then we became interested in Bug Bounty and 

The ease of use of the platform convinced us of launching a program.

 Following the launch, we very quickly received interesting vulnerabilities, everything went smoothly, so we decided to conti­nue and expand our perimeters.

What value does Bug Bounty offer compared to traditional cyber security solutions, such as penetration testing?

We typically perform an annual audit on several of our services, which lasts between one and three weeks. But this approach is expensive, focuses only on a few services, and over time, doesn’t really deliver interesting results. Bug Bounty gives us ongoing feedback throughout the year, on various scopes, and detects bugs very quickly.

In terms of ROI, Bug Bounty is also very interesting: we decide ourselves the reward we assign to each vulnerability.

Moreover, Bug Bounty guarantees us a diversity of testing skills. With penetration testing, each consul­tant is ultra-specialized, so we tend to guide him or her on what we want from the test.

With Bug Bounty, we were surprised by some researchers’ reports. They gave us results of original scenarios, which we had never seen before.

Finally, I appreciate the quality of the reports on the flaws reported through YesWeHack. You sense the researchers are really trying to offer a functional and reproducible POC, that we can easily retest.

The reports of our usual audits are generally quite accurate, 

but we also find the equivalent quality with Bug Bounty, when the researchers are good and ‘play the game’

. It’s very pleasant to receive reports illustrated with screenshots and videos, which greatly facilitates their understanding, validation, and also their communication to the teams concerned.

Check out Deezer’s public Bug Bounty program

Do you get help from researchers to analyze and fix the bugs received?

Yes, the researchers help us in the bug reproduction phase. In some cases, we ask them to check whether the vulnerability has been fixed. We also have a large team of developers in-house who can take care of this patch management.

Does Bug Bounty mean the end of penetration testing or are the two complementary?

For me the two remain absolutely complementary. 

Bug Bounty is a tool that goes further and deeper than the audit.

 We use penetration testing on new services, or on scopes where we already know there are problems.

Have you observed any changes in your teams since you began using Bug Bounty?

We clearly see an increased awareness of security. Bug Bounty reports helped us trigger some major security projects. 

Our cybersecurity vision and posture have evolved, and Bug Bounty is one of the drivers of this change

In terms of organization, we adapted our process to collect, sort, and validate reports. Then, based on the elements of each validated report, an internal ticket is created and assigned to the relevant team for processing with a varying degree of priority.

Do you consider Bug Bounty as a sign of confidence towards the market?

Using a public Bug Bounty program, we can demonstrate and highlight our concerns about security and transparency

. We also assume the fact of exposing ourselves to ‘controlled’ attacks, and to consider the valuable feedback from the researchers’ community.

At Deezer, we also have a team dedicated to fraud: indeed, artists and labels are paid according to the audience of the tracks. In order to guarantee their income, we have to protect them from any fraud relating to the platform. So, this is a crucial part of our cybersecurity strategy – and within the scope of our Bug Bounty program.

For the time being, we are pursuing our current strategy, regularly reviving the program when activity is declining. Generally speaking, the amount of feedback often depends on how visible Deezer is in the news. When we communicate more or launch campaigns, researchers are attracted to our program.

As a next step, we will consider an increase in bounties to encourage researchers to find more complex vulnerabilities.

Do you have any advice for CISOs or startups considering Bug Bounty?

As a general rule, it’s better to know your security flaws when you start a project, rather than wait until there are too many to deal with, after you’ve made (bad) choices of architectures.

When I see what our Bug Bounty program brought us, I think it would have been better if we had taken these insights into account as early as possible.

So, I would recommend not waiting too long to implement tools such as Bug Bounty

, in order to minimize the dependency on legacy systems, which are more complex to secure afterward.

If you want more information about Bug Bounty & YesWeHack,

Founded in 2013, YesWeHack is the #1 European Bug Bounty & VDP Platform.

YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cyber-security experts (ethical hackers) across 120 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs, public programs and vulnerability disclosure policies (VDP) for hundreds of organisations worldwide in compliance with the strictest European regulations.

Deezer protects their artists & users with a public Bug Bounty program

Alain Tiemblo, Web Security Lead Engineer,

We used to rely on ‘traditional’ audits, such as vulnerability scans, penetration testing, and code analysis, which exposed a lot of threats. Then, we began receiving messages from trolls on social networks, reporting potential vulnerabilities, without notice and without any detail.

We also received emails via customer support regarding vulnerabilities, with no precise or exploitable information. These people wanted payment before revealing more information, but in the absence of any ‘proven’ flaw, it was impossible for us to pay them.

The volume of these messages grew and grew, up to the point where we decided to take the Bug Bounty step, in order to channel this flow of noisy reports.

We compared different Bug Bounty platforms in Europe and 

mainly for regulatory and data sovereignty reasons.

was the number of active hunters on the platform

: it doesn’t make much sense to put money and energy into a Bug Bounty program if there isn’t a sufficient number of hunters to effectively search for vulne­rabilities.

Conversely, we integrated security.txt on our web­site to guide hunters to the YesWeHack platform, as Bug Bounty is a good way to encourage Coordinated Vulnerabilities Disclosure.

Can you describe the evolution of your program from the beginning?

We launched our private program in late 2017, with an important running-in phase. When we opened, we initially received many reports, then we gradually refined our program. For example, we defined our scopes more clearly, including the type of vulnerabilities we wanted to see reported.

From the outset, we received ‘real’ and potential critical vulnerabilities, which convinced us of the relevance of the model and the effectiveness of the platform.

After one week, the number of reports began to decrease, but the ones that came up were more and more interesting. This is because the hunters ‘got into’ our product and produced reports that were really specific to our business.

After the first month, it became quieter, so we invited new hunters onto the program to introduce fresh eyes and other skills on specific aspects of our program.

The private program also allowed our teams to learn how to manage reports, classify and qualify them, and adjust the program rules.

Seven months after launching the private program, we switched to a public program. 

We were very satisfied with the quality of the interactions with the hunters during the private phase, and were therefore not worried about this transition… We just wanted more hunters on our program!

We also wanted to send a strong message to the community: anyone who finds a flaw can bring it back to us! Of course, we received more reports after the switch to a public program, but it was totally manageable.

Today, we are striving for quality reports on increasingly complex vulnerabilities that require more operating time for hunters, and more experienced hunter profiles.

In this context, we have increased the value of our rewards for critical and high vulnerabilities. The challenge is, with the support of YesWeHack, to attract researchers who find great stuff without ‘ex­ploding’ our rewards budget.

What value does Bug Bounty offer compared with traditional cybersecurity solutions, such as penetration testing?

The advantage of Bug Bounty is first of all crowdsourcing

. With an audit, you only have a couple consultants at your disposal. With Bug Bounty, we potentially have hundreds or thousands of researchers working on our program.

Then there is 365/24/7 continuity, whereas a penetration test usually takes place over a limited period of time and only offers a ‘snapshot’ at a specific moment. This continuity is critical to detect bugs as early as possible, as we update our applications very frequently.

Another key differentiator is that Bug Bounty implies an obligation of result – you pay only for what you get – while penetration testing only implies an obligation of means

This also helps us obtain security budgets internally: the rationale being that we only pay people who find exploitable vulnerabilities, rather than pay auditors to see whether they will find something, without any obligation of results.

Bug Bounty also sends a strong message to hackers. Many companies have long threatened to prosecute hackers who report vulnerabilities. As a result, there is a kind of trauma among some bug hunters who find vulnerabilities and hesitate to contact the organizations concerned, for fear of being mistreated.

With our public program, we’re sending this very strong message to the community: we want you to report flaws to us. In return, we give you a legal and secure framework, with a trusted third party between us to make sure everything goes well.

Ultimately, we want hunters to think, ‘I found a vulnerability on BlaBlaCar, I can be rewarded for this work legally and without taking any risks’. Rather than some people ending up selling the vulnerabilities on the black market…

How do you manage bug reports internally?

The security team is in charge of handling bug reports. They provide an initial qualification, in order to set the severity of the bug, and determine whether it requires immediate attention or not. If the flaw is complex, we discuss it with our team.

Once the vulnerability has been qualified internally, the relevant dev team is notified using a ticketing system provided by the YesWeHack platform.

This ticketing system enables us to monitor the progress of the teams in their patching process and to respond to them if needed.

We then move on to check the fix with the hunter. It’s often a formality because we’ve usually checked ourselves, but it’s always interesting to have an outside eye. We sometimes have surprises: the hunter might tell us it’s not fixed correctly, for instance!

Have you observed any changes to your teams since you began using Bug Bounty?

The security aspect is much more important now. In our internal training, we no longer talk about potential flaws, but we show concrete cases – flaws that have been brought to our attention as part of our program. This has a much greater impact.

How does Bug Bounty fit into your agile approach?

Bug Bounty is integrated into each team workflow via a ticketing system. The idea being that security breaches are tasks just like any other, which we assign to each team concerned with the right degree of priority.

As we deliver continuously, the ability to extend our program scope in one click, and to detect things quickly on these new scopes, also makes us more agile. As soon as an application is updated, we can have it tested, take the results into account, and easily set up a feedback loop.

We will fine-tune our program to continuously improve the quality of our reports and attract better hunters.

If you wish to learn more regarding our platform and service, please do not hesitate to 

BlaBlaCar leverages crowdsourced security to secure its millions of users’ data

YESWEHACK PROPHILE ON EBODA

I am the Group CISO of a multinational insurance firm. My team’s mission is to set up a “cyber shield” for the Group and all its subsidiaries, by offering new security services to our subsidiaries – including 

I discovered Bug Bounty following discussions with CISOs from major financial institutions. Having a recommendation from organizations like these with demanding security needs was a key factor in my decision. We started small and the results were conclusive, so we gradually opened several Bug Bounty programs. It’s a new approach, which implies a learning curve.

Bug Bounty offers the guarantee of continuous checking

 – and not just punctual testing, which is what you get with ‘traditional’ penetration testing. If I run a two-week penetra­tion test every year, it implies that we remain ‘unprotected’ for the other 50 weeks, which is no longer acceptable. As a comple­ment, automated tests can also be useful, but are not sophisticated enough. With Bug Bounty, I have researchers working permanently on my scopes.

This continuity is essential, especially when you have frequent deliveries in an increasingly agile development context.

Bug Bounty also allows us to be more flexible.

 For example, I need to test environments which are still in development, or in validation phase, before going into production. Again, this is challenging to do consistently using traditional penetration testing. The 

 platform enables us to adjust the rules for each program, including the bounty grid, accor­ding to the specific phase of each project.

I would also mention responsiveness and availability: it is increasingly difficult, if not impossible, to find skilled penetration testers at short notice, when you need them most, i.e. when you have a new release. 

With Bug Bounty, you just ‘press a button’, and it starts: you can run tests at any time and get confir­mation of remediation in the process very quickly.

Finally, we have been amazed by the diversity of reported vulne­rabilities. We uncover more ‘real-life’ scenarios: for example, researchers have found ‘bits’ of vulnerabilities whose combination made unprecedented attacks possible. Vulnerabilities like these were not addressed until then, as they were not brought to our attention. We are now able to correct them in depth.

Bug Bounty really puts yourself in the head of a hacker.

Does Bug Bounty mean the end of penetration testing, or are the two complementary?

For me it is complementary. The reality however is that there are too few audit firms to keep pace with the number of testing that must be carried out. Hence the key value of Bug Bounty. Moreover, 

penetration testing shows various limitations and constraints: they must be scheduled in advance, with a start and end date, and they demand project manage­ment.

 This synchronization is a real headache, especially with agile developments. If a delivery is two days late on a given scope, the pentesters are no longer available, which poses a real stewardship problem.

What I also like about Bug Bounty is the 

. With traditional penetration testing, you almost never receive a remediation check. Following an audit, if a developer tells me, ‘I fixed the bug’, I only have his word. Bug Bounty allows me to delegate this control to the researcher, who is entirely objective.

This enables me to fix a vulnerability and validate the correction in the process – unlike a traditional cross-verification, which I should run once all my vulnerabilities have been addressed. Now, when a serious or critical vulnerability is discovered, I know it is fixed quickly, and I can sleep soundly! 

Have you seen any other changes since you started the Bug Bounty program?

There is certainly more awareness now, but the major point I’m observing is the 

acceleration of the patching rate / frequency

. Our developers fix much faster. Responding to researchers, rewarding them, closing reports, etc. require developers to react more qui­ckly. This, in turn, leads to much shorter time-to-remedia­tion.

As mentioned earlier, we have implemented speci­fic programs dedicated to test environments, before their release. We therefore detect and fix vulnerabi­lities further upstream of projects. Firstly, this allows us to train our developers ‘on the fly’; second, it accelerates our deliveries since there are fewer patches to manage in the validation and release phases.

We became more responsive, in the interests of both developers and business.

Our first step is to gradually expand the Group’s assets under Bug Bounty. And on these scopes, to gradually move from black box to grey box.

The second step, where we are now, is to make the ser­vice available to our subsidiaries worldwide. We want to offer them something different and forward-thinking, allowing them to renew their vision of cybersecurity and audits.

Bug Bounty’s strengths compared to penetration testing

organises bug bounty programmes to disclose and correct vulnerabilities before malicious tools get in. A year after joining the Paris Call, we look back at how have we contributed to furthering peace in the cyberspace.

On 12 November 2018, hundreds of partners gathered to launch the 

Paris Call for Trust and Security in the Cyberspace

. The Paris Peace Forum kicked off on 12 November 2019, to continue building upon the Call and showcase peaceful global governance from the world over.

YesWeHack is Europe’s bug bounty leader and a first-hour Paris Call signatory. 

 bridges the gap between discoverers and vendors, thus structuring a Coordinated Vulnerability Disclosure (CVD) process and clarifying benefits for all. Bug bounty is , therefore, an accessible legal and value-generating framework preventing state and non-state actors from stockpiling vulnerabilities.

Furthermore, by enabling actual CVD, bug bounty is a viable economic alternative to vulnerability-oriented black markets. Our active contribution to decreasing the proliferation of malicious uses of digital products is thus twofold.

Protecting NGOs and civic-tech initiatives

YesWeHack promotes proactive vulnerability disclosure by providing bug bounty programmes for NGOs and civic tech initiatives, forebears of democratic values. Those programmes unfold during the 

International Forum for Cybersecurity (FIC)

 held yearly in Lille, France. More specifically, YesWeHack provides the full operational power of its ethical hackers’ community and ensures that researchers get an adequate reward for reporting vulnerabilities to the participating NGOs.

For its 2019 edition, “le FIC”, as it is known amongst its French-speaking community, hosted a two-day long bug bounty we organised. 

 benefited from our hunters’ skills: HelloAsso, iRaiser, Croix Rouge, CapCollectif, OpenStreetMap and Destination Rennes. Its 2020 edition will witness again YesWeHack’s recurrent effort to improve the security of NGOs’ infrastructures. The 2020 edition is coming up end of January, and we are currently convening NGOs to join (so, watch this space for more!).

Coordinated Vulnerability Disclosure, a sustainable way to root malware out

A CVD process aims at reducing risk and ultimately mitigating the potential damage caused by a security vulnerability. Even though patch deployment or report publication are indicators of efficient cooperation between vulnerability discoverers and the affected service editors, the CVD process cannot be reduced to any of those events alone.

The YesWeHack Blog

DOJO CHALLENGE #4 Winners!

Showcasing your vulnerability disclosure policy to the world

Deezer protects their artists & users with a public Bug Bounty program

DOJO CHALLENGE #4 Winners!

BlaBlaCar leverages crowdsourced security to secure its millions of users’ data

YESWEHACK PROPHILE ON EBODA

Bug Bounty’s strengths compared to penetration testing

BlaBlaCar leverages crowdsourced security to secure its millions of users’ data

Fighting malware at the roots

YesWeHack EDU, the world’s first Bug Bounty educational platform

Bug bounty is significantly more cost-effective than penetration testing

Fighting malware at the roots

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us