A deep understanding of his targets lies at the heart of Sn0rkY’s approach to Bug Bounty hunting.
In this interview, the experienced French hunter looks back on how he got into cybersecurity, explains his methodology and shares advice for up-and-coming hackers. He also discusses his views on AI tooling and what he values most about the YesWeHack platform.
Sn0rkY, aka Joffrey Czarny, began hunting on YesWeHack Bug Bounty programs more than a decade ago, when the platform was still known as BountyFactory.io. Since then, he has delivered Arsenal sessions at Black Hat and currently combines bug hunting with a cyber position based in Singapore.
How did you get into cybersecurity?
I come from a small village in France where the internet was not necessarily easy to get and really expensive at this time. So I needed to find a way to reach the internet, and that’s how I started to be more focused on security.
What are your favourite hacking tools?
I’m not the kind of person to rely on tooling, especially for Bug Bounty. Nowadays, there are a lot of hunters that automate plenty of attacks. They report – I apologise – but really dummy bugs, and this is not what I’m looking for. I think we have more added value to provide with Bug Bounty.
I spend really a lot of time – maybe several months from time to time on some programs – to go really deep, to understand the technologies they used. I build my own labs with some services they used. And that’s how I approach Bug Bounty. So there are tools, but the main tool you have to use is your own knowledge and curiosity.
What skills do you feel you need to learn to stay relevant as technologies evolve?
Of course we have to [build] knowledge and keep pushing, because the area where we work is really changing and evolving. But for me, there is not necessarily a plan to say: “OK, I need to be an expert in this area in the next five or two years.
So there are these AI capabilities where people say, “you have to be an expert in AI” and so on. So I don’t want to do that. I will play with this new technology – the AI as a tool – but I don’t necessarily plan to be an expert.
What do you like most about YesWeHack?
What I like most in YesWeHack is definitely the triage. We have really good communication with the program manager, or people who are behind the screen to do the triage.
And also the fact that I play with some programs, and YesWeHack reach out to me to understand why I did this kind of test. So that’s quite unique, I didn’t get that for some other platforms.
I was surprised initially when people reached out to me. I say: “woah, they tried to contact me for that?” But in the end, it was good to say “oh, people look at what’s going on, to try to be more secure than just having a program and just ticking the box.
What is your top tip for new or inexperienced hackers?
Don’t try to jump from program to program if you don’t find a bug quickly – it’s a really big mistake.
Or don’t try to use like a simple tool and just run the scanner and say: “OK, I will spot the bugs and I will get rewards like that”. No.
My advice is really: try to first understand how things work, and when you know how things work, you will be able to find quite interesting bugs, logic bugs… Not necessarily something obvious. That’s my main advice.
Interested in emulating Sn0rkY? Register as a hunter on YesWeHack, sharpen your hacking skills on Dojo, or learn about the latest hacking tools and hacking techniques on our blog.
