Aye matey! Bring home the bounty. Don't just find bugs-- Find an SSRF.
Where
Track 3
CactusCon 12
Duration
—
Shows how to move past ordinary bug hunting toward finding a server-side request forgery worth a bounty.
Summary
No summary yet — watch the video above, or open it on YouTube.
Related talks
Bug Bounty Village·21 min
Glendon Chong
Walks through three TikTok bug bounty reports where web cache poisoning on an OAuth login endpoint led to account takeovers.
webappsecbug-bounty+2
Day 2 Stream 2·25 min
Ali Kabeel
Shows how business logic flaws in web apps, like invite and reset flows, let attackers bypass intended rules.
appsecbug-bountyweb+2
Track 3·44 min
Louis
Shows how JWT algorithm confusion lets attackers forge tokens, and how libraries can block it in code.
webappsecvulnerabilities+2