Rapid automation will define the evolution of Bug Bounty hunting in the coming years.

That’s according to GoDiego, a full-time hunter from Spain. At the time of writing, the 22-year-old sits 19th on YesWeHack’s 

 (real name: Diego Bernal Adelantado) is the inaugural interviewee in a series of Bug Bounty hunter Q&As we’re publishing on our blog, in text and video form (some videos are already 

). The Q&As, which ask YesWeHack hunters about their backstory, finest discoveries so far and advice for newbies, should at once be inspirational and educational for their peers.

GODIEGO ON GETTING INTO HACKING AND BUG BOUNTY…

I’ve been hacking for like four years now, I think, more or less. It’s been a wild ride!

My story is a bit random because I first started when I was like 15. I was bored in my room, and I said: “Oh, I don’t know anything about computers – let’s teach myself how to code.”

Then a couple of years later I found out about 

. I didn’t know what it was at the time, so I didn’t pay much attention, so I just kept learning stuff.

And then I just got drawn into it, and started doing Bug Bounty – and here I am!

THE THREE WORDS THAT BEST DESCRIBE HIS DEFINING QUALITIES AS A HACKER…

I would say: persistent, creative and curious.

ON HIS MOST CREATIVE VULNERABILITY DISCOVERY SO FAR…

I would say that my most creative and special bug was my first one, because I was testing one of the major news companies. They have a ‘limited’ program. So I was testing it. At this point I was a noob: I didn’t know what I was doing.

There was this feature for careers applications. I tried a couple of payloads – nothing worked. Then, one day, I noticed that they had this “submit a Word document” feature so I tried that, and nothing happened. I put some 

 payloads inside, then saved Word again – it didn’t work.

But they had this button: “Extract data and fill in application from Word”. So I took that then got the pingback.

At first I couldn’t believe it. And then it turned out, yeah – it was accepted!

ON WHAT IMPRESSES HIM MOST ABOUT YESWEHACK…

From my point of view, the thing that makes YesWeHack different is that the triagers are very fast. I sometimes put in a bug and then a couple of minutes later it’s on triage. That’s quite nice!

Also, there are some very good programs, and I’ve had very good interactions with them.

HIS PREDICTIONS FOR THE EVOLUTION OF BUG BOUNTY…

The Bug Bounty world is moving into an automated era, where most people are just relying on 

. So in the future, from my point of view, everything will be based on post-authentication bugs, rather than just finding, I don’t know, an exposed Git repo or something like that.

The level of automation that is going on right now is crazy.

HIS ADVICE FOR ETHICAL HACKING BEGINNERS…

I would say: experiment. Most of the times I found a bug while trying random theories, or saying: “well, what would happen if I tried this or tried that?”

Just don’t rely on other people’s tools; be creative and do your own thing. Because in the end that’s what’s gonna make you stand out and be different!

Learn more about hunting through YesWeHack

, or learn about the latest hacking tools and techniques 

‘The level of automation right now is crazy’: GoDiego on why post-auth vulnerabilities are the future of Bug Bounty

Cybersecurity is a more pressing priority than ever for US-listed companies and foreign private issuers in the wake of new rules and a landmark enforcement action from the US Securities and Exchange Commission (SEC).

The new SEC cyber rules, in force since 15 December, introduced mandatory reporting of “material” cybersecurity incidents and new annual disclosure obligations around cybersecurity risk management, strategy and governance.

A month earlier the SEC stunned the cybersecurity industry when it 

charged SolarWinds and its Chief Information Security Officer (CISO)

 with fraud and internal control failures related to a catastrophic cyber-attack in 2020 – an unprecedented move for the agency.

Even cybercriminals have noticed the SEC’s increasingly muscular approach to cybersecurity. In November, the BlackCat ransomware gang 

 to the agency for failing to disclose BlackCat’s breach of the digital lending platform.

Added to increasingly numerous and sophisticated cyber-attacks, the SEC’s latest manoeuvres are certainly focusing minds in the boardroom (and not necessarily just for public companies).

With digital transformation ongoing and code vulnerabilities a 

unified, multi-layered offensive security strategy

 is invaluable in reassuring both regulators and stakeholders about your security posture. To this end, for instance, 

YesWeHack’s all-in-one vulnerability management platform

 consolidates auto-scanning, Bug Bounty, pentest management, a vulnerability disclosure mechanism and attack surface management.

Public companies must now disclose in their annual filings “any cybersecurity incident they determine to be material” within four days of deeming it material, 

 when the new SEC cybersecurity rules were adopted in July 2023. Their disclosure must “describe the material aspects of the incident’s nature, scope, and timing, as well as its material impact or reasonably likely material impact on the registrant.”

The SEC cybersecurity rules 2023 also require a description of “their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents.”

Third and final, filings must “describe the board of directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats.”

These cybersecurity risk management and incident disclosure obligations require comparable disclosures by foreign private issuers.

The SEC cybersecurity rules’ effective date was 15 December 2023. ‘Smaller reporting companies’ have an additional 180 days before they must start disclosing ‘material’ incidents.

Why was the SolarWinds CISO charged by the SEC?

, the observability and IT management platform, and its CISO, Timothy Brown, “for fraud and internal control failures relating to allegedly known cybersecurity risks and vulnerabilities”.

It was the first time the SEC had ever brought cybersecurity-related charges against a CISO.

The bombshell news relates to the nearly two-year-long ‘Sunburst’ attack, which compromised 18,000 SolarWinds customers via a backdoor implanted in a software update for IT performance monitoring system Orion. Microsoft, NASA and the US justice and state departments were among the victims.

The charges allege that “SolarWinds and Brown defrauded investors by overstating SolarWinds’ cybersecurity practices and understating or failing to disclose known risks”. Brown is also alleged to have “failed to resolve” certain “risks and vulnerabilities” or “at times, sufficiently raise them further within the company”.

The SEC cyber disclosure rules show the agency is getting serious about cybersecurity. Why?

The SEC, which enforces securities laws, appears to increasingly see cybersecurity as central to its mission of protecting investors and facilitating capital formation.

“Whether a company loses a factory in a fire – or millions of files in a cybersecurity incident – it may be material to investors,” explained SEC chair Gary Gensler upon the rules’ adoption. He said companies and investors would benefit if their cybersecurity disclosures “were made in a more consistent, comparable, and decision-useful way”.

On the eve of the new rules coming into effect, Erik Gerding, director of the SEC’s corporation finance division, 

 the trajectory of multiple trends highlighted “investors’ need for improved disclosure” about cybersecurity issues. Namely, he cited the AI threat and increases in the digitisation of economic activity, remote work, the profitability of cyber-attacks, the use of digital payments, and reliance on third-party cloud and IT service providers.

Gerding also noted the rising costs – up to $4.45 million per data breach in 2023, 

 – associated with successful cyber-attacks.

Far from simply encouraging “boilerplate disclosures”, Gerding said the new cybersecurity disclosure requirements should elicit “tailored disclosures” that help investors evaluate even “emergent or evolving” risks.

Do the SEC cybersecurity rules for public companies affect other organisations?

The new SEC rules on cybersecurity apply directly only to US-listed companies and 

Organisations not subject to SEC oversight might nevertheless see its new rules as offering a useful framework for being transparent with their own stakeholders.

Moreover, with software supply chain attacks increasing, privately-held organisations can still be held liable as third-party suppliers implicated in cybersecurity incidents disclosed by public companies.

The SEC has not shied away from launching enforcement actions against private entities, most famously over the Theranos blood-testing scandal that 

landed founder Elizabeth Holmes in prison

. More recently, the SEC has targeted private clean energy company 

The new SEC cybersecurity rules and SolarWinds charges are also part of a 

 – propelled by the White House’s cybersecurity-focused 

 of 2021 – making stringent cybersecurity controls a greater legal and compliance imperative.

The trend is global. Across the Atlantic, for instance, the 

 – Digital Operational Resilience Act (DORA) are imposing new compliance requirements on organisations operating within the EU.

What are the implications of the SEC cybersecurity disclosure rules for my cyber-risk management strategy?

In mandating greater transparency and consistency in registrants’ cybersecurity disclosures, the SEC will hope to encourage a more rigorous approach to cyber-risk management.

Specifically how those risks are mitigated amid fast-evolving threats and technology is left to organisations to judge.

“In order to address a potential misconception, the Commission is not seeking to prescribe particular cybersecurity defenses, practices, technologies, risk management, governance, or strategy,” said Erik Gerding. “Public companies have the flexibility to decide how to address cybersecurity risks and threats based on their own particular facts and circumstances.”

In unifying and streamlining offensive security testing and its outcomes, the YesWeHack platform suits organisations of various sizes, sectors and levels of security maturity. It also offers increasingly powerful security benefits in the context of the current threat and infosec industry landscape.

How can I proactively improve my cyber-risk management strategy with YesWeHack in light of the SEC cybersecurity rules?

Our platform can help public companies enhance their SEC disclosures around “assessing, identifying, and managing material risks from cybersecurity threats”.

How? First, our Vulnerability Disclosure Policy (

) product provides a simple, standardised mechanism for receiving external vulnerability reports.

 Program, which is inherently more scalable, draws on a much broader skills base and has fewer methodological constraints than traditional security testing. As such, this form of crowdsourced security testing reliably surfaces serious vulnerabilities even on heavily-pentested scopes.

A Bug Bounty Program extends and maximises your security testing coverage through an unlimited pool of ethical hackers and a continuous, flexible audit of your growing attack surface.

But to comprehensively secure your attack surface, you must first understand its size and composition. Hence Gartner cited continuous Attack Surface Management (ASM) as a 

 that gives a real-time, comprehensive picture of your attack surface (including the third-party assets that the SEC’s Erik Gerding expressed concern about).

The ASM, which leverages a Continuous Threat Exposure Management (CTEM) model, also detects your online assets’ exposure to known vulnerabilities and provides automated, risk-based prioritisation of those security flaws.

How can I reassure investors or other stakeholders over our cybersecurity posture given budgetary and recruitment challenges?

 flat or shrinking cybersecurity budgets in 2023, while the global shortfall in infosec skills reached a 

Fortunately, the YesWeHack platform can both increase the cost-effectiveness of your OffSec strategy and unlock access to various skills – from problem solving to cloud security – apparently 

lacking in the current infosec jobs market

YesWeHack offers a pay-by-results testing model (paying only for valid, actionable bugs, according to severity), and substantially streamlines vulnerability management and remediation.

 solution consolidates pentest findings from all providers into one, user-friendly reporting interface. Similarly, the overall YesWeHack platform combines asset discovery with vulnerabilities from various sources – ASM auto-scanning, pentests, Bug Bounty, VDP – into a single interface.

The result is a unified, comprehensive and risk-based approach to security testing.

What do the SEC’s new cybersecurity rules and enforcement stance mean for the role of CISOs and senior executives?

In addressing boardroom-level oversight of cybersecurity risk management, the new SEC cyber rules are a firm reminder to CISOs and other senior executives that they bear ultimate responsibility for their organisation’s cybersecurity posture. The SolarWinds action serves notice that they can be held to account if they fall short.

“It’s clear that delegating oversight entirely to the security team, striving merely for ‘box-ticking’ compliance, or simply throwing money at the cybersecurity problem will no longer suffice,” says Rodolphe Harand, managing director of YesWeHack. “More than ever, CISOs must frequently ‘reality check’ their online risks.

“To this end, they must source the best, most cost-effective processes and technologies for the proactive discovery, evaluation and mitigation of risks – and in a way that is easy to convey to regulators and their stakeholders. We believe the YesWeHack platform can efficiently facilitate these goals.”

The YesWeHack platform provides real-time visibility of your potential attack vectors and a unified, multi-layered model for uncovering, prioritising and remediating vulnerabilities. It also provides functionality that facilitates the production of what the SEC calls “consistent, comparable, and decision-useful” disclosures.

Real-time tracking of vulnerability reports

Real-time view of your ‘asset coverage’ – ie, seeing which assets are currently being tested, by which methods, and the outcomes so far

Integrations with popular bug-tracking tools

Ability to certify compliance and share vulnerability information with authorities via dashboards and one-click generation of proofs of audit and exportable executive summaries

YesWeHack’s GDPR compliance, CREST accreditation plus ISO 27001 and ISO 27017 certifications can give stakeholders further reassurance. The same applies to our zero-trust network, bombproof infrastructure and state-of-the-art encryption, among 

Proactive, multilayered and unified security testing is a strategic investment. CONTACT OUR SALES TEAM to BOOK A DEMO of our Bug Bounty service or ASM, and to find out more about how your organisation can secure your growing attack surface cost-effectively.

US SEC cyber rules, SolarWinds CISO charges: How a unified OffSec strategy can enhance your SEC disclosures

Welcome to a new era for our CTF training platform 

Designed for a broad spectrum of cybersecurity enthusiasts, from Bug Bounty hunters to CTF champions, the latest iteration of Dojo is set to enhance the experience of creating and engaging with security challenges. With extended support for popular server-side programming languages like PHP, Python and Java, 

Dojo is your indispensable partner for mastering cybersecurity skills

We've rolled out a host of new features, designed to enhance your user experience and encourage greater participation:

: A user-friendly environment and easier navigation.

: A streamlined registration process for quicker access.

Expanded support for back-end vulnerabilities

: Greater flexibility in crafting challenges.

: Engage with challenges created by the community.

The Challenges section offers a more intuitive navigation system coupled with several useful new features.

You can now create challenges in a wider array of programming languages, including PHP, Python, Node.js and HTML, and choose the client-side rendering style that best suits your challenge. This flexibility is essential for designing realistic and engaging cybersecurity puzzles.

Mastering vulnerabilities through hands-on training

, accessible from the homepage, provides an in-depth exploration of various vulnerabilities. For instance, learn about 

 vulnerabilities, their underlying mechanics, and how different programming languages can influence their exploitation.

These practical exercises offer a hands-on approach to mastering the finding and exploitation of vulnerabilities. They also feature challenges that mimic common protection mechanisms.

Understanding how things work 'under the hood' is the most crucial aspect of hacking. 

Dojo offers a unique ability to see in real-time the effects of your actions and attempted attacks

, allowing you to understand what you're trying to achieve rather than blindly attacking. 

Combined with quick tips, clear explanations and code snippets, this makes Dojo an excellent launchpad for budding bug hunters.

Creating a challenge is now more intuitive and flexible. Start by setting up custom configurations and secrets with our startup code feature. Steps:

2. Fill in the challenge details, select the runner and click on 

3. Customise your challenge on the new page with various options.


4. Write the code to your challenge in the 


5. Fine-tune your filters and test their impact on inputs.

tab, you can modify the properties of that filter in the 

7. Test inputs in real-time and enhance challenge complexity with your added filters.


8. Congratulations, you have just created your first Dojo challenge!

Let's start with our very first Dojo v2 challenge: 

. In this challenge our goal is to escape the system command 

 which is running in the Python function 

). The input is then inserted into the Python variable 

, which is filtered one more time by using a short blacklist. The blacklist will stop the code and print 

 if our input contains any of the following characters : 

Now that we have a good understanding of how the code works and what filters are in place, we can start solving the challenge.

However, you are welcome to solve the challenge yourself without a walk-through and return to this article when you have solved it.

To test the WAF, we can simply make an input containing any of the characters the WAF is looking for and see the result:

Now we will instead use a valid value that the application expects to receive from the client:

The blacklist prevents us in various ways from escaping the 

 - but that doesn't mean it's completely safe. We can bypass the blacklist and WAF by specifying the values 

 command and then execute our inject system command. We will run the system command 

 to see if we can see the flag file in the folder we're located in.

Success! We were able to execute our own system command using 

 is within the same folder we are currently working in. Now we open the flag and solve the challenge!

Congrats! You have just earned your first flag and successfully solved the challenge 

Monthly DOJO challenges: A chance to shine

. This allows you to elevate your skills, compete with peers and earn rewards! Here's what you can expect when you manage to solve a Dojo challenge and submit a report:

Gain invitations to private Bug Bounty Programs!

Moreover, each challenge is an opportunity to showcase your skills and learn new ones!

The new Dojo platform offers a much better experience when creating challenges thanks to the new user interface and ability to choose from a wider range of programming languages, as well as the client-side rendering mode.

It therefore provides the opportunity to create more interesting challenges and a superior user experience for both creator and participants. The limitations are almost as good as gone and nothing will now stop you from creating even better challenges. We look forward to seeing the challenges that will now be created by the community.

If you are interested in creating your own monthly challenge for our hunters to tackle, 

Unveiling Dojo v2: Our new CTF and realistic challenge-building framework

Thirty-one valid vulnerabilities across five heavily pentested applications was a strong first-year return for our latest Bug Bounty success story.

Especially so, given that – in line with best practice – the client in question started small before expanding gradually.

Speaking at our recent ‘Client Success Stories’ event in Singapore, the cybersecurity chief at the global retailer of luxury goods recounted how its private Bug Bounty Program (BBP) had materially “enhanced security and increased compliance” and potentially prevented costly breaches.

“The ROI is easy to justify,” read his presentation slides at the Asia-Pacific (APAC) event in October.

The speaker, whose organisation chose to remain anonymous, recalled how in the year before launching the BBP they “received quite a lot” of bug reports via multiple channels. Some ethical hackers asked for financial rewards, but there was no mechanism or policy for paying for vulnerabilities.

The lack of a formal disclosure mechanism was clearly undermining the reporting, prioritisation and remediation of vulnerabilities.

The organisation already did extensive pentesting – “but I wanted to discover what I did not know”, said the head of cybersecurity.

 was duly put to senior management. As well as discussing the organisation’s risk profile and current security testing program, a killer question was posed: if we don’t pay $2,000 for a critical vulnerability now, what will be the cost of malicious exploitation?

The daily attacks mounted by malicious hackers against the organisation put any security concerns about the activities of ethical hackers in perspective. “It’s a matter of 

” attacks will sometimes succeed, he reflected.

With a pilot duly sanctioned, the security team consulted the IT and finance teams, and CIO and CTO, about choosing a crowdsourced security testing platform.

Among other things, they wanted help with budgeting and to compensate for their lack of internal resource and Bug Bounty experience; a program that would dovetail effectively with their internal pentest team; and access to experienced, highly skilled bug hunters.

YesWeHack impressed with its strong use cases, “good feedback from the CTOs I spoke to” and promises of extensive customer support, especially during onboarding. “They did everything I asked for,” said the speaker, “which is why we decided to work with them as a strategic partner.”

’s Bug Bounty case study and several other 

, having an in-house triage team really sealed the deal.

The decision to use YesWeHack was soon vindicated. The program was “super easy to get started”, while the customer-centric support was singled out for praise. The customer success and triage teams did the “heavy lifting” – enabling the busy BBP manager to adopt a fairly hands-off approach to program management.

The manageably modest scope and bug hunter roster left enough time for experimenting and optimising of security testing.

The first critical bug surfaced after 16 days. As the process was gradually optimised, critical bounties were upped from $2,000 to $3,000 after four months, scopes were increased from three to five after six months, and hunter numbers rose from an initial 21 to 222 by the end of the first year.

 was launched in tandem to cover out-of-scope issues.

The first year saw 44 vulnerability reports submitted in total on the pentest-hardened scopes. Some 31 were deemed valid, with 25 warranting a payout. Three vulnerabilities were classified as critical, and a further six were designated as ‘high’ severity. Total rewards so far had reached $15,500, averaging $620.

A $3,000 maximum payout was earned through the discovery in a developer’s GitHub account of a file containing credentials that could have enabled the compromise of internal systems, recounted the speaker.

Another notable and lucrative find – netting the hunter a $2,000 bounty – was a firewall-bypassing remote code execution (RCE) on an API endpoint using Spring Expression Language SpEL.

Bug Bounty hunting can achieve results that are typically elusive to pentesters, said the speaker, because they operate with “no limitations” and offer “multiple testing methodologies from many, many people”.

The speaker also reasoned that, because bug hunters are not (unlike pentesters) whitelisted by firewalls, it forces them to be more creative in bypassing defences. Necessity is indeed the mother of invention.

Nevertheless, the client still saw the value in continuing with traditional pentesting engagements. YesWeHack’s 

The speaker suggested that a Bug Bounty Program’s success hinges on having sufficient platform support and securing internal buy-in by communicating about the Bug Bounty model in an easy-to-understand way. For all the promise of BBPs, he also advises other program managers to carefully manage the expectations of both internal and external stakeholders.

Nevertheless, in this case study expectations were comfortably surpassed. So much so, that the speaker said the ultimate goal was to launch a public program and open the scopes to the entire YesWeHack 

Ready to enhance your company's security and prevent costly breaches? 

Connect with our experts today to launch a Bug Bounty Program

'ROI is easy to justify’: Bug Bounty success story from a luxury goods retailer 

YesWeHack is proud to reveal we are now CREST-accredited for penetration testing services delivered in Asia and EMEA (Europe, Middle East and Africa).

This means our penetration testing services are compliant with stringent, internationally recognised requirements – giving customers strong assurance regarding our technical expertise, competence and professional values.

To become a member of CREST, YesWeHack had to undergo a rigorous accreditation processes covering the policies, processes and competencies involved in delivering pentest-related services.

Membership criteria covers four key areas: operating procedures and standards, personnel security and development, approach to testing and response, and data security.

Among other things, CREST scrutinised our information security certifications, quality management system, contract management, insurance policies, compliance with relevant legislation and our complaint-handling process. YesWeHack provided references from existing customers as part of the process.

The CREST seal of approval gives customers peace of mind about our competence and adherence to the highest professional and ethical standards. Using CREST-accredited providers can sometimes even be a prerequisite to securing commercial contracts, or at least offer a competitive advantage.

These advantages apply regardless of which regions your organisation operates in, since CREST accreditation is recognised and valued around the world.

CREST continually reviews and refines its assessment methods and criteria to reflect evolving threats, technology and best practices, while YesWeHack must demonstrate compliance annually through the membership renewal process.

listed with over 300 CREST-accredited providers

announcement that our Information Security Management System (ISMS) is now officially compliant with ISO/IEC 27017

 – a globally recognised standard for cloud security controls.

The YesWeHack Blog

‘The level of automation right now is crazy’: GoDiego on why post-auth vulnerabilities are the future of Bug Bounty

US SEC cyber rules, SolarWinds CISO charges: How a unified OffSec strategy can enhance your SEC disclosures

Unveiling Dojo v2: Our new CTF and realistic challenge-building framework

‘The level of automation right now is crazy’: GoDiego on why post-auth vulnerabilities are the future of Bug Bounty

'ROI is easy to justify’: Bug Bounty success story from a luxury goods retailer

YesWeHack announces CREST accreditation for pentesting services

Festive Dojo challenge #29: SantaLock winners revealed!

'ROI is easy to justify’: Bug Bounty success story from a luxury goods retailer

9 rules for a successful first-time Bug Bounty Program

YesWeHack secures ISO/IEC 27017 certification to boost trust in our cloud-based services

"Triage was world class": Bug Bounty success story from risk-management giant DNV

9 rules for a successful first-time Bug Bounty Program

DON'T WAIT FOR THE THREATS TO STRIKE

Produits

Chercheurs

Ressources

A propos

Suivez-nous