Popping a shell on the Oculus developer portal

Re:Popping a shell on the Oculus developer portal by canadev on Sunday August 31, 2014 @05:08PM (#8250382)

I liked this. I also wonder if it'd be worthwhile for me to take a few months off of work and try just poking away at security bounty programs. I doubt it would pay off to start with, but it seems like a pretty lucrative path. I know the OWASP Top 10, but don't really know my way around Burp Suite or anything.

[ Parent | on HN ]

Re:Popping a shell on the Oculus developer portal by homakov on Sunday August 31, 2014 @06:43PM (#8250660)

I don't know any program except FB with such bounties for bugs in web apps. If you want to hack for money, focus on FB forget about others.

[ Parent | on HN ]

Re:Popping a shell on the Oculus developer portal by christop on Sunday August 31, 2014 @08:23PM (#8250996)

https://hackerone.com/programs

[ Parent | on HN ]

Re:Popping a shell on the Oculus developer portal by homakov on Monday September 01, 2014 @04:28AM (#8251982)

Which one is profitable there?

[ Parent | on HN ]

Re:Popping a shell on the Oculus developer portal by rqebmm on Sunday August 31, 2014 @06:52PM (#8250697)

Google has one: https://www.google.com/about/appsecurity/reward-program/

[ Parent | on HN ]

Re:Popping a shell on the Oculus developer portal by homakov on Monday September 01, 2014 @04:28AM (#8251979)

They pay ten times less

[ Parent | on HN ]

Re:Popping a shell on the Oculus developer portal by dsl on Monday September 01, 2014 @03:39AM (#8251867)

Sign up for Bugcrowd and give it a go in your spare time. I would say it pays really well, in that it forces you to exercise and stretch your brain, over time you'll start getting better and work to the point you could quit your day job and do security full time.

[ Parent | on HN ]

Re:Popping a shell on the Oculus developer portal by maqr on Monday September 01, 2014 @04:06AM (#8251932)

How do things like bugcrowd (and bug bounties in general) work from a legal point of view? It seems very risky to go poking around without some kind of formal contract with the target.

[ Parent | on HN ]

Re:Popping a shell on the Oculus developer portal by dsl on Sunday September 07, 2014 @06:28PM (#8282664)

Bugcrowd has a contract with the target, and with you.

[ Parent | on HN ]

Re:Popping a shell on the Oculus developer portal by phaus on Sunday August 31, 2014 @08:41PM (#8251032)

If you decide to give it a shot, pay close attention to the policies and procedures that companies post. Facebook has refused to pay people in the past because they didn't use the framework/channels that they have provided.

[ Parent | on HN ]