Customisation is key when it comes to unearthing code vulnerabilities, according to Bug Bounty hunter ‘Brumens’.

, who is also researcher enablement analyst for YesWeHack, shares his Bug Bounty tips and tricks for beginners, and reflects on his own experiences as a successful ethical hacker.

Among other things, we asked the 23-year-old (22 when the interview took place) to reflect on his defining qualities as a bug hunter, about how he chooses his hunting targets and for his preferred hacking tools.

When I was young, I always mixed with a lot of computers. I did a lot of networking, learning, and when I grew up I liked coding, so I started to build some code. And then I also started to learn how different things worked and I think that’s how I got into hacking.

 on YesWeHack with a little bit of background about programming and IT security. I started hunting on a 

, and I managed to find my first vulnerability there. From that point, I got some private invites and started my journey on YesWeHack and continued to do hunting.

The triage is amazing. When you report something, the triage is done in a really short amount of time, so that’s a huge benefit about the platform.

And also, the way that you’re able to structure your report and communicate with the company, it’s amazing.

I always go for the functional ones that have a lot of functions, and from there I just like to discover and use the website or the programs as a regular user. And from there, I take the interesting points or interesting functions and go deeper and try to hack them.

ON THE MOST CRITICAL VULNERABILITY HE HAS DISCOVERED SO FAR…

The most critical vulnerability that I discovered myself was an unauthorised SSRF, also known as 

, that led to a remote code execution on an administration panel in the backend.

ON THE THREE WORDS THAT BEST DESCRIBE HIM AS A HACKER…

I would say creative, persistent and very much patient.

My top three hacking tools that I always use are 

ON THE MOST COMMON MISTAKE MADE BY INEXPERIENCED HUNTERS…

In my opinion, the thing that is very common to new hackers is that they take a lot of tools and they spray them on the target with a default configuration, without any customisation.

I would recommend to new hunters: make your own wordlist, make your own payloads, and understand the technology and adapt it to your target. Not spray and use the same methodology for all your programs, but adapt them to the specific one you are hacking.

MORE ADVICE FOR ANYONE STARTING OUT AS A BUG HUNTER…

Pick a target that you’re comfortable with, that you feel motivated to hunt on – not just a target that everyone is hacking on, but a program that you feel would be fun.

When you have that target, then just discover a function, and do research about how that function works. When you’ve got that information and find a behaviour, just keep digging and, eventually, you’ll probably find a vulnerability.

Learn more about hunting through YesWeHack

, or learn about the latest hacking tools and techniques 

‘Adapt payloads to your targets’: Brumens’ Bug Bounty tips for newbies

Writing an effective Bug Bounty report is not as easy as it might seem if you haven’t written one before.

Getting it right is crucial for proving the validity and severity of a vulnerability and getting paid promptly and fairly for your discovery.

As with the severity score, well-written bug reports will earn points that propel you up the leaderboard and unlock lucrative new hacking opportunities.

Whether your bug is low, moderate or critical severity, the following best practices for vulnerability disclosure can build trust with security teams and earn invitations to private Bug Bounty programs.

Before you report a vulnerability, you should first evaluate whether it is valid under the rules of the Bug Bounty Program. Do this by answering the following questions:

 As a bug hunter, you must respect the program rules and only hunt on perimeters authorised as within scope.

Does your bug fall within the program’s list of qualifying vulnerabilities? 

A non-qualifying vulnerability risks the report being rejected and closed in RTFS (

Does the bug have any potential security impact?

 As a general rule, validation requires some direct security impact (unless the program policy says otherwise).

The impact of a vulnerability directly influences the severity of your findings and, subsequently, the reward you might receive. Demonstrate impact by:

: Assess what data could be compromised or which functionality could be abused and to what effect. For example, could the vulnerability lead to unauthorised access to sensitive information or lead to financial losses? What is a realistic worse-case scenario?

: Provide a realistic attack scenario that demonstrates how an attacker could exploit the vulnerability. This helps the program’s security team grasp the practical implications of the security flaw.

This SQL injection vulnerability could allow attackers to retrieve the entire user database, including sensitive customer information such as passwords and credit card numbers.

Write a behaviour analysis that explains how you identified the vulnerability by inducing the application or system into behaving abnormally. For instance:

: Understand how the application or system is 

 to function based on documentation, use cases and legitimate user interactions

: Show deviations from expected behaviour that are indicative of a vulnerability, such as unexpected error messages, undocumented features or inconsistent application responses to user inputs.

During the analysis, it was observed that submitting a specially crafted payload in the user login form caused an unusual delay in the application response. This behaviour is indicative of a time-based SQL injection vulnerability, as the application's response time varied significantly with different payloads, suggesting it was executing unauthorised SQL commands.

A report can be divided into the following sections:

 related to the vulnerability. This gives the reader a broad understanding of the vulnerability you discovered.

A description of the process of how you discovered the vulnerability.

The PoC essentially serves as evidence that the vulnerability exists. One of the best ways to do this is to combine a short summary text with a visual reference in the form of an image and/or video.

A demonstration of the steps an attacker could take to exploit the vulnerability. These steps must be easy to follow so that triagers can reproduce your exploit and validate your report as quickly as possible.

You can also include an exploitation script, which is particularly handy for advanced vulnerabilities comprising numerous complex steps.

Clearly describe the impact of your vulnerability and link it to the Proof of Concept.

Provide a technical solution for how the vulnerability might be resolved. This is not obligatory, but providing a potential fix could be a time-saver for the security team and will be much-appreciated.

Add links to resources that provide further context or information that will help the security team understand the vulnerability. For example, it could include URLs for the relevant CWE definition and security advisories for existing vulnerabilities that your bug can be chained with.

.  To create or find your templates, navigate to:

When you're about to submit a report to a program, your custom templates will be accessible from a dropdown menu at the top of the page:

Here you can simply choose a Bug Bounty report template that reflects the vulnerability you are reporting. This auto-fills details adapted to the program and vulnerability you have discovered - saving you time in the process!

. Ensure your report is comprehensible to all readers, regardless of their familiarity with the specific vulnerability type. The technical depth of your report should not obscure its understandability. 

Remember, whoever reads your report may lack an in-depth knowledge of the vulnerability type you're reporting. To bridge this gap:

: Incorporate comprehensive details about the vulnerability, leaving no room for ambiguity.

: Where possible, supplement your explanations with screenshots, diagrams or videos. Visual aids can significantly enhance understanding and are particularly helpful for complex vulnerabilities.

 (see above section): Creating report templates for specific vulnerability types not only streamlines your reporting process for similar future discoveries, but also ensures consistency and completeness across your reports. Remember to anonymise the template by removing any program-specific details.

Vulnerability reports: your path to private Bug Bounty Programs

Poorly written Bug Bounty reports make it harder for security teams to reproduce legitimate vulnerabilities. This can lead to delays to the remediation of serious vulnerabilities or – worse still – their erroneous rejection. 

It’s therefore wise to take report-writing as seriously as hacking itself. This will help to build strong relationships with programs and open doors to exclusive hacking opportunities, such as private programs or Live Bug Bounties.

How to write an effective Bug Bounty report

Bug Bounty hunting need not be a full-time pursuit to make a big impact or earn a decent income.

’, is proof positive of this claim. The French ethical hacker has reached 11th on YesWeHack’s 

 (at the time of writing) despite working in the daytime as a pentester for Thales Group.

In this writeup and video, Amel explains how he discovered YesWeHack and Bug Bounty, revisits a pair of particularly impressive LibreOffice exploits, and offers some bug bounty hunting tips for beginners.

ICARE ON ENCOUNTERING BUG BOUNTY FOR THE FIRST TIME…

At the time, I was working for a small IT services company. They were testing a web application, which I tested myself and found some fairly critical vulnerabilities.

Since the application wasn’t managed by the company in question, I contacted the publisher, who thanked me for my work and then offered to let me test the product through a Bug Bounty platform.

I didn’t know what it was, but it was YesWeHack. So I signed up to the platform and that’s where it all started.

ON WHAT HAS IMPRESSED HIM MOST ABOUT YESWEHACK…

I would say the team. They are really nice – like a family! The programs are very interesting.

The platform is really user-friendly: it’s super easy to make a report, you don’t get lost in the tabs, it’s really simple and effective!

ON THE THREE WORDS THAT BEST DESCRIBE HIS APTITUDE FOR HACKING…

ON THE VULNERABILITY HE IS MOST PROUD OF UNEARTHING…

I’m quite proud of that one, because it was one of the first that enabled me to develop my skills on the platform and start sharing with the community. It was in collaboration with 

It was an application where you rendered a document and we did an RCE on it, which was great. There was a CVE on LibreOffice that we took advantage of. We went all the way: performed an exploit and got a reverse shell on the machine. And that wasn’t bad, because it got us a nice €10,000 reward.

This is the most recent one, which I found not long ago. It’s a CVE I found on LibreOffice that lets you execute code without any warning: in other words, you open a document – a CV for example – and open it on your machine with LibreOffice, then I can execute the command I want.

I check out the invitation, see if I like the application, and if I do, I work on it. I just follow my gut feeling.

ON THE MOST COMMON MISTAKE MADE BY NEWBIE BUG HUNTERS…

They’re afraid of the programs. For example, if it’s a public program they think: “Everyone’s been there, I’m not going to find anything” – when in fact you can always find something. You have to carry on.

HIS ADVICE FOR ASPIRING AND INEXPERIENCED ETHICAL HACKERS…

You have to be curious, be persistent, gather information, learn, and understand what the application does and how to bypass it.

‘Be curious, be persistent’: Icare on thriving as a Bug Bounty hunter

Bug Bounty’s intrinsic cost-effectiveness – thanks to the crowdsourced and, in YesWeHack’s case, results-based pricing model – is a big plus for public-sector organisations.

As well as praising the “cost model”, the CISO of one such entity, the European Community of Alsace (Collectivité européenne d'Alsace), hailed the agility of 

In the video and writeup below, Jérémie Piazza explains the strategic decision to launch a Bug Bounty Program in 2022, how the model fosters more secure development, and the strengths underpinning the partnership with YesWeHack.

The European Community of Alsace is a regional government body that provides services tailored to the needs of the Alsace region in France. It emerged from the merger of two departmental councils, Haut-Rhin and Bas-Rhin, in 2021.

ON THE IMPORTANCE OF CYBERSECURITY AT THE EUROPEAN COMMUNITY OF ALSACE…

Security is an important, even strategic, issue, particularly in the context of the convergence of teams, systems and technologies, added to an increasing number of cyber-attacks against local authorities, as well as the possible assimilation to a European institution. 

All this means that the local authority’s management really takes security issues into account.

Setting up a Bug Bounty Program is part of our vulnerability management process. In this context, we opted for Bug Bounty for agility reasons, particularly in terms of the scope, which can be modified on demand.

Because the cost model is particularly clear, you have a subscription cost and a cost linked to bounties. The notion of bounties also makes development teams aware of the cost of vulnerabilities and encourages them to gradually integrate security by design.

And then we have the advantage of calling on a 

 who have very different approaches to managing and detecting these vulnerabilities.

We also use Bug Bounty as part of the approval process for our teleservices.

We launched our program in 2022, in stages – initially with a limited number of assets and hunters, to enable our teams to mature both in terms of bug resolution and the use of the platform.

The main challenge in setting up a Bug Bounty Program is essentially an internal one. It will depend on your teams’ ability to deal with the bugs reported.

Initially, we were careful to ensure that our teams were capable of handling all the bugs reported by the hunter, to maintain their interest in the program.

The next steps are to broaden our scope. Today, we only have a certain number of institutional sites. In the future, we hope to add externally hosted sites to this number.

Our relationship with YesWeHack is now one of 

, based both on the expertise of the YesWeHack teams in helping us use the platform and on the quality of the bugs reported by hunters.

HIS ADVICE FOR LAUNCHING OR GROWING A BUG BOUNTY PROGRAM…

One piece of advice I’d give to those who want to get started is simply to do it gradually. Give yourself time to mature, both in terms of the type of bug reported and in terms of your teams’ ability to deal with these bugs.

Want to learn more about the YesWeHack Bug Bounty & Vulnerability Management Platform? Click the button below to schedule a demo with one of our experts.

‘We opted for Bug Bounty for agility reasons’: European Community of Alsace CISO

In the ever-evolving landscape of cybersecurity, YesWeHack recognises the vital role our hunters play in securing our clients' digital assets and their customers' sensitive data. 

To this end, we periodically send special posters to ethical hackers who have notched exceptional achievements in 

 hunting. These range from claiming maximum bounties to dominating the 

 or crafting imaginative, engaging Dojo challenges. 

Embracing the cosmic expanse of cyberspace, we are thrilled to introduce our latest collection of achievements: the 

These are more than just acknowledgments – they are a testament to the skill, persistence and ingenuity of our highest-performing hunters. With a celestial theme, these achievements are designed to express our gratitude to our community of hunters – and hopefully inspire them to even greater heights!

When and how are the hacker achievements awarded?

These coveted achievements are awarded quarterly. 

Every three months, we assess the performance and contributions of our hunters. Those who meet the criteria for any of the achievements will receive a special email from YesWeHack. 

Along with this recognition, you'll receive a physical poster celebrating your achievement – and serving as a tangible reminder of your hacking prowess!

: each physical poster is sent only once per researcher. So if you win, say, the 'Black Hole' achievement in the first quarter and then again in the third, you will receive the 'Black Hole' poster only for the first of these achievements. 

🌑 BLACK HOLE: The event horizon of criticality

 Attain the maximum reward in any YesWeHack program to claim this prestigious accolade (

this does not apply to reports produced through collaboration

 Top the leaderboard – ranking #1 – for at least three consecutive months.

 Demonstrate unwavering consistency by submitting valid reports every month for a full year (

 Prove your expertise on a specific program with at least 10 valid reports on the same program.

 Sit among the leaderboard’s top 5 for at least three months.

🪐 CELESTIAL PLANNER: Serious staying power

 Stay among the top 5 hunters for a six-month stretch or longer.

🚀 GALAXY VOYAGER: Achieving persistence all-year round

 Demonstrate long-term dominance by staying in the top 5 for at least an entire year.

🤝 COSMIC BLACKSMITH: The community contributor

' achievement is reserved for those who enrich the YesWeHack community, be it through blog contributions or crafting imaginative and engaging 

This is more than just a challenge; it's a journey towards becoming a legend in the cybersecurity space. These milestones can signpost your progress through the vast and growing Bug Bounty universe. 

Each poster is not only a reward, but a symbol of your skill, dedication and contributions to securing the digital cosmos.

So: are you ready to join this select group of world-class hunters, to pwn systems with flair and claim your rewards? Set your sights on these celestial targets and 

YesWeHack hunter achievements: Unveiling the Galactic Guardians series

Ethical hacking can be lucrative but there is no guarantee of income.

As such, inexperienced Bug Bounty hunters must above all practice patience and persistence if they are to reap the potentially significant rewards, according to the subject of our latest hunter Q&A.

‘Xel’ – real name Raphaël Arrouas – is well placed to judge: he’s fourth on YesWeHack’s 

 at the time of writing and boasts an ‘impact score’ (average points per report) surpassed by few others.

But, reassuringly for struggling newbies, even Xel admits full-time bug hunting “was not easy” when he started four years ago.

In the second writeup in this series (other videos are 

), the ethical hacker reflects on the challenges of finding the right work-life balance as a freelance white hat, enthuses about his most impressive bug finds, and offers advice to his fellow hunters.

I’m a cybersecurity engineer and following my studies I worked as a penetration tester. During my time as a pentester, I [became] interested in Bug Bounty Programs and I tested myself. I tested participating in one, in two, in three Bug Bounty Programs.

And eventually I thought: “Wow, this is a great opportunity that I should not miss!” So I quit my job to do Bug Bounty hunting full-time.

I joined YesWeHack’s platform with a very interesting program at the time, Swiss Post. It was very interesting for me because I live in Switzerland, so I invested some time into the program, and then into the platform, and got to meet the team. So yeah, I’ve been a regular of this platform!

ON WHAT IMPRESSES HIM MOST ABOUT YESWEHACK…

It’s always hard to say, but I would say the team. Really, it’s a top-notch team!

They are very friendly and reachable people. What I like is they spend a lot of time explaining their philosophy to their customers, and so it makes the whole process very agreeable.

I like their programs a lot. I think they have expanded their customer base in every continent these last years, so I think it’s more and more interesting to hunt on YesWeHack.

ON THE CHALLENGES OF BEING A FULL-TIME BUG HUNTER…

At first, being a full-time bounty hunter was not easy because, well, I needed to get results and there are no guidelines about how to do that.

So I had to develop my strategy, I had to develop my contact with the platforms, I had to see how it would fit into my schedule, my social life, and then my family life. So it had many challenges, but I would say that these challenges are kind of the same as the ones that entrepreneurs have.

ON THE THREE WORDS THAT BEST DESCRIBE HIS TALENTS AS A HACKER…

I would say curious, persistent and focused.

ON THE MOST CRITICAL BUGS HE HAS FOUND SO FAR…

I think the most critical vulnerability I’ve ever found was an unauthenticated RCE on a firewall orchestrator. I think I would have been able to take control of maybe 50 firewalls or something – I could have caused a lot of damage!

I have [another] vulnerability I was proud of: it was an RCE in an e-banking [application]. I was kind of limited in terms of length, and I had to do a server-side template injection in less than 100 characters or something. It kind of looked like a CTF challenge to me, so I was very proud of this one!

HIS ADVICE ON HOW TO BECOME A SUCCESSFUL BUG BOUNTY HUNTER…

You need to stay creative, you need to see what exists and you need to come with your own approach. You need to familiarise yourself with all the basic security concepts.

You need to start doing it really – to start hunting, even when you think hunting on public programs is hard and so on.

You really need to start doing it and invest some time in it – and don’t give up! After some time, you will get more and more vulnerabilities coming in and you will get better at Bug Bounty hunting.

It’s a job where you need to invest some time in it to be proficient, I would say.

, or learn about the latest hacking tools and hacking techniques 

‘Proficiency takes time’: Xel on his best Bug Bounty finds and the primacy of patience in ethical hacking

YesWeHack is delighted to unveil a new-and-improved User Experience (UX) that better aligns with users’ workflows and the platform’s fast-evolving capabilities.

Launched today, the redesign reconfigures the layout and gives important elements greater salience in ways that will help customers and hunters track metrics and take actions more efficiently.

The revamp has, for instance, removed friction from sorting, filtering, tracking and commenting on findings or vulnerabilities. For hunters, meanwhile, there’s a 

 facelift, while it’s now easier to find 

The more intuitive and attractive interface builds on design changes introduced with the launch last year of YesWeHack’s 

 (ASM) product. The latest overhaul further simplifies the handling of assets, findings and reports, however numerous.

Vulnerability reports more aligned with workflows

Making it easier to view and take actions, changes to the vulnerability report page (see image below) should produce a more seamless remediation process.

Crucially, BUG DESCRIPTION, COMMENTS and ACTIONS tabs are now always visible near the top of the page; previously users may have had to click or scroll down the page to reach them. Moreover, some dropdowns have been replaced with tabs for even quicker access.

Report details like scope, affected endpoints and patch status have been moved to a more logical position beneath the CVSS and asset value metrics on the right-hand side. By clicking on a new ‘workflow’ link, users can see a visualisation of the workflow for processing vulnerability reports.

The filtering menu on the VULNERABILITY CENTER and ATTACK SURFACE modules is much more compact – elevating the list of findings and reducing the need for scrolling. Notice also how the headline metrics are more conspicuous thanks to a simple dash of colour.

The revamped programs list makes choosing your next hacking engagement a quicker, more informed process with a multi-column layout, enhanced colour coordination and addition of useful program details (namely: country, sector, number of reports and 1st response).

As for the program page itself, a new HTML anchor menu means hunters can save time by navigating with a single click to the most relevant sections.

RANKINGS refresh adds Olympic-style podium

An eye-catching new podium design gives due prominence to the achievements of the top three performing Bug Bounty hunters (whether of all-time, during the current month/quarter/year or of previous quarters/years).

Gilles Yonnet, CTO at YesWeHack, says: “Our design refresh enhances the user experience, whether you’re a hunter or Bug Bounty Program manager, and whether you oversee just a Bug Bounty Program or combine it with ASM, 

 and a Vulnerability Disclosure Policy (VDP).

“The revamp should facilitate the vulnerability remediation process to the benefit of hunters and organisations alike, and enhance the platform’s utility as a 360-degree cockpit combining unified vulnerability management with continuous threat exposure management.”

A raft of new features will be launched throughout 2024.

 that gives hunters more granularity in finding suitable hunting opportunities. Search filters will include scope types, reward grids, program type, collaboration allowed/not allowed, supported languages, countries and activity areas (sectors).

 feature, this functionality is being introduced in response to hunter demand.

YesWeHack unveils workflow-friendly revamp of user interface

 Program (BBP) has diversified the vulnerabilities unearthed in the financial institution’s systems and strengthened the skills of its offensive security team.

That’s according to Lucas Zuluaga Pérez, part of Bancolombia’s red team and manager of the banking group’s BBP at YesWeHack.

Founded in 1875, Bancolombia Group comprises banks in Colombia, Panama, Guatemala and El Salvador, supported by more than 30,000 employees and 80,000 suppliers. It also operates in the US and the Bahamas.

Translated from Spanish, the following interview sees Lucas discuss the group’s approach to expanding the BBP, the security and red team benefits of Bug Bounty, success factors in crowdsourced security, and the reasons for choosing YesWeHack.

LUCAS ZULUAGA PÉREZ ON THE LAUNCH AND EVOLUTION OF BANCOLOMBIA’S BBP…

Security is of the utmost importance to Bancolombia, as we ensure the protection of more than 16 million customers.

Bancolombia’s Bug Bounty Program started around October 2021. We started with a private program in which five of the best hackers in YesWeHack participated. We had a great evolution and within a year we managed to considerably expand the scope of our sites, going from two sites to 30 sites, from five hackers to 50.

Key factors such as the support of senior management, that our leaders consider cybersecurity as a key element, are very important.

Secondly, having the engagement of the technology teams, which positively welcome reports of some of the vulnerabilities we identify in the environment.

And thirdly, the involvement of the red team, to raise the bar every day with the support of the triage team and hunters of YesWeHack.

ON THE RED TEAMING AND SECURITY BENEFITS OF BUG BOUNTY…

With our Bug Bounty Program, the red team’s skills have increased considerably. We have vulnerabilities in our checklist that we would not have considered before.

We have achieved great maturity and a great process, which allows us to quickly address vulnerabilities that may at some point affect the confidentiality, integrity or availability of information.

ON CHOOSING YESWEHACK OVER RIVAL PLATFORMS…

When we conducted the request for proposal for the Bug Bounty Program, we saw in YesWeHack some differentiators, such as their experience in Europe and Asia, the number of hunters registered on their platform, and the level of vulnerabilities reported, which could fit perfectly into our ecosystem.

The YesWeHack Blog

‘Adapt payloads to your targets’: Brumens’ Bug Bounty tips for newbies

How to write an effective Bug Bounty report

‘Be curious, be persistent’: Icare on thriving as a Bug Bounty hunter

‘Adapt payloads to your targets’: Brumens’ Bug Bounty tips for newbies

‘We opted for Bug Bounty for agility reasons’: European Community of Alsace CISO

YesWeHack hunter achievements: Unveiling the Galactic Guardians series

‘Proficiency takes time’: Xel on his best Bug Bounty finds and the primacy of patience in ethical hacking

‘We opted for Bug Bounty for agility reasons’: European Community of Alsace CISO

YesWeHack unveils workflow-friendly revamp of user interface

‘The red team’s security skills have increased considerably’: Bug Bounty at Bancolombia

Smart Automation With Burp Suite

YesWeHack unveils workflow-friendly revamp of user interface

DON'T WAIT FOR THE THREATS TO STRIKE

Produits

Chercheurs

Ressources

A propos

Suivez-nous