This is something that has been on my mind the past few weeks, and it’s concerning the topic of utilizing methodologies that are common in the bug bounty arena in domestic penetration testing. Especially when it comes to very high and open scope tests that may have a large number of assets.
Typically as a penetration tester, your goal is to 1. Get in, and 2. Identify as many different potential ways of getting in. That may include any number of vulnerabilities.
I see a lot of automation and continuous scanning solutions come out of this revolution known as the bug bounty community. I honestly feel as if some of the best, highest motivation hackers are in the bug bounty space. Innovation has been bred out of the reward of a bounty. Personally I am developing a solution revolving around automated enumeration (and then further diffing, or tracking the changes between scans).
I was watching some of the conference talks at NahamCon today, and one thing I noticed was that feeling of awe that I felt when I first started out in security, that feeling of “wow these people are on another level”. I really feel the bug bounty community right now will be remembered in history for what it has done to open the gates to those with the merit to receive the rewards.
Mostly for me, it is the community. Twitter is extremely active with bug bounty hunters that share their tools and knowledge continuously.
What are your thoughts? Have you had a chance yet to peek into what the people in the bug bounty circles are doing? Do you think it has any significance? Let me know!