Pentest Bugbounty

pentest-bugbounty

Bug bounty avlama disiplini — sadece yetkili programlar, ROE'ye sadakat, dedupe, kaliteli rapor.

Triggers

• "H1 raporu yazalim"
• "Bugcrowd submission"
• "CVSS skoru hesapla"
• "dedup nasil yapilir"
• "bounty rapor sablonu"

Program Secimi Kriterleri

Onerilen baslangic: VDP (vulnerability disclosure program) -> public bounty -> private invitation.

Ne YAPMAYIN (Program Ihlali)

• Scope disi varlik test (her zaman ban + yasal risk)
• Production data exfil > kanit eshiti
• Otomatik scan vendor onaylamadan
• DoS / load test
• Sosyal muhendislik calisanlara (cogunlukla yasak)
• Brute force (cogunlukla yasak)
• Public disclosure musteri onayindan once

Dedup Stratejisi

Submission'dan once:

# H1 hacktivity
curl 'https://hackerone.com/<program>/hacktivity' | jq '.results[] | select(.title | contains("<finding-keyword>"))'

# Bugcrowd public submissions
# Program sayfasinda search

Eger ayni zafiyet tipi + ayni endpoint -> duplicate riski, baska program dene.

CVSS 3.1 Hizli Hesap

Base = Impact + Exploitability

Impact (CIA):
  C/I/A: None=0, Low=0.22, High=0.56

Exploitability:
  AV: Network=0.85, Adjacent=0.62, Local=0.55, Physical=0.2
  AC: Low=0.77, High=0.44
  PR: None=0.85, Low=0.62, High=0.27
  UI: None=0.85, Required=0.62

Web exploit ornegi:

• SQLi (authenticated, network, low complexity, low priv, no UI, high CIA)
  • AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 (HIGH)

Rapor Sablonu (H1 / Bugcrowd ortak)

## Title
[CRITICAL] Stored XSS in admin panel allows session hijack of all admins

## Severity
CVSS 3.1: 9.0 (CRITICAL)
Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

## Summary
Authenticated low-priv user can inject JS into the comment field that
executes in admin browser when viewing dashboard. Session token is
exfiltrated to attacker-controlled domain.

## Steps to Reproduce
1. Login as low-privilege user (user@example.com / Test123!)
2. Navigate to /comments
3. Submit comment body: `<img src=x
4. As admin, navigate to /admin/comments
5. Observe outbound request to attacker.com containing admin session cookie

## Impact
- Full admin compromise (session hijack)
- Persistent payload (stored DB)
- 1-click via existing admin workflow (no extra interaction)

## Proof of Concept
[screenshot1.png] — comment submission
[screenshot2.png] — admin browser request
[burp-export.har] — full HAR file

## Suggested Fix
- Server-side sanitize comment body (DOMPurify on save, not on render)
- CSP: `default-src 'self'; img-src 'self' data:`
- Cookie: `HttpOnly` + `Secure` + `SameSite=Strict`

## Additional Context
- Affected version: 4.2.1 (production as of 2026-05-15)
- Tested on: Chrome 119, Firefox 120
- No public PoC, no CVE assigned

Triage Karsiti Hazirlik

Programa report'tan sonra triagecinin atip sorusabilecekleri:

Bounty Maksimizasyon

• Chain bug: Low + Low + Med -> Critical chain (premium payout)
• Out-of-band: DNS, email, time-based POC (zor reproduce -> kalite puani)
• Detection bypass: WAF / CSP bypass kanit
• Multi-domain impact: Birden cok asset etkilenirse explicit ekle

Out-of-Scope

• Otomatik dedup tool composer'i (insan kararı)
• Sosyal muhendislik calisanlara
• Yasakli teknik kullanma (DoS, brute force)