Web Hacking Lessons from a Government Bug Bounty Program
Sng Peng Boon examines we share the lessons learnt from testing government web apps - how we prioritised, and what interesting bugs appeared.
Summary
Architecture and Background
Sng Peng Boon present 'Web Hacking Lessons from a Government Bug Bounty Program' at DEF CON SG1 CSIT Village, detailing technical frameworks, attack surfaces, and core methodologies in bug-bounty, web-application-security, government-security, vulnerability-assessment.
Vulnerability Analysis
The technical analysis dissects structural design flaws, protocol vulnerabilities, and edge cases uncovered during rigorous research.
Exploitation and Demonstrations
We share the lessons learnt from testing government web apps - how we prioritised, and what interesting bugs appeared. We will also walk through real-world vulnerabilities and recommend practical takeaways for both bug hunters and developers.
Remediation and Defensive Strategies
Security practitioners and defenders receive actionable defensive controls, hardened configurations, and threat detection strategies to mitigate impact.
Related talks
Main Stage·48 min
Jason Haddix
Jason Haddix delivers an exhaustive playbook of modern application security testing workflows, automated recon pipelines, and high-impact bug bounty methodologies.
CSIT Village·19 min
Loke Yan Hao
Loke Yan Hao examines we share our findings from using AI tools for web penetration testing on bug bounty programmes.
Village Interviews·< 1 min
A quick spotlight on the Bug Bounty Village highlighting collaborative hunting events, live hacking, and educational sessions at DEF CON 34.