Austin Sturm

[email protected] || Breaker of all the things || Hack@UCF || IRC @astor || @awscloud Straight crowding - Bounty mgr || My own opinions

[Austin Sturm @AustinSturm]

@nnwakelam Facts...

[Austin Sturm @AustinSturm]

@alxbrsn Yes. Think services that specifically provide this functionality or are supposed to provide security observability.

[Austin Sturm @AustinSturm]

@NahamSec 😭 Me... reading clear AI slop that is explicitly allowed by the RFC

[Austin Sturm @AustinSturm]

@stokfredrik Shrimp life. Sauna at home is my lifestyle end goal.

https://t.co/tbPs2nHn7S

[Austin Sturm @AustinSturm]

@RepRichHudson Weird because Dominion Energy is actively increasing rates.

[Austin Sturm @AustinSturm]

@albinowax This was the exact question in my mind.

[zseano @zseano]

i live and breathe amazon, literally everyday i am hacking on amazon. and i'll never stop :)

[Austin Sturm @AustinSturm]

Just had to explain this to some folks. What timing.

[Tib3rius @0xTib3rius]

So what did I show in my original screenshot? Just a normal feature of HTTP called pipelining.

If you open a connection to (most) HTTP servers, you can send multiple HTTP requests over that connection in succession, provided you don't specify a "Connection: close" header.

[Austin Sturm @AustinSturm]

@zack0x01 @Hacker0x01 Congrats.

[Austin Sturm @AustinSturm]

@zseano Facts. D2 is only beat out by Warcraft 3 imo.

[Frans Rosén @fransrosen]

I had so much fun recording this ep. My requirement was for @Rhynorater not to see the slides prior so what you see in the video are his genuine reactions as they happen live, from WTF to FOMO to "why did I not think of this before". Enjoy!

[Austin Sturm @AustinSturm]

You know you're in West Virginia when even the fries have brown sugar.

[Winnona 💾 @__winn]

I’m SO stoked to finally announce @DistrictCon - a new DC hacker conference, bringing together hackers across industries to do cool sh*t 🎉🪩 (Feb 21-22,2025) https://t.co/EGuvIlVdna

[Austin Sturm @AustinSturm]

@pry0cc You know the answer is no lol

[Austin Sturm @AustinSturm]

@MerrittBaer Hope to see you there!

[Katie Paxton-Fear @InsiderPhD]

Okay real talk: if your only motivation to get into #BugBounty is money, you’re not going to make it as a bug bounty hunter. It’s not enough to get through the time it takes to learn, the hours on a single website to find a single bug. Money AND is okay but money alone is just not enough.

No one decides to start painting to solely be a famous painter. The act of painting soothes something in their brain, maybe it makes them calm, allows them to get their thoughts into reality, or just the satisfaction of representing something as it truly is. Fundamentally that is what a hobby needs to do it needs to scratch an itch in your brain.

And I’m not saying that people shouldn’t get paid for bugs. Just because you’re a painter doesn’t mean you go and paint portraits of rich guys for fun, you paint what brings you joy first.

Money alone will kill your motivation, it might look good to be self employed, be your own boss etc but what happens when that bug doesn’t pay out because a client is slow? Or you spend hours and find nothing? If money is your only motivator you will get a job because at least it’s reliable.

Now bug bounty does change people’s lives, people genuinely are making crazy salaries from it. It’s completely changed mine, but I didn’t go into it for money, I did it because it was fun, it was a challenge and it scratched the itch I had to figure out how things work. But beware of those who try to present that as the norm, most hackers, myself included are not millionaires and none of us got into this because we aimed to be one.

If you’re stuck finding your first bug, and getting frustrated, reading articles and pasting other people’s payloads only for them to not work? Have you considered that you may not like this hobby?

I want to make it super clear this doesn’t mean companies get off the hook of paying hackers because they want to do it for fun. Pay the people for their labour, resolve vulnerabilities in a timely manner to avoid duplicates, and don’t treat VDPs like BBP with the incentive of points. But that you can’t answer “why do you want to do bug bounty hunting?” With anything other than money/finance/status related answers it won’t be enough for you to get past the learning all the hard bits.

There’s your #bugbountytip

[Austin Sturm @AustinSturm]

@MerrittBaer Planet money, wait wait don't tell me, radical candor, fall of civilizations, conflicted, in our time

[Austin Sturm @AustinSturm]

@Frichette_n 🫣

[Austin Sturm @AustinSturm]

@sshell_ I bought one awhile back as well, I tried to use it and gave up. I need to dedicate time to it when I am not busy, the productivity loss was too great for me to overcome at the time.

[Michael Skelton @codingo_]

Today @bugcrowd, we're expanding our product line to offer VDP's for free https://t.co/OiD82DnXuP, marking the next evolution of our VDP product, following our removal of incentives some time back.

This marks a change in the industry, providing a no cost entry point for customers to build up reporting portals, to support hackers in bringing vulnerabilities to them, in a fast, and effective manner. It also allows customers to build exposure to the value of the hacking community, and then pursue other offerings in the managed bug bounty space, or pen testing space, in a paid model, that incentivises findings and discovery, whilst VDP is intended to capture existing known findings.

Also, hackers, we hear you, we love you and we know there's more to change around VDP's. This isn't our only change. We're aware of the need to change terms for them, and it's currently an active discussion, as well as better separating VDP from MBB which we've done by removing incentives, and having this offering not list in our program portals. If you've other feedback, we would love to hear it, and welcome it - my slack is always open and you can reach me on HIVE, Bug Bounty Forum, or here over DM