zy9ard3

|

[zy9ard3 @zy9ard3]

@Koustics

[zy9ard3 @zy9ard3]

@Jhaddix probably continued my Process Engineer job in Paper & Board Industry

[zy9ard3 @zy9ard3]

@Ganofins @Hacker0x01 Congratulations🎉

[zy9ard3 @zy9ard3]

@fattselimi Most of the programs with "Program VDP" in their name or username, definitely have private BBPs under the hood

[zy9ard3 @zy9ard3]

@Paaastha https://t.co/Qd1hhF9PoV

[zy9ard3 @zy9ard3]

@0ppsec @jeetbhdr @fr4vian And when you report on that private BBP, your BBP report will be duplicated to a public VDP report, submitted by someone just like you and you will understand why not to hunt on VDPs

[HackerOne @Hacker0x01]

The results are in!🥇

Congratulations to these 32 teams who will move on to the Group Round of the 2024 #AmbassadorWorldCup! 🙌

The next round kicks off at the end of August! Stay tuned for the latest info, and read more about the AWC here. https://t.co/ZKBzjgwKWv

[zy9ard3 @zy9ard3]

@amanmahendra_ @Bugcrowd @codingo_ @Masonhck3571

[zy9ard3 @zy9ard3]

@imHangyaku @DanaEpp @rez0__ @Jhaddix @Shopify Ignore him, He doesn't know anything about how BBP works and doesn't even know that communicating program out of bands is a violation of CoC and the researcher may get banned for that

[zy9ard3 @zy9ard3]

@Wabafetnew They're running program also on h1??? LoL

[zy9ard3 @zy9ard3]

LoL

I came across a program that is running ;

Private VDP
Public BBP
Private BBP
Clear BBP

#bugbounty

[zy9ard3 @zy9ard3]

@haksecio This will miss out some of ccTLD root domains like com[.]sg, co[.]jp, etc...

[zy9ard3 @zy9ard3]

@0xdef1ant 😂😂😂

[zy9ard3 @zy9ard3]

@iamunixtz @Hacker0x01 That's not how it works !! Those pages are created for helpful purposes for security community

Its entirely your responsiblity to verify the legitimacy before submitting any issues to the referenced links on those pages, A Clear Disclaimer is displayed from Hackerone side

[Security Trybe @SecurityTrybe]

😂

[zy9ard3 @zy9ard3]

@iamunixtz @Hacker0x01 What do you expect on Hackerone to do on this ???... These are community created legacy pages and a clear disclaimer is already placed on these pages by Hackerone to know whether it is real page or not

[zy9ard3 @zy9ard3]

Hey @jobertabma @scarybeasts, I came across this https://t.co/mLmTiS9bkG prgrm which is defined as VDP on their policy but running as BBP & misleading researchers. H1 should not allow this, if they have no budget for BBP, change their license to VDP or disable them #bugbountytips

[zy9ard3 @zy9ard3]

@MrRajputHacker @msftsecurity @msftsecurity is a disgrace to security researchers, I stopped hunting for them 2 yrs ago. Sometimes I still come across multiple severe issues including RCEs on their subdomains but I won't report those to them instead I let blackhats to exploit them whenever they find it

[zy9ard3 @zy9ard3]

@amansmughal @alexbindrei @vankyv3r Isn't something there called reporter privacy, what If a researcher want to stay anonymous

Also the techniques aren't... it's solely belongs to the researcher, how can a program fully disclose the report without permission which is included with pvt techniques, privacy, etc...

[zy9ard3 @zy9ard3]

@irahulmali @snyff