Felipe Alejandro

Hacking vagrant? Flexing on computers, every bone and muscle, and previously: Vulnerability Research @NCSC / @interruptlabs / @pwc_uk

[Felipe Alejandro @fwrnr]

I was awarded $65,400 for my submissions on @bugcrowd #ItTakesACrowd

The #bugbounty #bugbountytip here is turn off your testing mindset and turn on your vulnerability research mindset.

[Felipe Alejandro @fwrnr]

@Bugcrowd Guys there are people who were AT THE EVENT liking the post 🤣

[Felipe Alejandro @fwrnr]

Top 5 @bugcrowd P1 warrior not invited to BC events...

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

@bsysop @Bugcrowd Congratulations mate
❤️

@Bugcrowd why you keep running hacking events privately 😒without invites ?

[Felipe Alejandro @fwrnr]

@GodfatherOrwa @Bugcrowd Okay, from what I've learned in DMs, you should message your hacker success manager @ bc and ask them why you weren't invited :)

[Felipe Alejandro @fwrnr]

Like, do bugrcrowd not tell these people 'hey, there's an event going on but we weren't able to make room for you: here's why these other people were selected'.

Just a strange thing to see when there's so much infrastructure, leaderboards, events etc.

[Felipe Alejandro @fwrnr]

Got some flak for this... All I'm saying is: If Top 5 ATP tennis player posted on socials 'wait, you guys had an event without me? why wasn't I invited?' - it would have strange optics.

[Felipe Alejandro @fwrnr]

Top 5 @bugcrowd P1 warrior not invited to BC events...

[Felipe Alejandro @fwrnr]

@bsysop @Bugcrowd Who do we ask by the way? If someone doesn't reply to a thread like you have: Orwa obviously tagged Bugcrowd, but it's not like they'll respond to his ask 😅

[Felipe Alejandro @fwrnr]

@bsysop @Bugcrowd Transparency is good for the community, helps everyone!

[Felipe Alejandro @fwrnr]

@bsysop @Bugcrowd 'profile match' is obviously very prone to bias, you can hide anything under 'profile match'. Profile match could just mask personal preferences etc. So I'd like to hear more about the factors that go into it that are measurable.

[Felipe Alejandro @fwrnr]

@bsysop @Bugcrowd Fair enough mate, I'll ask a couple questions:

What is the number of Bugcrowd events you been invited to participate in over the past 3 years?

Do you believe that you are invited solely on the basis of the merit of your performance on Bugcrowd?

[Felipe Alejandro @fwrnr]

@ImposterAdam @CalebDixonSmith @DanielMiessler Do you think if there was no linguistic description of gravity and its laws, human beings wouldn't be able to observe them and 'know' that they apply?

[Felipe Alejandro @fwrnr]

@iam_wanders This all depends on how high the bar gets raised by AI written code, we'll see in a year.

[Felipe Alejandro @fwrnr]

You think you're upset at bug bounty platforms and their natural use of leverage they have and the market incentives for them to use that leverage.

You fail to realize that you're actually upset at the hacker community, who have failed to make use of the leverage they have.

[Felipe Alejandro @fwrnr]

@iam_wanders You can't solve mistreatment, you solve it by taking your skill elsewhere, eventually companies getting their attack surface covered by the most skill will be the most hardened and least vulnerable to other attackers with access to AI.

[Felipe Alejandro @fwrnr]

@iam_wanders I really think Synack Red Team had the right idea, all along. They just didn't execute well with that slow ass VPN...

[Felipe Alejandro @fwrnr]

@iam_wanders We could still have leaderboards etc. using ledgers. Self-hosted programs could run ledgers with username and finding count/criticality etc. And you could reference these ledgers in directories of hackers etc.

[Felipe Alejandro @fwrnr]

If you do this over and over again, there will either be some form of collective action, led by people with the most influence, or there will be a sea of pseudo action replies from these people that will go down in the history of hacker culture as grifting.

[Felipe Alejandro @fwrnr]

The number one thing you as a hunter can do, assuming you're a hunter who actually has submitted decent research, is every time you see someone with 5K+ followers complaining about bb -> reply "what can we do about it?" or "what does this achieve?"

[Felipe Alejandro @fwrnr]

You think you're upset at bug bounty platforms and their natural use of leverage they have and the market incentives for them to use that leverage.

You fail to realize that you're actually upset at the hacker community, who have failed to make use of the leverage they have.