, the global Bug Bounty & VDP platform, organised a Live Bug Bounty during the 

, held in Lille, France. This year, it was 

‘s — the giant sports and entertainment retailer — turn, with its Technology team, to participate in these two days of intensive hacking!

Operating in over 70 countries, addressing the needs of 500 million users of its products and services and with a community of over 100 million members, 

 is a major digital player with high visibility and exposure to cyber risks.

Decathlon’s cybersecurity teams deploy numerous resources and tools to ensure the security of the company’s activities in the 70 countries in which it operates. Among the actions carried out by the company’s cybersecurity teams in order to remain at the cutting edge of innovations, 

Decathlon has been in a private Bug Bounty program for a year on the

“Bug Bounty is challenging and engaging for us. When researchers detect a vulnerability, they submit a report. And when this vulnerability is critical, we set a deadline to fix it. This reactivity is essential in our commitment to security. It allows us to maintain the high level of requirements that characterises us at Decathlon, and keeps both the bug hunters, and our teams, motivated

, Information Security Manager at Decathlon.

With their participation in this Live Bug Bounty, Decathlon has gone one step ahead in its efforts to collaborate with ethical hackers.

For corporate security teams, it’s a unique and invaluable opportunity to discuss their findings with researchers, and better understand security bugs. For hackers, it’s an easy way to ask live questions to program managers and YesWeHack’s teams to get more information about the programs and thus go even further in their research. Furthermore, researchers may collaborate with each other to pool their skills and expertise and thus go further in the hunt for new vulnerabilities and exploitation.

“This is the first time that we are embarking on a Live Bug Bounty. It allows us to meet the hunters, to discuss with them, and then, to go further in the search for vulnerabilities.”

During these two days, the Decathlon teams offered exclusive scopes to the researchers attending the event. They wanted to test the robustness of their “OneShop” solution; it is an E-Commerce solution, based on PrestaShop, used by about thirty countries in the world (

Moreover, in order to test the E-Commerce platform from end to end, Decathlon Technology also wished to include its authentication solution called “Login” and its loyalty solution called “Account” in the scope of the test.

Decathlon Technology’s technical teams were on hand to ensure the rapid assessment and remediation of the reports submitted by the hunters. And what speed! The team had an average response time of only 1 hour 06 minutes during the event 👏

The Live Bug Bounty started on Wednesday 08 June at 10:00. A few dozen hunters were present at the booth and were eagerly awaiting the launch of the program. The Live Bug Bounty was also open to participants of the 

, an ethical hacking competition using eSport codes dedicated to students!

The first submission (aka “first blood”) was submitted by 

, only 1 hour after the start of the event! 

 then quickly took the lead, thanks to several IDOR (Insecure Direct Object Reference) discovered on the scope, followed closely by Zax and Effrite.

As the day progressed, the rankings changed with several reports from the hunter 

After 30 hours of Live Bug Bounty, the overnight research efforts of the BZHunt team (

) finally paid off. The hacktivity revealed a RCE (Remote Code Execution) as well as an SQL injection and some other vulnerabilities, reported by Zax. This allowed him to take the lead and keep it until the end of the event.

And here is the podium of the Decathlon Live Bug Bounty:

“I really enjoy participating in live Bug Bounty events, it’s really great to meet the community as well as the program managers! During these 30 hours, it was possible to interact with the Decathlon team, who came in numbers. Being able to talk directly with the Decathlon teams allows us to show our PoCs, to have real-time feedback and therefore to go even further in the impact.

As for my team, BZHunt, we are exhausted but delighted. We pushed on until the last few minutes of the event and managed to grab the lead on the podium, carefully held by Hisxo throughout the event. A big thank you to YesWeHack for this great organisation!”

A successful first experience for Decathlon

“After just over a year in private Bug Bounty program, we wanted to reach a new level by running a Live Bug Bounty. Despite some apprehension due to the fact that we were going to test the robustness of one of our E-Commerce platforms with real conditions on the production environment, the event was a great experience for us and a real success on all fronts:

✅ There were no disruptions to the production (the hunters took into consideration the rules of the program which forbade carrying out tests that could cause possible service interruptions)

✅ The allocated reward budget was respected and we were able to pay all the hunters during the event

✅ Our on-site teams did a remarkable job, notably with the qualification of the 64 reports submitted by the hunters before the end of the event and with an average response time of only 1 hour 06 minutes

✅ Our mobilised teams accepted 27 reports, including 3 critical reports, and the first patches were being built even before the end of the event and are currently being deployed throughout the affected area

✅ The proximity with the hunter community was very much appreciated, as it allowed for smoother interactions and the opportunity to be confronted with new approaches to security

In addition, our communications teams enjoyed co-organising the event in partnership with YesWeHack and the result highlighted both our companies through this action.”

The next Live Bug Bounty organised by YesWeHack will take place at 

 Paris, on June 24th and 25th 2022! Be ready, it’s going to be intense! More info 

.
Fancy a ticket to leHACK? We might have a few left! Send us an email.

Founded in 2015, YesWeHack is a Global Bug Bounty & VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with bug bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices. YesWeHack runs private and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

In addition to the Bug Bounty platform, YesWeHack also offers support in creating a 

), a learning platform for ethical hackers called 

 and a training platform for educational institutions, 

Over the past decade, Decathlon has engaged in a strong acceleration of the digital transformation to address new technological challenges and consumption patterns. With more than 3,000 engineers in 67 countries, Decathlon relies on the most innovative technologies, the company works with and develops tools, systems and experiences that help people around the world access the pleasures and benefits of sport. Decathlon, the leading company in the sports market, combines two activities: the creation of innovative sports products and services, and their distribution online and in stores.

With 324 points of sales in France and more than 1,700 worldwide, Decathlon and its 97,000 employees have been working since 1976 to achieve its permanent ambition: to innovate in all areas in order to remain the main partner for the many. With 300 recruitments in 2021 and 420 positions open for 2022, Decathlon Technology continues its development and expands its teams in major metropolitan cities such as Paris, Lille, Nantes and Lyon. Decathlon Technology has more than 1,200 employees based in France and is deploying an ecosystem of 3,000 people around the world (Europe, China, India, Brazil) with tech skills to serve the digitalization of the Decathlon Group. 

Software engineers, product managers, data scientists, machine learning ops engineers…

 These cutting-edge skills and expertise are mobilized across all of Decathlon’s business lines, from design to retail and to the supply chain. These tech and digital skills enable us to address the needs of the 500 million users of Decathlon products and services, as well as the Decathlon community of over 100 million members.

Want to discuss crowdsourced security with our experts?

Back to Decathlon’s Live Bug Bounty

 was a special edition for “LeHack” and consisted in bypassing the simulated WAF in order to execute JavaScript and obtain the secret password.

 You want to create your own DOJO and publish it? Send us a message on 

We are glad to announce the #17 DOJO Challenge winners list.

The best writeups reports were submitted by: 

DrLNO, Hiboukibou, Kubolos231, Sh33my and Spawnzii 

 feeds to be notified of the upcoming challenges.

Read on to find the best write-up as well as the challenge author’s recommendations.

We asked you to produce a qualified write-up report explaining the logic allowing such exploitation. This write-up serves two purposes:

Determine the contestant ability to properly describe a vulnerability and its vectors inside a professionally redacted report. This capacity gives us invaluable hints on your own, unique, talent as a bug hunter.

We received a large number of reports and all of them were detailed, well explained… However, we had to make a selection of the best ones. These challenges allow to see that there are almost as many different solutions… as long as there is creativity 😉

pecial mention for ivarsvids and its 4 different solutions.

Thanks again for all your submissions and thanks for playing with us!

This code runs a JavaScript code inside a script that craft a “secret” variable.

Execute Javascript (XSS) and alert (popup) the value of the original variable secret.

Alert (popup) the value of the original variable secret

We see that we can change the value of the $inject variable. This variable match the value of the src atttribute of the script tag. So we can inject an external js script from it.
We write an external javascript file which contains a code to alert the secret value. We add a function to delay the alert function in order to wait the instanciation of secret value:

Then we escape the pattern :// which is replaced with __NOPE__ with &#47.

The final $inject variable look like: http:&#47;/localhost:8080/<path>/xss.js

First, we see that we can modify the $inject variable. This variable is the value of the src attribute from the script tag.
The src attribute allows to load javascript from another file, even from an external source (for example stored on an external server).
We want the secret variable which is defined after the second script tag as a const variable.
In order to achieve this, we will display it through alert (a javascript function) by exploiting a XSS vulnerability.

We create a new file on our local machine called for example xss.js so we can expose it (with a python server: python -m http.server 8080)
For the test and because it’s simplier, I create a new file, in the same repository called challxss.html which contains the html code of the challenge.
So we can now navigate to http://localhost:8080/<path>/challxss.html with a browser.
The same output as the challenge (coffee gif) is displayed.

Let’s change the src value !
Still in our local file challxss.html, we replace the $inject variable with the path of our xss.js.
The first piece of code I write in xss.js is alert(secret):

But the variable isn’t loaded yet so it is not displayed. (To be sure, we can move the script tag after the div "Coffee_Design" and see what happend. Answer: secret is displayed).
To remedy, I delay the alert function with the setTimeout function.
The modified file look like this now:

And now it works ! (on my machine)
There is still a problem, the pattern :// is replaced by __NOPE__
In order to bypass this, we can replace ‘/’ by the ‘/’ HTML Escape Characters code which is &#47;

Now instead of having http://localhost:8080/<path>/xss.js for the $inject variable, we have http:&#47;/localhost:8080/<path>/xss.js

DOJO CHALLENGE #17 Winners!

Carried out by the French Ministries of the Interior, Justice, Transformation and Public Service and by the State Secretariat for Digital Affairs, the “

” application offers an alternative to photocopies of identity documents, allowing people to send authentic and secure single-use digital identity documents.

In order to guarantee a maximum level of security, the 

’s platform researchers. The Bug Bounty program will last throughout the life of the application, allowing a permanent audit of the code by the community. The objective is to improve the security and the level of trust of the infrastructures used by 

Continuous security check in three phases

 Bug Bounty program will take place in three phases:

A first private phase starting in June 2022 will be held with about thirty ethical hackers selected by YesWeHack and France Identité.

This private phase will be progressively strengthened with the invitation of new researchers to the program.

Lastly, the app will move into a public Bug Bounty phase, where the whole community will be able to test the security of the app.

Always with the aim of ensuring transparency, 

 will gradually open up its code and make it available to as many people as possible, with the same mission of identifying any potential vulnerabilities.

YesWeHack continues to guarantee the security of essential digital assets

YesWeHack is a long-standing partner of government organisations. The platform has notably collaborated with:

 to watch a video describing the partnership between the two organisations.

Direction interministérielle du numérique

, France’s digital transformation agency – Click 

 to see their public Bug Bounty program.

 the French platform for prevention and assistance to victims of cyberattacks – Click 

 project team, for the security of the mobile contact tracing application implemented during the COVID-19 pandemic – Click 

Quebec Ministry of Cyber Security and Digital Affairs

Founded in 2015, YesWeHack is a global Bug Bounty & VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with bug bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices. YesWeHack runs private and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

, a learning platform for ethical hackers called 

The French government’s digital identity application under Bug Bounty program on YesWeHack

is launching a virtual reality game, YesWeHackVR, allowing players to get into the role of an ethical hacker of the

Have you ever dreamed of being a hacker? We’re sure you have! Well, you’re in luck because we’ve created a game just for that experience!

🕹️In its ongoing effort to make more accessible the work of ethical hackers and make it understandable to the greatest number of people, YesWeHack is now going one step further by releasing its VR game! YesWeHackVR allows participants to experience all the steps that security researchers go through when working on a Bug Bounty program.

This game was created to make everyone understand what Bug Bounty is, and how the security researchers of our platform work, identify and analyse vulnerabilities! Whether you are a student, a security professional, or even someone outside of the security industry, YesWeHackVR will introduce you the Bug Bounty universe in a playful way!

Sitting in front of your virtual PC, you will discover the Bug Bounty program you have been invited to join! 

🕵️ Once you have understood the rules and identified the scope of the program, you will have to search, analyse, exercise your brain and logic to discover potential vulnerabilities within the perimeter.

🐛 Think you’ve discovered a vulnerability? Now find the right tool to exploit it!

✉️ Once you are sure you have found a qualifying vulnerability within the scope, you will have to write the report and rate the severity of the discovered bug!

💵 Will your vulnerability be eligible for a reward? Which hunter rank will you be? Hold on, you’ll soon find out!

The official launch of the game took place during the 

, the International Cybersecurity Forum, which was held in Lille from 7 to 9 June, with 

YesWeHackVR available to try out on our booth F12

The Showroom on the 13th floor of the Campus Cyber, the new cradle of French cybersecurity, has YesWeHackVR available all year long where demos are arranged with the Campus Cyber team.

And because we absolutely want everyone to have access to it and have fun being an ethical hacker, we decided to publish our game on the 

! Click below to download it directly on the Oculus store 👇️.

We hope you will have fun playing an ethical hacker!

YesWeHackVR, an immersive hacking game

 publishes articles on exploitation techniques, tools and tips to help hunters find vulnerabilities in their reconnaissance process and hunting routine. The goal is to provide ideas and keys to attack and understand the various web technologies hunters may face on their private programs.

The world’s biggest rainforest is what we referred to when we heard the word Amazon. But since 1994 this reference started to change when Amazon as an e-commerce company was launched and took pace in 2006 when AWS (Amazon web services) as a cloud service company was started. With the increasing greed for space and authority, humans started exploiting thick covers of Amazon rain forests and on the other hand, hackers started abusing AWS S3 bucket permissions. Since we are dealing with the technological part here, let’s wear our black hats and take a deep dive into how attackers abuse S3 bucket permissions.

According to Amazon, S3 buckets are containers for objects stored in Amazon S3. You can store any number of objects in a bucket and can have up to 100 buckets in your account. To simplify it a bit, it is a pubic cloud storage resource which is similar to file folders that store objects containing data and its respective metadata. Amazon provides several features with S3 buckets few of which are versioning, Access logging, Object-level API logging, tags and encryption.

The use case for S3 can be a situation where a web application wants to share certain files and has some image dependencies. S3 can come to the rescue where it can hold all such data and provide it to users as requested and required. Also, it can be used to store data/images/profile photos of users and also other dependencies of web applications like JavaScript and CSS.

AWS S3 comes equipped with a range of permissions and access control mechanisms which if in the case overlooked by administrators and improperly implemented can act as a treasure of data for malicious hackers and bounty source for 

Misconfigured AWS S3 buckets that leave unauthorized access are thus abused by attackers to compromise the privacy of the data stored in those buckets breaching the privacy of millions of users around the world. If the case misconfigured S3 Bucket contains EC2 snapshot instances, then attackers might be able to retrieve the snapshot instance and then get security keys for the EC2 instance itself.

There Are various ways to identify S3 buckets few of which are

HTML inspection (S3 Bucket URL hardcoded in HTML of webpage)

Testing and Abusing S3 Bucket permissions

Once you have identified S3 buckets, it is time to test out permission they have and once they are identified, we can start abusing them. But what are the permissions in particular assigned to S3 buckets? Let us have a brief look at them

This permission allows reading the contents/objects of the bucket. At the object level, it allows reading the contents as well as metadata of the object. Testing this permission is really simple. The first way is to try and access it via URL. Use this as a skeleton and modify as according to your needs

This same thing can be done by using the AWS command line as well. Following is the command that can be used to list the contents

No sign request switch that we used in the above command is used to specify not to use any credential to sign the request. A bucket that allows reading its contents will spit out all the contents once requested by any of the above methods. HTML request will show output on the XML page and the command line will give a list of files.

This permission allows to create, overwrite and delete objects in a bucket. Speaking of object-level access, it allows editing of the object itself. As far as testing goes, this permission can only be tested by the AWS command-line interface, unlike reading permission where you had a chance to test it through a web browser. Following is the command that you can use and modify according to your needs

A bucket that allows unrestricted file upload will show a message that the file has been uploaded.

At bucket, level allows to read the bucket’s Access Control List and at the object level allows to read the object’s Access Control List. Read ACL can be tested with the AWS command line using the following command

Once we execute both these commands, they will output a JSON describing the ACL policies for the resource being specified.

This policy at the bucket level allows setting access control list for the bucket. At the object level, allows setting access control list for the objects. To test this, all you need to do is run the following g command :

To test for a single object, following command can be used

For this though, there is no output shown in the form of a message

This term is self explanatory which means it grants full control (

). The same goes for object-level access as well.

Finally is the most destructive one which is any authenticated AWS CLIENT. This permission allows any authenticated AWS client to access the account regardless of what type of account they are using. To test this, simply take any command from above and replace –no-sign-request with –profile [your_profile_name].

Following is an excellent open-source resource where you can test out all the permissions. Assuming that ACL and proper policies are in place, only one or few commands might show successful output. You can always set up your own S3 bucket and test out these commands as an unauthenticated user on your bucket. You can then see the output. Later you can add on policies and Access control measures on your bucket and test again with these commands.

 gives CTF like challenges where the content of each flag is entry to the next challenge so you can test out your skills in securing the cloud with these challenges.

To demonstrate the above commands, we have created an AWS bucket and configured it in a vulnerable fashion. Let us look at the above commands one by one. First, we will show you what the output will look like once we run the above commands and later, we are going to look at the vulnerable policy that we have set on our bucket and also other misconfigured buckets that might have on open public internet.

In this, when we ran command for first time, it showed error because s3 bucket blocked file uploads. Later on, we modified permission hence it allowed file uploads.

You can test out write ACP by creating your own custom Access control Policy and uploading it by running command mentioned previously.

Let us have a look at vulnerable policy we set on our bucket.

The main problem here is with the Action tag which is set to *. It means that to allow all the actions including reading write upload delete etc. This is a quick and convenient way for administrators to assign access control to the bucket but at the cost of convenience comes the security which leaves the bucket vulnerable. To mitigate this, administrators should set each and every permission/Action manually as per requirement and configure the bucket properly such that public access is blocked.

Here are summed up steps you can take to secure an s3 bucket or recommendations you can give after you have found the s3 bucket.

Making Bucket private / Disallow public access

Using assumed IAM roles which has access to the bucket for read/write

Enabling CloudTrail and Server access logging for your bucket.

Abusing S3 Bucket Permissions

Web applications & APIs are often the highly exposed asset of any organization. With the use of modern frameworks, the development process becomes handy and faster. However, often the developers leave some 

unlinked, unreferenced or unintentionally/accidentally open for use. Often, attackers may utilize these to perform attacks such as Cross-Site Scripting (XSS), Open Redirection, Server-Side Request Forgery (SSRF), SQL Injection and others.

In this article, we will be discussing identifying the hidden attack surface by identifying the hidden parameters.

The process of identifying unlinked, unreferenced or simply hidden parameters that are accepted by the application and could allow a user to control the behaviour of the application using these hidden parameters is often known as 

As mentioned, the hidden parameters may allow an attacker to control the behaviour of the application and may result in the execution of successful attack scenarios such as Cross-Site Scripting, Open Redirection, SQL Injection, Local File Inclusion, Command Injection, Server-Side Request Forgery, Server-Side Template Injection and other security vulnerabilities such as an IDOR.

Hence, it is an essential step to perform 

as part of your Recon process for building an attack surface that is inclusive of the Hidden Attack Surface through these parameters. This often helps bug bounty hunters and security professionals to find unconventional and high reward paying bugs.

Since the purpose and motivation behind identifying the 

is now clear, let’s look for different tools & methodology to perform parameter discovery.

Tools for performing Parameter Discovery:

Arjun is a python based command-line tool that helps in the detection of the parameters present in the application. By default, the tool utilizes a custom wordlist to check for the parameters but this can be modified by the user to set their own parameters.

Detailed information and installation instructions can be found on the official repository of the Arjun tool:

Run the following command: arjun -u https://demo.testfire.net

Observe the parameters returned by the tool.

Note: By default, the tool uses GET request method but you can define other methods such as POST by using -m flag. Ex: python3 arjun.py -u https://target.com/test -m POST

ParamSpider is a python based command-line tool that helps in the identification of the parameters. It has the ability to find parameters from web archives, subdomains and other sources as well. This is one of the most effective tools to identify the parameters.

Detailed information and installation instructions can be found on the official repository of the ParamSpider tool:

 https://github.com/devanshbatham/ParamSpider

Finding Hidden Parameters with ParamSpider

Run the following command: python3 paramspider.py -d <target_domain> –level high

Param-Miner is a Burp Suite Extension that is handy and useful to find hidden and unlinked parameters that are specifically useful while looking for the Web Cache Poisoning related vulnerabilities.

Detailed information about the extension can be found here:

 https://github.com/PortSwigger/param-miner

As per the official GitHub Repository, the tool combines advanced diffing logic from Backslash Powered Scanner with a binary search technique to guess up to 65,000 parameters names per request. Param names come from a carefully curated built-in wordlist, and it also harvests additional words from all in-scope traffic.

To use it, right-click on a request in Burp and click “

”. If you’re using Burp Suite Pro, identified parameters will be reported as scanner issues. If not, you can find them listed under Extender -> Extensions -> Param Miner -> Output

In this section, we will look at a simple example of chaining multiple tools to perform parameter discovery and further utilize the identified parameters to check against cross-site scripting using tools such as KXSS.

First, let’s perform parameter discovery using ParamSpider:

Now, We have all the parameters identified, let’s run XSS GF patterns to extract the parameters that could be vulnerable to XSS:

on the URLs that are potentially vulnerable to XSS:

Observe that we have found some valid Cross-Site Scripting Issues

As we were able to find valid cross-site scripting issues, you can also attempt to write your own one-liners or small scripts to automate other security vulnerabilities as well.

Thank you for reading the article till the end and we hope you have learned something new. Make sure to check out the programs on the 

 platform and apply your newly learned skills to find some interesting security vulnerabilities. We will be back with some other interesting articles soon.

Parameter Discovery: A quick guide to start

, is launching the first live Bug Bounty event dedicated to European scale-ups and unicorns!

The idea was born in September 2021, during the 

Why not organise an event that would encourage all French scale-ups and unicorns to collaborate with ethical hackers, all in a fun and friendly atmosphere?

After some discussions with the unicorn Blablacar, already familiar with Bug Bounty with its 

 on the YesWeHack platform, then with Malt, the idea became a reality! The first edition of Hack Me I’m Famous will happen on 13 & 14 April 2022 at the 

13 & 14 April 2022 – A Promising First Edition

For this first edition, YesWeHack called on around fifty of the best European hackers to come and challenge the information systems of Doctolib, Blablacar and Malt. For more than 30 hours, day and night, the hunters will try to find vulnerabilities in the partners’ information systems. If they succeed, they will receive rewards based on the reward grids as well as unique goodies and special prizes!

For corporate security teams, it’s a unique and invaluable opportunity to discuss their findings with researchers, and better understand security bugs. For hackers, it’s an easy way to ask live questions to program managers and YesWeHack’s teams to get more information about the programs and thus go even further in their research. Furthermore, researchers may collaborate with each other to pool their skills and expertise and thus go further in the hunt for new vulnerabilities and exploitation. 

In a nutshell, a live Bug Bounty is an amazing experience for everyone to get to the top!

Alongside the live Bug Bounty, a workshop of the 

, of which YesWeHack is a member, will take place on the first day of the event. The SPARTA project is a novel Cybersecurity Competence Network supported by Horizon 2020, aiming to develop and implement excellent R&I actions and to ensure digital security and strategic autonomy of the EU. Strongly guided by concrete challenges, this workshop aims to gather the European ethical community to discuss their contribution to the European cybersecurity. 

You can download the SPARTA workshop programme here

This event aims to be replicated every year, with new scale-ups and unicorns joining every year. If you are interested in the initiative and would like to discuss with our teams, we invite you to contact us.

This project has received funding from the European Union’s Horizon 2020 research and innovation program under grant agreement No 830892.

Founded in 2015, YesWeHack is the #1 European Bug Bounty & VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with bug bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organizations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices. YesWeHack runs private and public programs for hundreds of organizations worldwide in compliance with the strictest European regulations.

In addition to the Bug Bounty platform, YesWeHack also offers support in creating a Vulnerability Disclosure Policy (VDP), a learning platform for ethical hackers called Dojo and a training platform for educational institutions, YesWeHackEDU. For more information: 

The first live Bug Bounty for European scale-ups and unicorns

Smart contracts security has had an increasingly bad reputation over the last few years, with over 

 worth of cryptoassets stolen in this first quarter of this year alone. The need for whitehat hackers to help protect smart contracts has never been higher.

The YesWeHack Blog

Back to Decathlon’s Live Bug Bounty

DOJO CHALLENGE #17 Winners!

The French government’s digital identity application under Bug Bounty program on YesWeHack

Back to Decathlon’s Live Bug Bounty

YesWeHackVR, an immersive hacking game

Abusing S3 Bucket Permissions

Parameter Discovery: A quick guide to start

YesWeHackVR, an immersive hacking game

The first live Bug Bounty for European scale-ups and unicorns

Getting started with smart contract in Bug Bounty

Getting Started with iOS Penetration Testing (Part 2)

The first live Bug Bounty for European scale-ups and unicorns

Don't wait for threats to strike

Produits

Chercheurs

Ressources

A propos

Suivez-nous