Writeup – Open Bug Bounty Blog

For Researchers

Frequently Asked Questions Read the FAQ to get best experience with our platform	Write a Blog Post Write a blog post to share your knowledge and get kudos
Browse Bug Bounty Programs Browse active bug bounty programs run by website owners	Report a Vulnerability Report and help remediate a vulnerability found on any website

How it Works

Download presentation and learn
how our platform works

PDF, 500kb

For Website Owners

FAQ: For Website Owners Start here to ensure smooth collaboration with the security researchers	Start a Bug Bounty Start your bug bounty program at no cost and leverage crowd-security testing
FAQ: For Bug Bounty Owners Read how to maximize your ROI from crowd-security testing

How it Works

Download presentation and learn
how our platform works

PDF, 500kb

About

About the Project Read about Open Bug Bounty history, values and mission	API Request National CERTs and law enforcement agencies may request our API
Frequently Asked Questions Review the most popular questions about the project	Contact Us Get in touch

How it Works

Download presentation and learn
how our platform works

PDF, 500kb

Hall of Fame
Forum

SSRF | Reading Local Files from DownNotifier server

Posted on September 18, 2019 by Leon

Hello guys, this is my first write-up and I would like to share it with the bug bounty community, it’s a SSRF I found some months ago.

DownNotifier is an online tool to monitor a website
downtime. This tool sends an alert to registered email and sms when the website
is down.

DownNotifier has a BBP on Openbugbounty, so I decided to take a look on https://www.downnotifier.com. When I browsed to the website, I noticed a text field for URL and SSRF vulnerability quickly came to mind.

How I was able to create Unauthorized Comments on Facebook Live Stream

Posted on April 22, 2019April 23, 2019 by WHOISbinit

Back in October, 2018, I discovered a vulnerability on Facebook that allowed me to create unauthorized comments on live streams of people who aren’t my friends and don’t allow non-friends to comment on their posts.

For this vulnerability, the Facebook Security Team rewarded me a bounty amount of $750, which was the first ever bounty that I ever received.