1
00:00:07,740 --> 00:00:15,060
All right, so now we're going to get into bug bounty and there are two prominent managed bug bounty

2
00:00:15,060 --> 00:00:24,820
resources or platforms because Hacker was in the but Crout now hacker one is probably the most popular

3
00:00:25,140 --> 00:00:30,330
if you go to why Hacker won and then you clicked and noticed there's a section for businesses and for

4
00:00:30,330 --> 00:00:30,750
hackers.

5
00:00:31,380 --> 00:00:39,180
If you click on the program directory, you can see all of the companies offering bounties for high

6
00:00:39,180 --> 00:00:43,800
impact, but you can actually sort here by program feature.

7
00:00:43,810 --> 00:00:48,120
So you can say I only want to see the programs that offer bounties or that offer bounties splitting,

8
00:00:48,960 --> 00:00:50,610
sort of questionmark and tells you what that means.

9
00:00:52,630 --> 00:00:55,540
And you can scroll through there and you can see, I mean, there's some pretty big brands in here,

10
00:00:55,870 --> 00:00:58,060
you can see on average how much the companies pay out.

11
00:00:59,460 --> 00:01:03,180
You can see Ingenix, on average, is paying out three K. Aboudi, right?

12
00:01:03,900 --> 00:01:08,940
I mean, people 123 gay and you can actually click into here.

13
00:01:10,830 --> 00:01:12,250
And this is really the most important part.

14
00:01:12,600 --> 00:01:18,480
Yes, you can see the rewards, the important part is the policy should always read the policy.

15
00:01:18,480 --> 00:01:22,640
Before you start hacking, you need to know what items are in scope, which items are not in scope.

16
00:01:22,800 --> 00:01:26,640
You know, what's eligible for bounty, you know, which vulnerabilities are in scope.

17
00:01:26,640 --> 00:01:28,500
And then it tells you which assets you are in scope.

18
00:01:28,500 --> 00:01:28,640
Right.

19
00:01:28,740 --> 00:01:33,720
Anything here that people dash, anything dotcom eligible for Boudi?

20
00:01:35,580 --> 00:01:39,190
Start out, people become eligible for bounty.

21
00:01:39,660 --> 00:01:43,800
So this gives you tremendous freedom, you know, as a big bounty hunter when you're trying to figure

22
00:01:43,800 --> 00:01:49,290
out which programs to participate in and which targets to attack and the second big bug bounty platform

23
00:01:49,290 --> 00:01:50,120
of the bug crowd.

24
00:01:50,400 --> 00:01:54,190
So if you go to bug crowd and you click on how it works, they give you a really good explanation.

25
00:01:54,630 --> 00:01:58,590
It's similar to hacker one, but you can see here what it's saying.

26
00:01:58,590 --> 00:02:04,110
Four out of five cyber attacks are driven by organized crime rings in which data tools and expertise

27
00:02:04,110 --> 00:02:04,860
are widely shared.

28
00:02:06,040 --> 00:02:11,230
And I tell you, you know, this is basically what you're doing, you're you're crowdsourcing your penetration

29
00:02:11,230 --> 00:02:11,890
testing, right?

30
00:02:11,900 --> 00:02:14,620
So if you actually go back to hacker one.

31
00:02:17,160 --> 00:02:19,470
If you scroll down, you can see what some people have said about this, right?

32
00:02:20,220 --> 00:02:25,410
Researchers all over the world who don't work lines nine to five schedule and they get feedback all

33
00:02:25,410 --> 00:02:27,690
the time, which is very beneficial.

34
00:02:28,560 --> 00:02:29,940
So this is a really, really good thing.

35
00:02:30,180 --> 00:02:32,730
And a good thing is that more and more companies are actually participating in it.

36
00:02:32,970 --> 00:02:35,070
We scroll down back to Bud Crowder.

37
00:02:35,100 --> 00:02:35,640
You'll see.

38
00:02:35,970 --> 00:02:38,180
And basically what you can do here, it's a crowdsourced hacking.

39
00:02:38,220 --> 00:02:43,290
Basically, you can if you're a program owner, you can invite hackers to hack on your door, hack your

40
00:02:43,290 --> 00:02:44,250
particular organization.

41
00:02:44,640 --> 00:02:50,820
And as the vulnerabilities are uncovered by you, the organization will track them to determine if they're

42
00:02:50,820 --> 00:02:53,540
valid and then we'll assign the severity to it.

43
00:02:54,660 --> 00:02:59,070
And since we're only paying the researcher for finding the problem, the pay is proportional to the

44
00:02:59,070 --> 00:02:59,430
problem.

45
00:02:59,880 --> 00:03:00,670
It's really smart.

46
00:03:02,160 --> 00:03:03,150
This is why it works, right?

47
00:03:03,300 --> 00:03:06,540
Like we said earlier, rewards are tied to successful outcomes.

48
00:03:06,780 --> 00:03:09,700
So you get true risk reduction and it's competitive.

49
00:03:10,230 --> 00:03:13,190
The first hacker to find a vulnerability is rewarded, right?

50
00:03:13,620 --> 00:03:17,700
You basically gave Afie the bug hunting process.

51
00:03:19,450 --> 00:03:23,020
And, of course, higher criticality vulnerabilities resulting bigger rewards.

52
00:03:24,770 --> 00:03:27,740
So we're going to show you guys how to get started with all this in the next election, I'm going to

53
00:03:27,740 --> 00:03:33,080
show you how to stand up for infrastructure so that we can get started setting building our toolset.

54
00:03:33,290 --> 00:03:35,990
Obviously, this isn't something we can emulate in our cyber range.

55
00:03:36,350 --> 00:03:38,720
We'll get back to our cyber and subsequent sections.

56
00:03:39,110 --> 00:03:43,850
But right now, we need to get into building out your Bargnani infrastructure so that we can start playing

57
00:03:43,850 --> 00:03:47,490
with the recon tools and seeing some live results and how that stuff works.

58
00:03:47,840 --> 00:03:50,360
So I'll see you guys in the next lecture by.