HackerOne's LIVE HACKING EVENTS ARE BACK!

### Overview This video transcript documents a participant's travel and attendance at HackerOne's in-person live hacking event, designated as h1-303, held in Denver starting around May 18th. The speaker notes that this marks a return to in-person events following the pandemic, as well as their first time taking part as an active hacker rather than an organizer. The event brings researchers together to hack on a designated target for significant bounty payouts, with the speaker noting that a previous event had reached nearly a million dollars in total bounties.

### Key Topics - **In-Person Community Reconnection**: A significant portion of the trip centers around reconnecting after two to two and a half years with fellow security researchers, community members, and former colleagues—including former HackerOne VP of Community Luke Tucker, Caitlyn, Farah, and others. - **The Live Hacking Dynamic**: The vlog showcases the atmosphere of live hacking events, balancing intense vulnerability research with social gatherings such as a Lightspin-hosted happy hour, meals, caricature drawings, and cornhole. - **Target & Bounty Structure**: While the specific client target remains undisclosed due to event rules, attendees note individual payouts could scale up to $30,000–$50,000, with total event payouts exceeding $200,000 over the course of the hacking sessions.

### Technical Details While the video focuses primarily on the vlog experience, brief technical details emerge regarding a vulnerability collaboration between the speaker and another hacker named Justin: - **IDOR Chaining & Field Injection**: The researchers initially discovered an insecure direct object reference (IDOR). To demonstrate greater security impact, they identified a method to inject additional fields into the vulnerable endpoint. - **CVSS Scoring & Attack Complexity**: Evaluating the issue against the CVSS rating framework, the vulnerability initially appeared lower in priority due to high attack complexity. Collaborating with another researcher (Ben), they established a method to reliably enumerate the relevant IDs, successfully arguing to lower the attack complexity score. - **Bounty Outcomes**: The transcript references typical live hacking outcomes, including submitted bug reports being marked as duplicate ("duped") as well as bounty payouts being awarded as the event progressed.

### Takeaways The event highlights the return and value of in-person collaboration at live hacking events. Researchers can form ad-hoc teams in hotel lobbies and common areas to escalate vulnerability severity, chain initial findings such as basic IDORs into higher-impact bugs, and network with platform organizers and peers while competing for substantial bounty payouts.