All right, so now we're going to get into bug bounty and there are two prominent managed bug bounty
resources or platforms because Hacker was in the but Crout now hacker one is probably the most popular
if you go to why Hacker won and then you clicked and noticed there's a section for businesses and for
hackers.
If you click on the program directory, you can see all of the companies offering bounties for high
impact, but you can actually sort here by program feature.
So you can say I only want to see the programs that offer bounties or that offer bounties splitting,
sort of questionmark and tells you what that means.
And you can scroll through there and you can see, I mean, there's some pretty big brands in here,
you can see on average how much the companies pay out.
You can see Ingenix, on average, is paying out three K. Aboudi, right?
I mean, people 123 gay and you can actually click into here.
And this is really the most important part.
Yes, you can see the rewards, the important part is the policy should always read the policy.
Before you start hacking, you need to know what items are in scope, which items are not in scope.
You know, what's eligible for bounty, you know, which vulnerabilities are in scope.
And then it tells you which assets you are in scope.
Right.
Anything here that people dash, anything dotcom eligible for Boudi?
Start out, people become eligible for bounty.
So this gives you tremendous freedom, you know, as a big bounty hunter when you're trying to figure
out which programs to participate in and which targets to attack and the second big bug bounty platform
of the bug crowd.
So if you go to bug crowd and you click on how it works, they give you a really good explanation.
It's similar to hacker one, but you can see here what it's saying.
Four out of five cyber attacks are driven by organized crime rings in which data tools and expertise
are widely shared.
And I tell you, you know, this is basically what you're doing, you're you're crowdsourcing your penetration
testing, right?
So if you actually go back to hacker one.
If you scroll down, you can see what some people have said about this, right?
Researchers all over the world who don't work lines nine to five schedule and they get feedback all
the time, which is very beneficial.
So this is a really, really good thing.
And a good thing is that more and more companies are actually participating in it.
We scroll down back to Bud Crowder.
You'll see.
And basically what you can do here, it's a crowdsourced hacking.
Basically, you can if you're a program owner, you can invite hackers to hack on your door, hack your
particular organization.
And as the vulnerabilities are uncovered by you, the organization will track them to determine if they're
valid and then we'll assign the severity to it.
And since we're only paying the researcher for finding the problem, the pay is proportional to the
problem.
It's really smart.
This is why it works, right?
Like we said earlier, rewards are tied to successful outcomes.
So you get true risk reduction and it's competitive.
The first hacker to find a vulnerability is rewarded, right?
You basically gave Afie the bug hunting process.
And, of course, higher criticality vulnerabilities resulting bigger rewards.
So we're going to show you guys how to get started with all this in the next election, I'm going to
show you how to stand up for infrastructure so that we can get started setting building our toolset.
Obviously, this isn't something we can emulate in our cyber range.
We'll get back to our cyber and subsequent sections.
But right now, we need to get into building out your Bargnani infrastructure so that we can start playing
with the recon tools and seeing some live results and how that stuff works.
So I'll see you guys in the next lecture by.