AI-Powered Bug Hunting

on YouTube ↗35m

" summary

Claims $1M since 2022 and about 900 valid submissions while demonstrating concrete workflows: asset discovery with amass producing ~27,188 subdomains for nasa.gov, parsing chunks via llm (simonw) to find GitLab/Git instances, exploiting misconfigured GitLab APIs to dump projects, using shortscan to enumerate IIS short-name files and extract DLLs containing API keys, then using kaido to authenticate and escalate to remote upload/aspx shells, plus automated username enumeration and Zip Slip POCs that overwrite web app files.

AI-written summary · about

" chapters (14)

1. 0:00Intro
2. 2:12What's a bug bounty?
3. 3:15$1M since 2022
4. 3:52Easier with AI
5. 6:09Applied AI for bug bounties
6. 6:33Asset discovery
7. 8:30Hacking NASA
8. 14:03Insecure direct object reference
9. 15:46Unauthenticated access to the API leaks user PIl
10. 19:40IIS short name enumeration
11. 26:38In collaboration with Shubs & Rens
12. 32:08Demo
13. 34:13Final thoughts
14. 34:41Outro

" related talks

• 32mAutomating Web Application Bug HuntingJonathan Cran, Jerry Gamblin · BSidesSF 2019
• 46mThe Bug Hunter's Methodology 2.0Jason Haddix · OWASP AppSec California 2018
• 38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities ProactivelyPeter Yaworski · Øredev 2018
• 35mBug Bounty HuntingJan Kvapil · DevConf.CZ 2023
• 38mHacking Demos, Dirty Secrets, Dangerous Lies, Asset IntelligenceBrian Contos · Conf42 DevSecOps 2023
• 29mFlagship Projects: AmassJeff Foley · OWASP 20th Anniversary 2021
• 42mHidden Chains: Revealing High-Impact Bugs from Bounty submissionsMurali Vadakke Puthanveetil, Vinay Prabhushankar · OWASP Global AppSec San Francisco 2024
• 37mAI-Powered Slopsquatting: Is Your Software Supply Chain Compromised?Kalle Sirkesalo · CyberWiseCon Europe 2026