@Bugcrowd

The leading provider of crowdsourced cybersecurity solutions purpose-built to secure the digitally connected world...Unleash Ingenuity™

 San Francisco, CA
linktr.ee/bugcrowd
Joined September 2012
  • Tweets27K
  • Following6.1K
  • Followers205K
9.3KMedia
➡️ DELETE /api/user/999 → 403 ❌ Try this: ➡️ POST /api/user/999 + X-HTTP-Method-Override: DELETE → 200 ✅ ➡️ POST /api/user/999?_method=DELETE → 200 ✅ Gateways/auth middleware often match on verb+path. Frameworks (Laravel _method, Express method-override, Rails) may accept overrides at the router level. Same for edge rules that only guard GET/POST. Try HEAD/PATCH/OPTIONS too.
14
96
2,965
Attending a live hacking event is a career-defining experience for many hackers! Here’s why:
11
1,733
"Managing the PHP threat involves striking a balance between the risk of a severe cyberattack and the business impact of downtime." ⚖️ In the wake of PHP2Shell, our CI&SO Nick McKenzie shares a CISO perspective about how security and business leaders made decisions under pressure, what works, and what other CISOs can take into the next critical vulnerability. bugcrowd.com/blog/behind-the…

Behind the scenes of PHP2Shell: What the last 72 hours taught us | @Bugcrowd

PHP2Shell hit fast. Bugcrowd’s CISO shares what 72 hours of response taught us, plus three lessons for CISOs facing the next critical vulnerability.

bugcrowd.com
1
2
16
2,896
"Won't fix." 😂
3
1
69
9,210
Exactly one week from right now, you could be: 🟠 Meeting CISOs and expert hackers 🟠 Learning how to uncover vulnerabilities faster 🟠 Networking over drinks and dinner It's your last chance to sign up for the Hive Exchange Nuremberg! Don't miss it 🚀 luma.com/4hngxg09

The Hive Exchange: Nuremberg - powered by AWS · Luma

The Hive Exchange is coming to Nuremberg during it-sa Expo & Congress! Join Bugcrowd, GlobalDots and AWS in central Nuremberg for an exciting evening of…

luma.com
2
1
6
3,416
You can never go wrong with recon. 🔎 Here are some tactics you can try: 🟠 Scope company domains 🟠 Scope target company acquisitions 🟠 Enumerate ASNs 🟠 Run reverse WHOIS lookups 🟠 Enumerate subdomains 🟠 Analyze open ports 🟠 Check ad/analytics trackers 🟠 Use Shodan to find exposed assets 🟠 Google copyrights, terms of service, and privacy policies Just make sure to test only in-scope assets. ✅
4
14
81
5,188
Get a better understanding of why you should stay within scope: 👇 bugcrowd.com/blog/understand…

Understanding Scope for Higher Payouts | @Bugcrowd

Scope is one of the most important elements in a crowdsourced security program. As described here, the Bugcrowd team works closely with program owners to craft a detailed and clear brief

bugcrowd.com
1
3
1,277
UPCOMING EVENT: Join us on October 21 for the RSA Conference, where Alistair G, our Director of Red Teaming, will participate as a panelist in the Innovation Showcase: "Countering AI-Powered Fraud Before It Happens." Register here: bgcd.co/4yVlDG6
1
8
4,394
How does a top hacker prepare for a Live Hacking Event (LHE)? 😏 Let’s hear it from a pro:
8
11
1
155
14,153
Got rate-limited. 😩
2
7
61
9,616
“Is bug bounty really legal? 🤔” Here’s a quick clarification: 👇
1
1
46
7,622
The Nuremberg Hive Exchange agenda just dropped ⬇️ We hope to see you October 28. Reserve your spot today! luma.com/4hngxg09
2
2
11
5,085
You can now scroll X and Reddit at the same time! ⏬ If you’re interested in: ➡️ Bug bounty ➡️ Security news ➡️ or anything hacking-related Follow us here and on Reddit! 🔔 Here’s our official subreddit: 👇 reddit.com/r/Bugcrowd
1
2
25
4,683
How to discover and test API endpoints? Here are some solid tips: 👇
3
5
76
8,129
No target yet? Take your pick here: 🎯 bugcrowd.com/engagements
2,106
Hack and party!🕺
26
146
19
1,139
56,278
Are you seeing a 403 when you access this: GET /api/v2/admin/users ❌ You can try bypassing it by accessing an older API version: ➡️ GET /api/v1/admin/users ➡️ GET /api/admin/users ➡️ GET /api/V2/admin/users ➡️ GET /api/v2/admin/users with X-API-Version: 1 ➡️ GET /api/v2.0/admin/users ➡️ GET /api/beta/admin/users What else will you try? 👇
8
39
346
11,855
We are continuously reviewing the mechanics of the Bugcrowd Platform to safeguard triage capacity, uphold signal quality across all engagements, and improve the experience for everyone. Read about our latest update here: bugcrowd.com/blog/evolving-o…

Evolving our submission accuracy and throttling controls to protect triage speed | @Bugcrowd

Bugcrowd updates its submission accuracy metric and throttling rules to curb AI-generated spam and speed up triage. See how the changes affect researchers.

bugcrowd.com
11
3
3
27
8,106
Stuck on a target? Other hunters have your back.
1
1
8
5,146
Join our community on Reddit 👇 reddit.com/r/Bugcrowd/

r/Bugcrowd

Discussion about bugbounty & ethical hacking disclosure and things related to Bugcrowd.

reddit.com
2,152
Load more