📣 Follow JR0ch17 on Twitter: https://x.com/jr0ch17
✉️ Sign up for the mailing list: https://bbre.dev/nl
📣 Follow me on Twitter: https://bbre.dev/tw
Interview with Jasmin “JR0ch17” Landry, a former triager and security manager, now a full-time bug bounty hunter. We discuss bug bounty strategy, mindset, and finding high and critical vulnerabilities.
BBRD podcast is also available on most popular podcast platforms:
https://open.spotify.com/show/6tLoJ5f...
• Bug Bounty Reports Discussed
https://podcasts.apple.com/us/podcast...
Links mentioned in the video:
The web application hacker's handbook: https://amzn.to/3GS4t68
Xlif: https://docs.oracle.com/en/cloud/saas...
DTD finder: https://github.com/GoSecure/dtd-finder
Secondary path traversal blogpost: https://samcurry.net/hacking-starbucks
OAuth dirty dancing: https://labs.detectify.com/writeups/a...
Cognito doc-driver misconfiguration: https://docs.aws.amazon.com/elasticlo...
Timestamps:
00:00 Intro
00:37 The road to becoming the full-time bug bounty hunter
20:06 The change in the mindset that lands a lot of highs and crits recently
23:02 SSRFs
24:33 How to test for SSTI?
28:54 Does SQLi still exist in 2025?
35:09 Where to test for XXEs?
41:33 Secondary path traversals
47:40 GraphQL bugs
51:04 The Chromium bug that still allows to control the referrer policy despite using DOM Purify
53:58 OAuth testing
1:03:41 Automation for a manual hacker
Поделиться в:
Доступные форматы для скачивания:
Скачать видео mp4
Информация по загрузке:
Скачать аудио mp3
Похожие видео
array(10) {
[0]=>
object(stdClass)#6694 (5) {
["video_id"]=>
int(9999999)
["related_video_id"]=>
string(11) "6mVMVLYKBYI"
["related_video_title"]=>
string(58) "Bug bounty tools that actually land bugs with Arthur Aires"
["posted_time"]=>
string(22) "11 дней назад"
["channelName"]=>
string(28) "Bug Bounty Reports Explained"
}
[1]=>
object(stdClass)#6667 (5) {
["video_id"]=>
int(9999999)
["related_video_id"]=>
string(11) "_VGEtJSRkjg"
["related_video_title"]=>
string(68) "Turning unexploitable XSS into an account takeover with Matan Berson"
["posted_time"]=>
string(27) "9 месяцев назад"
["channelName"]=>
string(28) "Bug Bounty Reports Explained"
}
[2]=>
object(stdClass)#6692 (5) {
["video_id"]=>
int(9999999)
["related_video_id"]=>
string(11) "-YzAwKRMXK0"
["related_video_title"]=>
string(79) "Going full-time bug bounty, privilege escalation bugs and more with Douglas Day"
["posted_time"]=>
string(28) "10 месяцев назад"
["channelName"]=>
string(28) "Bug Bounty Reports Explained"
}
[3]=>
object(stdClass)#6699 (5) {
["video_id"]=>
int(9999999)
["related_video_id"]=>
string(11) "hfNFRfFIJbY"
["related_video_title"]=>
string(45) "Bug Bounty Q&A with Jhaddix & Blaklis"
["posted_time"]=>
string(27) "8 месяцев назад"
["channelName"]=>
string(28) "Bug Bounty Reports Explained"
}
[4]=>
object(stdClass)#6678 (5) {
["video_id"]=>
int(9999999)
["related_video_id"]=>
string(11) "s7pnANMPigg"
["related_video_title"]=>
string(119) "Как Telegram связан с ФСБ? Что это значит лично для вас? Расследование"
["posted_time"]=>
string(22) "12 дней назад"
["channelName"]=>
string(27) "Важные истории"
}
[5]=>
object(stdClass)#6696 (5) {
["video_id"]=>
int(9999999)
["related_video_id"]=>
string(11) "uoKMhb6juSo"
["related_video_title"]=>
string(64) "The perfect SSRF exploitation - 10/10 Critical SSRF with JR0ch17"
["posted_time"]=>
string(23) "1 месяц назад"
["channelName"]=>
string(28) "Bug Bounty Reports Explained"
}
[6]=>
object(stdClass)#6691 (5) {
["video_id"]=>
int(9999999)
["related_video_id"]=>
string(11) "0PnWrdqV3TA"
["related_video_title"]=>
string(42) "How to become an XSS expert with renniepak"
["posted_time"]=>
string(25) "3 месяца назад"
["channelName"]=>
string(28) "Bug Bounty Reports Explained"
}
[7]=>
object(stdClass)#6701 (5) {
["video_id"]=>
int(9999999)
["related_video_id"]=>
string(11) "kfZoWdKYfYg"
["related_video_title"]=>
string(88) "From 0 to a top bug bounty hunter - Johan Carlsson's journey to GitLab TOP1 on Hackerone"
["posted_time"]=>
string(27) "5 месяцев назад"
["channelName"]=>
string(28) "Bug Bounty Reports Explained"
}
[8]=>
object(stdClass)#6677 (5) {
["video_id"]=>
int(9999999)
["related_video_id"]=>
string(11) "MQQCKOppxuE"
["related_video_title"]=>
string(37) "This was a $5,000 Bounty on Netflix?!"
["posted_time"]=>
string(23) "1 месяц назад"
["channelName"]=>
string(28) "Tyler Ramsbey - Hack Smarter"
}
[9]=>
object(stdClass)#6695 (5) {
["video_id"]=>
int(9999999)
["related_video_id"]=>
string(11) "dAQftuNu1VU"
["related_video_title"]=>
string(86) "Finding criticals on well-tested targets - Victor “doomerhunter” Poucheret"
["posted_time"]=>
string(27) "5 месяцев назад"
["channelName"]=>
string(28) "Bug Bounty Reports Explained"
}
}
