Youssef

Pentester | Bug Bounty Hunter

[Youssef @regex33]

@Hacker0x01 The funny part is they received all the details, applied the exact remediation I recommended, and then asked me to reproduce it again. They literally just played dumb to get a free retest out of me before closing it lmao. 😂

[Youssef @regex33]

Bug bounty programs are using weak excuses to scam researchers out of critical payouts.

I reported a full sandbox escape to a Kubernetes node as root from normal access in a container to the host node in their infrastructure.
@Hacker0x01 #bugbounty

[Youssef @regex33]

Bug bounty programs are using weak excuses to scam researchers out of critical payouts.

I reported a full sandbox escape to a Kubernetes node as root from normal access in a container to the host node in their infrastructure.
@Hacker0x01 #bugbounty

[Youssef @regex33]

@suppvalen @Hacker0x01 I want to. But it's a massive company and if I drop their name, HackerOne will probably ban me.

[James Kettle @albinowax]

CVSS' Attack Complexity metric is the bane of bug bounty hunters: "you tried really hard to find that bug, so we'll pay you less".