We have recently been questioned on how our

works and how report quality is evaluated.

Our system has evolved quite a lot since inception, and some new report quality rating features have been added.
Updated in Feb. 2021

 of a bug report life cycle is being ( hopefully ) accepted as valid by the 

, otherwise it is classified as invalid and receives an additional qualification that 

 can lead to a negative rating, as illustrated below:

Note that a valid report can be triaged again as ” Informative ” or ” Won’t Fix ” after validation and before being accepted.

Now that your shiny report has been accepted by the program owner, congratulations, you are now eligible for a reward.
But how are your ranking points calculated exactly?

Depending on the bounty your report matches regarding the reward grid, 

you will be rewarded with ranking points :From 5 to 50 points
More informations here : 

 can also reward the quality of your report and attribute 

You get 7 additional points for a resolved bug, a big 

Finally we’ve stitched it all inside a single graph for your convenience.

You can refer to our leader-board to discover the hunters top 100

A quick update on our ranking point system

The goal of the challenge was to find an XSS vulnerability on a minimalist website.

It was composed of 3 steps of increasing difficulty in the form of extra security layer. All the payload are tested with Chrome 75.

Let’s take a look at how the website work.
This is a simple gallery.

When we click on the differents link, a picture is shown.

The code is quite simple, when we click one of the link, the url hash will change, the event will be catched and the displayDrawing function is called.
This function take the hash and forward it to ./loader inside the key parameter.
The result is displayed in an iframe on the page.

Let’s try to understand how the loader work by looking at the html code.

There is a script loaded on line 6 as a base64 

The src part correspond to the base64 part of our key parameter, and the accessKey to the hash.

This config object is then used line 37 to create a new script that will render the picture.

If we try to alter the base64 or the hash, the loader page will return a 403 forbiden error. We need to find something else if we want to find an xss.

One weird thing about the loader page is the comment line 31 “DEBUG = False”. If we send a new query with an etre GET parameter debug set to true, the output of the page change a bit.

When the debug flag is set to True all the get paramters are reflected inside a comment.

With this information, we can now send a new paramter that will close the comment and add a script that will call alert(document.domain)

Our payload is reflected the js code is evaluated.

If we try to submit our first payload to the second level this is what we got:

This time, the values of our GET parameters are properly escaped. But the value is not the only thing reflected on the page, the name of the get parameter are reflected too.

We can try to put our exploit in the name instead of the value.

This way, our payload is not escaped and should trigger an alert. But nothing is happening

If we look at the js console we can see this message:

The XSS Auditor refused to execute a script in ‘

http://54.254.225.32:4242/medium/loader?key=L3N0YXRpYy9oZWFydC5qcw==.d635f5480983ee9eb49a2f9cbc010141cf2b7899&debug=true&–%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C!–=a

‘ because its source code was found within the request. The server sent an ‘X-XSS-Protection’ header requesting this behavior.

, a security feature of chrome has detected our attack attempt and blocked it.

XSS-auditor works by comparing the content of every query parameter with the content of the page, and it will block javascript execution if an XSS attempt is detected.

We can trick XSS-auditor, by spliting our payload into multiple parameters.

This is enough to trick auditor and the script is now executed.

Once again, let’s start by trying our last payload again.

The payload is injected, auditor is bypassed, but no alert.

In the js console we can see this message:

Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘nonce-nsWXKD8JXLV96kt1BQxBSw==’ ‘strict-dynamic'”. Either the ‘unsafe-inline’ keyword, a hash (‘sha256-8NbgAp0jfVRkKxwOjGfcHVoY6pt6APb/HnKwjq5wl/c=’), or a nonce (‘nonce-…’) is required to enable inline execution.

This is due to the fact that this time, a Content-Security-Policy is returned with the page. According to 

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to distribution of malware.

The script-src set by the challenge is the following:

script-src ‘nonce-3HIMjHg5/Rnuemec/NsDzQ==’ ‘strict-dynamic’;

If we want to inject some script we will need to guess the nonce, which is not possible. But we can abuse the ‘strict-dynamic’. If a script is trusted (has the right nonce), it’s trust shall be propagated to all the scripts loaded by that root script.

Because a script is created line 36-37, if we can control the config object, we will be able to execute code.

First we need a way to define a JS global variable without using JS. According to the 

, we can create a global variable by creating a html element with an id set to config.

Let’s test this with a small html page.

But if we create the same <img> on the victime website, it’s not working. That’s because a config object is already created and has priority over the id.

In step2, we had trouble executing our payload because XSS-auditor was blocking the line with the XSS.
We can abuse this feature, if we submit a parameter that look like the top configuration script, XSS-auditor will block it.

Now that we can block the config and inject a new one, we should be able to exploit the final level.

I want to thanks Alibaba for organizing this wonderfull event, and all the people for participating.

I’m looking forward for the next event !

YesWeHack & Alibaba Security Meetup challenge solution

Did you ever have the chance to win a pure gold medal ?


THIS IS HAPPENING : Join us next week, on the 18th of June, at the Alibaba Security Meetup-hacker Community Event organized by 

 will gives the solution and shares tips and tricks about how to find a vulnerability.

Learn about the vulnerabilities of lock and locking devices

18:00-18:30 Ice breaking game & Dinner & networking

18:30-19:40 Hacking game & Pick a lock game

19:50-20:00 Award ceremony for hacking game

20:30-21:00 Gives the solution to the hacking game and shares tips and tricks about how to find a vulnerability

Do you think XSS is “low hanging fruit” ?
So just exploit it on the website provided during the event and call alert(document.domain).

There are 3 levels of increasing difficulty each one is worth 100pts, and they are real XSS discovered on bug bounty…
For each step submit your payload to 



All your payloads will be tested on a default installation of Chrome 75
At the end of the timer, the one with the most points will be declared the winner.

If two players have the same score, the first one to reach the score will be declared the winner.

This is an XSS challenge, no need to brute force or automated tools.
This is NOT a cryptography challenge.
Your solution for each step will be a single link.
Just bring your laptop and chrome75 installed

Alibaba Security Meetup is a security event hosted by Lazada and ASRC.
The goal of these meet-ups is to build a strong “security community” within the South East Asia.
By becoming a member of such a community, you will get to:

 about the new trends within the Information Security domain.

 and relish food and drinks while networking with your peers in the domain of information security.
The goal of these meet-ups is to build a strong “security community” within the South East Asia. By becoming a member of such a community, you will get to

For more details about ASRC Vulnerability Rewards Program, please visit:


Catch the flag, catch the (real!) gold

 is a premier techno-centric cybersecurity event, bringing together top cybersecurity leaders from both the East and the West to share deep-technical insights, and build the next-generation cybersecurity capabilities around the globe.

at booth 5N7-01 to learn how you can make cybersecurity an accelerator of your digital transformation with

Get a product demo, meet our team, grab your loot and break the codes

You want to challenge your skills and get reward?

The CTF competition is open to all conference ticket holders and visitors to play, enjoy and compete. Participants simply have to come at the 

 booth, in front of the CTF area, 5N7-01, or directly to the CTF Area.

The CTF will have multiple categories of challenges and different levels from beginner to advanced… But only the best will get the prizes :

 will give SGD 1000 in cash (1st $500, 2snd $300, 3rd $200)
HITB will give one ticket to attend 

 (27-31 August 19) – value of 1,199 USD

CTF sponsored and created by YesWeHack
Prizes by HITB and Centurion Information Security

Let’s break stuff together Singapore: YesWeHack is coming up with a brand new CTF at Infosec in the City!

EU Parliament adopted the Cybersecurity Act

. The latter aims to strengthen the role of the European Agency for Network and Information Security (ENISA) and introduces a common certification framework for ICT products (Hardware, Software and Services).

Before this, in 2018, the European Commission advocated the creation of a network of Cybersecurity expertise centers to reinforce research and the deployment of new capabilities in the European Union.

The European Commission has pushed to invest more than €2 billion to reinforce cybersecurity in the Digital Europe Program along with the H2020 Program, with €63.5 million invested in four pilot projects.

One of the four funded projects is called 

, bringing together 44 partners. As a SPARTA partner, 

 asserts its role in advocating operational 

In March 2018, YesWeHack CEO Guillaume Vassault-Houlière and Romain Lecoeuvre (CTO) contributed to the ground-breaking 

​report on Software Vulnerability Disclosure processes in Europe

 experts including Lorenzo Pupillo, Afonso Ferreira and Gianluca Varisco.

As a result, only the Netherlands, followed closely by France, have a decent national CVD policy. Needless to say, a huge amount of work remains to be done in this field.

 – included Vulnerability Disclosure in its revised legislative framework. ( Source > 

 (CVD) is incentivized and framed by the 

Full version of the EU Cyber Security Act

Firstly, we are struck by the long list of paragraphs preceded by the opening phrase “

However, these introductory paragraphs have no legal value and only serve as a guide for the interpretation of the text.

We have spotted an interesting number of paragraphs in this list.

’s mandate, to establish its role in the changed cybersecurity ecosystem and to ensure that it contributes effectively to the Union’s response to cybersecurity challenges” …” as recognized during the evaluation of 

, the current mandate is not sufficient.”

: “It (ENISA) should promote the exchange of best practices between Member States and private stakeholders, offer policy suggestions to the Commission and the Member States, act as a reference point for Union sectoral policy initiatives with regard to cybersecurity matters, and foster operational cooperation, both between Member States and between the Member States and Union institutions, bodies, office and agencies.”

: “ENISA should actively support national efforts and should proactively contribute to Union efforts while carrying out its tasks in full cooperation with the Union institutions, bodies, offices and agencies and with the Member States, avoiding any duplication of work and promoting synergy. In addition, ENISA should build on input from and cooperation with the private sector as well as other relevant stakeholders.”

These three paragraphs underline the importance of 

‘s duty to strengthen cooperation between actors and thus help democratize the Coordinated Vulnerability Disclosure policy, and other policies, as well as its related standards to all Member States.

: “With a view to stimulating cooperation between the public and private sector and within the private sector, in particular to support the protection of the critical infrastructures, ENISA should support information sharing within and among sectors”.

: “Coordinated vulnerability disclosure specifies a structured process of cooperation in which vulnerabilities are reported to the owner of the information system, allowing the organization the opportunity to diagnose and remedy the vulnerability before detailed vulnerability information is disclosed to third parties or to the public. The process also provides for coordination between the finder and the organization as regards the publication of those vulnerabilities. Coordinated vulnerability disclosure policies could play an important role in Member States’ efforts to enhance Cybersecurity.”

: “In that context ENISA should involve the private sector within the framework of Directive (EU) 2016/1148 which lays down the grounds for the voluntary exchange of technical information at the operational level, in the computer security incident response teams network (‘CSIRTs network’) created by that Directive.”

s, the private sector and researchers is crucial for establishing CVD policies and achieving Member States’ goals of strengthening their Cybersecurity. In this respect, 

Maturity Evaluation Methodology for CSIRTs

In terms of legal content, the following four articles deal specifically with 

ENISA shall assist Member States and Union institutions, bodies, offices and agencies in establishing and implementing vulnerability disclosure policies on a voluntary basis

ENISA’s role is clear in this field. Although ENISA is not supposed to force Member States to adopt CVD policies, its role is clearly that of a CVD enabler.

Elements of European cybersecurity certification schemes

Rules concerning how previously undetected Cybersecurity vulnerabilities in ICT products, ICT services and ICT processes are to be reported and dealt with.

EU CYBERSECURITY ACT · ARTICLE 54 (1) (m)

The European cybersecurity certification scheme shall comply with mandatory criteria including the above which relates to Coordinated Vulnerability Disclosure.

Website on European cybersecurity certification schemes

1. ENISA shall maintain a dedicated website providing information on, and publicizing, European cybersecurity certification schemes, European cybersecurity certificates and EU statements of conformity, including information with regard to European cybersecurity certification schemes which are no longer valid, to withdrawn and expired European cybersecurity certificates and EU statements of conformity, and to the repository of links to cybersecurity information provided in accordance with Article 55.

2. Where applicable, the website referred to in paragraph 1 shall also indicate the national cybersecurity certification schemes that have been replaced by a European cybersecurity certification scheme.

This announces that ENISA’s Website would provide real time monitoring and/or index CVD initiatives.

Supplementary cybersecurity information for certified ICT products, ICT services and ICT processes

Contact information of the manufacturer or provider and accepted methods for receiving vulnerability information from end users and security researchers.

EU CYBERSECURITY ACT · ARTICLE 55 (1) (c)

Globally speaking, the new framework requires manufacturers and publishers to provide a – 

 – communication channel which allows users and researchers to report vulnerabilities.

 are likely to be supported and promoted by this new framework.

 is definitely the orchestrator of this Cybersecurity Act and the best players are required to ensure its success: 

The Cybersecurity Act: Strengthening coordinated vulnerability disclosure at the European level

platform – has announced that it is opening an office in Singapore. The new office is part of

’s fast-growth strategy for its international activities following a €4 million fundraising at the start of the year.

YesWeHack is consolidating its global positioning in a sector that will transform the cybersecurity industry over the next five years.

 has been appointed Managing Director APAC to develop YesWeHack’s strategy in Asia. Having spent more than ten years in the region, he knows the Asian cybersecurity market inside out, having notably participated in 

Aside from his recognized cyber expertise and own entrepreneurial experience, he also brings along his 

ethical hacker community from which all the co-founders of YesWeHack hail.

The Singapore government has made cybersecurity one 

of the priorities of its defence strategy.

 It launched its first bug bounty programs in 2018, with the aim of 

“building a smart, safe and resilient nation”

. This initiative has helped “educate” the regional market on bug bounty and its value.

Asian firms are quite advanced in their digital transformation and are open to

disruptive approaches that enable them to strengthen security

while also accelerating this transformation.

YesWeHack has already launched programs with major organisations in the region.

and the quality of our services, and show that

YesWeHack is now a key player in the region

YesWeHack’s differentiating advantage include its reputation and 

: major Asian organisations are highly sensitive to ensuring that 

the sovereignty of their operations and their data confidentiality are respected

 – guarantees that North American platforms cannot provide.

With a global community of ethical hackers and this new step in its international development, 

YesWeHack is consolidating its position as the ONLY alternative platform to the major US market players.

YesWeHack is the #1 European Bug Bounty & VDP Platform

YesWeHack offers companies an innovative approach to cybersecurity with 

 (pay-per-vulnerability discovered), connecting tens of thousands cyber-security experts (ethical hackers) across 120 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs, public programs and vulnerability disclosure policies (VDP) for hundreds of organisations worldwide in compliance with the strictest European regulations.

YesWeHack – Europe’s leading Bug Bounty platform – is opening an office in Singapore

Today we are proud to release the version 1.0.0 of our BurpSuite extension.

This will allow you to access all the programs details from 

. But also instantly configure the scopes and the required headers according to the program rules. No more copy pasting between the website and your favorite tool!

Download Jython 2.7.0 Standalone Jar from https://www.jython.org/downloads.html

In Python Environment, set the location of the standalone jar to the previouly downloaded one

The addon is now installed, a new tab named YesWeHack should appear

The configuration options are available in the tab 

To take full advantage of this tool, we recommend that you create an account on 

New YesWeHack Api Extension for Burp

This challenge was created for BSidesDublin 2019, the goal was to
trigger an alert using an 

https://bsides2019dublin.h4cktheplanet.com/

Nobody was able to solve it during the event so we decided to keep it online for an extra week to let you play with it.

3 persons managed to solve it during this extra time:

When you submit an username some checks are made and a message tells you if the submitted username is l33t or not.

Let’s take a look at the JavaScript code.

There are 3 different assignments of element.innerHTML in these functions:

If we manage to control one of those we should be able to trigger our XSS. But how can we reach them ?

The code looks at location.search and tries to extract the name parameter. (l4-5)
If the parameter is set then it will start a chain of promise ending with success or fail depending if the promises throw or not. (l34-28)

The success function takes the HTML element with id template and adds it as HTML to the div with id result.

There is no user supplied data, so it’s probably not vulnerable.


The fail function takes an error and display it in the DOM, it uses an insecure innerHTML but all the throw parameters are constant strings, so it should not be vulnerable.

The hello function takes a name as an argument and displays it as HTML. This is clearly vulnerable if we can control the name content.

To reach the hello function you need to pass through check_name without a throw.

Our name is passed through multiple checks preventing you from using the following:

name shorter than 1 or longer than 1337 characters.

onevent= where event can be any ASCII letter combination.

name containing or & (used by XeR to bypass some part of the challenge)

This looks quite secure as we need at least a tag and an event to create our XSS, but there is a catch. hello doesn’t add name to the HTML but name.capitalize().

capitalize change the first char of a string to uppercase and the following to lowercase.
If we find some characters that are not ASCII but become ASCII when transformed to lowercase we should be able to inject some HTML.

If we input <K>test</K> as an username we can see our DOM looking like this:

Perfect, we bypassed the HTML tag filter, but is there any event using a k in its name we can use with this tag ? All the events with k in it require some kind of user interaction: onkeyup, onkeydown, onclick ... That means we need to dig more.

We may not be able to inject JavaScript but we can inject some 

. Remember the success function ? It was copying the content of $("#template") to $("#result") with $ = document.querySelector.

When you use querySelector the first tag matching the selector is returned. That means: if we submit ?name=<K id=template>test</K> our tag will be inserted inside #hello which is before the real template and therefore will be returned by querySelector.

To reach the success function we need to go through all promises,

We already looked at check_name and hello, the delay_progress is just displaying some progress bar and forward the name to checkL33tFactor

checkL33tFactor is a simple function, it takes our name and converts it to a value using some kind of hashing function and makes sure the hash is equal to 1337 if not, it throws.

The hashing function can be rewritten like this:

A simple way to pass this test is to implement the following l33tify function.

The YesWeHack Blog

A quick update on our ranking point system

YesWeHack & Alibaba Security Meetup challenge solution

Catch the flag, catch the (real!) gold

A quick update on our ranking point system

Let’s break stuff together Singapore: YesWeHack is coming up with a brand new CTF at Infosec in the City!

The Cybersecurity Act: Strengthening coordinated vulnerability disclosure at the European level

YesWeHack – Europe’s leading Bug Bounty platform – is opening an office in Singapore

Let’s break stuff together Singapore: YesWeHack is coming up with a brand new CTF at Infosec in the City!

New YesWeHack Api Extension for Burp

Solution for “A Weird XSS Case”

New features for quicker and improved Bug Reporting!

New YesWeHack Api Extension for Burp

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us