Oops, I Hacked It Again: Tales And Disclosures

The talk opens with a look at how ethical hacking is defined differently depending on who is asked, and argues that the right way to disclose a finding depends heavily on local law. A disclaimer notes that some activities shown may not be legal everywhere and are presented for educational purposes only.

The middle section tells a series of stories from testing done in Argentina. They cover an amusement park payment system with weak APIs and race conditions, a web server that exposed a version control directory containing secrets, a supermarket customer portal where sequential identifiers exposed personal records, a ticketing platform where a modified request let the speaker reset an administrator password, and an internal login flow whose pre-authentication response leaked a value that worked as the password. The speaker also covers common mistakes in penetration testing, such as hitting systems that turn out to be production and leaving shells or backdoors behind.

The closing part compares full, private, responsible, coordinated and bug bounty disclosure, and notes that some countries run coordinated programs through national CERTs. Practical advice includes verifying a finding before reporting, keeping the report clear about who you are and what the impact is, and offering help with the fix. Companies often do not reply, so patience and realistic expectations matter. The talk ends with a reminder to look after mental health while doing this work.