@trace37_labs@Hacker0x01 It is such a difficult situation to be in as a hunter. I value doing everything by the rules, but in circumstances like there where the platform is creating risk, not mitigating it, direct contact to the company is sanctioned. I really hope this bug you found gets resolved ASAP.
Found a cool bug at Meta.
From misconfigured Grafana instance to R/W access on 507 private Meta repositories.
Wrote up the full chain here:
https://t.co/LYQ0prc68d
$157k bounty awarded by @metabugbounty
SpaceX is actively hiring world-class engineers/physicists for SpaceXAI, even if you have zero prior experience in AI. Smart humans figure it out fast.
Please send an email with ~3 bullet points demonstrating evidence of exceptional ability to [email protected].
Tip of the day:
When you're hacking with AI, it pays to know when deterministic tooling is better than AI.
A good rule of thumb is this:
AI = fuzzy inputs and outputs
Deterministic tools = clear inputs and outputs
For example:
Want a list of subdomains? Use a deterministic tool like subfinder or amass.
Want to "check the list of subdomains to see if any of the hostnames look interesting"? use AI.
The real magic happens when you combine them.
@Zaddyzaddy@BugBunny_ai@Hacker0x01 You should probably validate by human first before submitting. I'd be curious what your accuracy % rate is. A lot of the platforms are complaining from being spammed by AI validated bugs that haven't been reviewed by humans.
I was hoping to compete in Pwn2Own with a Firefox full-chain entry, but unfortunately it was rejected. I’ve reported the vulnerability to the Mozilla team.
@caseyjohnellis I've seen your first point circling around a lot. Tbh I think the focus should be on implementing historic submission accuracy % requirements for submissions. Sure there will still be slop, but it will at least prevent people who are spamming fp bugs with 1-25% historic accuracy.
@Mr_Husky1 This is horrible. Unfortunately academia is rife with professors publishing students papers as their own as the "main author", offering only "editor" or nothing at all to the student. When I first saw this it made me realise academia is a complete scam.
@3ugman Marked as informative because there is no security impact. A user with a valid session can change their own email? Even despite the UI not permitting it, there is no clear risk or impact.