Bug Bounty Village's banner
Bug Bounty Village's profile picture

Bug Bounty Village

@BugBountyDEFCON • 9,061 subscribers

Official X account for the Bug Bounty Village @DEFCON. Founded by @infinitelogins and @arl_rose.

Videos

LIVE
1.2k

Anya Rossi

sweetdream.ai

SweetDream.aiSponsored•Livecam
Streaming Now

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

HD live stream
Exclusive private shows
1.2k viewers online

Free preview available • Premium content

Google is supposed to be impossible to hack. @rhynorator found a $20K IDOR on the front page. The kind of bug every hacker checks for. This 1-node Caido workflow made their RPC traffic readable, turning a crowded program into a private hunting ground.
1:15
BugBountyDEFCON's profile picture

Google is supposed to be impossible to hack. @rhynorator found a $20K IDOR on the front page. The kind of bug every hacker checks for. This 1-node Caido workflow made their RPC traffic readable, turning a crowded program into a private hunting ground.

Bug Bounty Village

20,725 views • 23 days ago

403 on /get_all_users 404 on /get_all_userz Then Justin Gardner fuzzed until a double-encoded “S” slipped past the NGINX filter. Result: 4.5M users' PII dumped. Bounty: $15K–$20K Full talk → #BugBounty #DEFCON #BBV #AppSec #WebSecurity
1:00
BugBountyDEFCON's profile picture

403 on /get_all_users 404 on /get_all_userz Then Justin Gardner fuzzed until a double-encoded “S” slipped past the NGINX filter. Result: 4.5M users' PII dumped. Bounty: $15K–$20K Full talk → #BugBounty #DEFCON #BBV #AppSec #WebSecurity

Bug Bounty Village

58,059 views • 1 year ago

No more content to load