Category: Bug Hunters Page 1 of 3

New features for quicker and improved Bug Reporting !

Our Dev Team issued two new features for you to save time and gain quality while reporting vulnerabilities.

As shown below, now you can access a new menu entry called "My Yes We Hack". This section provides a template manager up to five templates. According to our experience, 5 templates should be sufficient and useful for a majority of bug hunters.

In this section, based on Markdown, you can add or edit your templates.

Now, let's see a second useful feature to better illustrate and/or document your reports.

Read More

Lucas aka BitK: high level bug hunter and the brand new YesWeHack Tech Ambassador.

Tell us about yourself, your background ?

I'm Lucas also know as BitK, I am 28 y/o. I'm a French guy who lives in Lyon. If you play CTF we have probably already met during an on site event as I play a lot of them with the French team Hexpresso.

Before joining YesWeHack I was writing / reversing software for power plants.

I'm also a bug hunter, I've been in the top 10 hackers on YesWeHack Bug Bounty platform since the launch of the platform.

Why did you join YesWeHack and what is your role ?

It's a team that I've known for quite some time through CTF, Bug hunting and HZVCommunity & Events ( LeHack ).

We share the same principles and I do like the idea of bringing tools to the community.

My role as Tech Ambassador within YesWeHack will be to support the hackers’ community, by providing tools, talks and workshop. I’ll attend the YesWeHack sponsored events, having great time with bug hunters and IT security researchers.

As a bug hunter and CTF player what are you driven by ?

To me, bug hunting is a lot like a puzzle game, I feel like every software, application is vulnerable to some kind of exploitation, you just need to find how.

Writing software is a difficult job, and developers are still human beings, so they make mistakes : our job is to find those mistakes and help developers to fix them before it gets worse.

One thing I love about the hacker community is the willingness to share information, tips or tools. There is always someone better than you in a specific field and most of the time those people will share their knowledge if you ask nicely.

What are the benefits of CTF (Capture The Flag) for those who want to start bug hunting ?

CTF is a bit different from bug bounties, the major difference is that in CTF you know that a vulnerability is there, you goal is “just” to exploit it.

So usually CTF tasks are quite small, you need to exploit a very specific bug. While in bug bounties, you are hacking real enterprise, their website can be huge and sometime you can find yourself lost in the scope. Bug Bounty has a whole reckon phase that CTF don’t have, it’s a new skill to learn.

CTF and Bug Bounties are different, but most of the time I use tricks and tips I’ve learn during CTF to exploit real life application in Bug Bounty.

Read More

[ITW] Daniel Kalinowski: “Participating in bug bounties improves your skills and increase the overall knowledge.”

Let's meet with Kalin, Bug Hunter from Poland.

What's your background ?

I'm 25 yo ,I didn’t study, it’s kind of a waste of time in Poland. Well, depends if hacking the school PCs in junior high school counts? xD
I have started my carrier in IT industry as a Data Center Operator, then I got promoted to Junior Dev. They had to do it because I have pwned their application once, and after promotion with the access to source code I was able to find few more critical bugs. Also with the help of Shellshock I was able to download/view the files of the CTO that were stored on one NAS.

3 years ago I have joined a awesome security company, and in my current position I'm responsible for : Mobile apps testing / Web apps testing / Code reviews / General technical advisory on the customer side.

My nickname Kalin comes from my surname KALINowski. I can be also found on the Internet by @llamaonsecurity/@llamasbytes handle.

Why are you interested in bug bounty ?

It started bug bounties as a time-killer in my first job, then I forgot about it and came back to it when I started the carrier in IT security. Participating in bug bounties improves your skills and increase the overall knowledge. Once I had to dig into the PNG file format structure to execute the XSS payload on web servers. It was quite an unique experience. Financially speaking, 1 euro is equal to 4.15 PLN (my local currency) so participating in bug bounties can be profitable.

Read More

YesWeHack provides its bug bounty platform and expertise to the French Armed Forces Ministry.

YesWeHack is delighted to support the French Cyber Defence Command (COMCYBER), in order to leverage its 3,400 cyber-combatants+ force.

YesWeHack, a French start-up and bug bounty leader in Europe, equips COMCYBER with an innovative concept and tool to boost cooperation with all the Ministry's cyber entities.

This bold initiative is part of the Ministry opening up towards the civil society and private actors.

Florence Parly, the French Armed Forces Minister, announced on the 22nd of January :

A partnership has been established between COMCYBER and a start-up, YesWeHack. So, yes, I do announce: we will launch the first bug bounty of the French Armed Forces Ministry at the end of February 2019. Ethical hackers, recruited within the cyber operational reserve, will be able to search for vulnerabilities in our systems and, if successful, be as they should be, rewarded.

Florence Parly, the French Armed Forces Minister

With the signing of this partnership, the Armed Forces Ministry becomes the first French Ministry to launch a bug bounty program. COMCYBER will leverage YesWeHack bug bounty platform to meet the growing challenge posed by new cyber threats.

With the YesWehack bug bounty platform, COMCYBER will be able to best use its trusted community of reservists, in order to improve global security of the ministry's entities

Guillaume Vassault-Houlière, YESWEHACK CEO

This bug bounty program opens new perspectives for the management of the operational cyber reserve. Ultimately, such initiative will make possible to train reservists and increase their skills to significantly and durably improve the Ministry’s level of security.

YesWeHack met sa plateforme de bug bounty à disposition du ministère des Armées.

YesWeHack se réjouit d’apporter ses compétences au profit du Commandement de la cyberdéfense (COMCYBER) qui compte dans ses rangs plus de 3.400 cyber-combattants.

YesWeHack, start-up et leader français du bug bounty en Europe, offre au COMCYBER un concept et un outil novateurs développant la coopération avec l'ensemble des entités cyber du ministère. Cette discipline permet également au ministère de s'inscrire dans une démarche d’ouverture auprès du monde civil, avec l'ensemble des acteurs privés.

Un partenariat a été noué entre le COMCYBER et une start-up, YesWeHack. Alors, oui, je l’annonce, nous allons lancer fin février le premier bug bounty du ministère des Armées. Des hackers éthiques, recrutés au sein de la réserve opérationnelle cyber, pourront se lancer à la recherche des failles dans nos systèmes et s’ils en découvrent en être comme il se doit, récompensés.

Florence Parly, Ministre des Armées.

Avec la signature de ce partenariat, le ministère des Armées devient le premier ministère à se doter d’un exercice de bug bounty. Le COMCYBER va bénéficier de la plateforme de bug bounty de YesWeHack pour s'inscrire dans une vision de la Cybersécurité résolument moderne, où la collaboration et la coordination sont essentielles pour maintenir l'efficience de ses périmètres, face aux nouvelles menaces accentuées par la transformation numérique.

Il nous paraissait essentiel de proposer au COMCYBER la plateforme de bug bounty Yeswehack pour lui permettre d'améliorer sa sécurité opérationnelle grâce à leur communauté de confiance, constituée de réservistes.

Guillaume Vassault-Houlière, CEO YESWEHACK

Le bug bounty ouvre de nouvelles perspectives d’animation de la réserve opérationnelle cyber. À terme, la récurrence de ce type d'exercice permettra d’entraîner les réservistes et de les faire monter en compétences pour augmenter significativement et durablement le niveau de sécurité du ministère.
Ce modèle innovant pourra être facilement activé sur l'ensemble de l'exposition numérique du Ministère des Armées.

***

>> Devenir réserviste de cyberdéfense

La  réserve de cyberdéfense recrute tout au long de l’année des spécialistes dans le domaine informatique, réservistes opérationnels ou citoyens. La réserve recherche différents profils : coordinateurs, experts, analystes, techniciens; à différents niveaux : étudiants en 1ère année en informatique à BAC+5.

Le réserviste opérationnel souscrit un engagement à servir dans la réserve opérationnelle, un contrat rémunéré d'une durée de 1 à 5 ans renouvelable. Ces volontaires font le choix de servir leur pays sans faire du métier des armes leur seule profession.

Les réservistes citoyens sont des collaborateurs bénévoles du service public. Ils choisissent de servir leur pays en faisant bénéficier la défense de leur expertise et leur compétence. En tant que bénévole, ils consacrent le temps qu’ils souhaitent et peuvent, à cette mission.

Les conditions générales pour devenir réserviste

- Etre de nationalité française et résider en France
- Avoir plus de 17 ans
- Faire des études en informatique
- Etre en règle au regard des obligations du service national
- Ne pas avoir de casier judiciaire

Pour plus d’informations ou pour candidater (CV + lettre de motivation) : crpoc.cer.fct@intradef.gouv.fr

Source : https://www.defense.gouv.fr/portail/enjeux2/la-cyberdefense/la-cyberdefense/presentation

YesWeHack sponsor du CESIN : pour contribuer à renforcer la coopération entre les experts et les décideurs.

L'équipe YesWeHack est fière d'annoncer qu'elle devient officiellement sponsor du CESIN, une association qui lui est chère.

YesWeHack et le CESIN vont, ensemble, contribuer à renforcer la coopération entre tous les acteurs du numérique.

La communauté de YesWeHack, forte de plus de 6500 chercheurs, est désormais représentée au sein du CESIN.

Un combo gagnant : la transformation numérique et la Cybersécurité

YesWeHack inscrit ce partenariat avec le CESIN dans le long terme, afin de partager sa vision de la cybersécurité du futur, adaptée aux transformations que connaissent les membres de l’association. 

Ayant contribué au sein du CESIN depuis 2016 en tant que CISO chez Qwant, c'est une fierté de devenir sponsor aujourd'hui avec YesWeHack. Nous allons continuer à participer aux échanges au cœur du CESIN car la cybersécurité est le pré-requis essentiel pour mener efficacement toute transformation numérique auprès des décideurs."

Guillaume Vassault-Houlière, CEO de YesWeHack.

Avec plus de 500 membres, les activités du CESIN connaissent un succès grandissant parmi les experts en cybersécurité et YesWeHack est très enthousiaste à l'idée de participer à cette dynamique riche de promesses.

Le CESIN a souhaité cette année diversifier son sponsoring en accueillant en son sein quelques startups innovantes.

L’objectif est d’offrir encore davantage de visibilité à des entreprises auxquelles nous croyons beaucoup, comme YesWeHack car elles apportent, par leur innovation et leur audace, une réponse complémentaire aux enjeux de la cybersécurité auxquels sont confrontés les RSSI membres du club.

Alain Bouillé, Président du CESIN.

YesWeHack et le CESIN vous donne donc rendez-vous en 2019 pour une année constructive faite de rencontres et de projets concrets.

FIC 2019: YesWeHack’s community, NGOs & CivicTech unite through a unique Bug Bounty Campaign.

For this edition of FIC 2019, YesWeHack is organizing, for the first time in the history of FIC, a special event dedicated to Bug Bounty.

The International Cybersecurity Forum: the European reference event bringing together all stakeholders in digital trust will take place on 22 and 23 January.

This unprecedented bug bounty campaign will take place in an original space reserved for dozens of security researchers so that they can operate over several scopes, and where applicable, earn rewards according to the criticality of the reported vulnerabilities.

For this Premiere, the scopes are submitted by NGOs and CivicTech projects wishing to harden their systems and thus better protect their information assets and their reputation.

YesWeHack has chosen this year to help NGOs and Civictech as a priority, because many European citizens use tools developed by this sector to contribute to the common good, democracy, associative and charitable projects.

"For all actors, customers, developers and researchers, this Bug Bounty campaign within the 2019 FIC is a great and useful opportunity to exchange and confront the reality of threats in order to significantly increase the level of security and privacy by design"

Guillaume Vassault-Houlière - CEO @YESWEHACK

The Bug Bounty's area will welcome bug hunters who will cooperate with "program managers" from the selected projects with the support of Romain Lecoeuvre, the CTO of the YesWeHack team.

The rewards will be of two types: a total prize pool of several thousand euros is planned to reward the best researchers and goodies collectors will delight some players.

Read More

New YesWeHack platform : scale up your bug bounty programs

Thanks to the impressive work of our team,  our Bug Bounty platform has been revealed with new features for program Managers.

So we would like to share with you the new features below 🙂

New program structure
We have reviewed the structure of the programs by adding several fields.

A « Scope » field to define its types and perimeters (links, webapp, iOS Apple Store, Android)
An « Out of scope » field if applicable
« Qualifying Vulnerabilities » for a reward
« Non-Qualifying Vulnerabilities » for a reward
And a mandatory compensation grid based on criticality (Low / Medium / High / Critical)

Please update your Bug Bounty program by filling the new fields to better manage your perimeter.

New report workflow
We have reviewed the workflow for qualifying bug reports.
It is said that a picture speaks a thousand words so please take a look below:

[Optional] Free VPN
We offer all our customers a free VPN, which will allow you to provide hunters a dedicated connection to meet your program's legal framework, but also to be able to open dedicated environments (IP filtered).

Profile page
Each hunter now has a profile page through which all his activity within the platform is highlighted including his ranking.
This allows YesWeHack's client companies to select the hunters and to invite them into their programs based on their impact score or activities.

Two-factor authentication (TOTP)
We have integrated a two-factor authentication to increase the security level of your YesWeHack account.

New report structure
The details of the bug reports have also been reviewed, providing more clarity to the program manager. The ergonomics of the tools used for qualifying reports have also been redesigned to offer you a greater efficiency. These new programs/report structures linked to the provision of a public API allows an optimal capitalization of vulnerability reports (DevSecOps).

New dashboard
The new dashboard offers you all the statistics related to the reported bugs (severity, status, classification... etc.) but also concerning the amount of paid rewards.

API
We do provide an API so that you can develop or connect your own tools.

Members at all levels
We have improved granularity in member management. You can invite members to your business unit, but also to your programs and reports. The number of members is unlimited.

We hope that you will enjoy this new version as much as we do. Please be aware that we are still ready to listen to your feedbacks, questions and/or comments.

***

Click here to discover the new YesWeHack Bug Bounty Platform

***

YesWeHack Version 2 : And improvements for all Hunters !

Dear hunters,

Over the last months, we’ve been hard at work developing our new bug bounty platform. While engaging with you, we’ve made big changes to some parts of our services that needed improvements even a redesign.

Today, we would like to share some of these changes with you, and cover the benefits of the update.

We have a brand new logo!
Our branding is evolving with a new logo and design and we do think it provides a better look and we hope you will like it.

YesWeHack New Logo

We’ve been listening to your feedback about the previous platform experience and thanks to You we were able to develop a brand new user experience.

Profile page
Each hunter now has a profile page through which all his activity within the platform is highlighted including his ranking.
This allows YesWeHack's client companies to select the hunters and to invite them into their programs based on their impact score or activities.

Bug Hunter Public Profile

Two-factor authentication (TOTP)
We have integrated a two-factor authentication to increase the security level of your YesWeHack account.

TOTP new security 2FA for bug hunters

New programs display
The display of a program's details has been completely redesigned to provide a better user experience.
In addition to the traditional information related to a Bug Bounty program, we improved -in a very visual way- the current activity on the program (number of reports, thanks... etc.) but also the reward bracket that the security expert can expect.

New billing process
We have completely reviewed the billing process. This will allow you to comply with the requirements of the tax authorities.

Billing process for Bug hunters

Program versioning
It is not always easy for the hunter to follow the evolution of a bounty bug program over time. That's why we implemented a versioning feature on the program display.

Versioning of bug bounty program

***

We hope that you will enjoy this new version as much as we do.

We Wish You a Happy Hunting !

Please be aware that we are still ready to listen to your feedback, questions and/or comments.

***

Stay Tuned !
Soon, we will post about the new features improving our clients' experience.

Partenariat : SODIFRANCE & YESWEHACK.

Sodifrance et YesWeHack renforcent leur collaboration autour du Bug Bounty pour lutter efficacement contre les risques Cyber.

Sodifrance, au travers de sa marque d’experts Antéo Trust & Security et YesWeHack, principale plateforme ouverte de Bug Bounty en Europe, annoncent la signature d’un partenariat pour faciliter la détection de failles informatiques et offrir aux entreprises une réponse globale à leurs enjeux de cybersécurité.

Dans le cadre de leur transformation numérique, les entreprises de tous secteurs et de toutes tailles exploitent pleinement les capacités des nouvelles solutions numériques pour accélérer leur croissance et améliorer l’expérience client. En parallèle, le nombre de cyber-attaques augmente et leurs conséquences vont en s’aggravant : perte de chiffre d’affaires, de clients, vol de données, atteinte à l’image, et désormais risques juridiques avec les nouvelles réglementations telles que RGPD.

Face à ces nouveaux enjeux de sécurité, Sodifrance s’appuie sur la plateforme de YesWeHack pour proposer une solution innovante de services en cybersécurité. Elle permet aux entreprises de toutes tailles de mieux maîtriser le niveau de sécurité de leurs applications et environnements IT.

« Nous souhaitions proposer à nos clients une offre complémentaire aux audits de type Pentest ou Red Team » indique Hervé Troalic, Directeur de l’offre Sécurité de Sodifrance.

Hervé Troalic poursuit : "La solution clé en main de Bug Bounty que nous proposons, rendue possible par ce partenariat avec YesWeHack, apporte aux entreprises qui investissent dans des stratégies web et mobile, de réels atouts pour maîtriser la sécurité de leurs applications. De surcroît, elle s’avère parfaitement adaptée auprès des organisations qui adoptent les pratiques DevOps et qui souhaitent ne pas sacrifier la sécurité de leurs applications aux impératifs du time to market."

Pour Guillaume Vassault-Houlière, fondateur de YesWeHack,

« Cette collaboration avec Sodifrance offre à nos clients un service sur mesure, complémentaire et à forte valeur ajoutée. Elle répond au souhait des RSSI et Directions générales de pouvoir s’appuyer sur des acteurs de confiance européens, à l’écoute de leurs clients et respectueux de leurs contraintes budgétaires. »

A propos de Sodifrance
Entreprise de Services du Numérique créée en 1986, Sodifrance compte plus de 1350 consultants répartis sur 14 implantations en France. L’offre de services se décompose en 6 grands métiers : le conseil technologique, la transformation numérique, le Data Management, la modernisation de SI, les services pour les applications et les services d'infrastructure. Sodifrance assure la transition entre les SI historiques et les nouveaux modèles IT, permettant aux organisations de toutes tailles de renforcer leur compétitivité et collaborer plus efficacement grâce aux solutions innovantes centrées sur la mobilité, la sécurité, le Big Data et le Cloud.

A propos de YesWeHack
Avec des bureaux en France et en Suisse, YesWeHack est la première plateforme européenne de Bug Bounty en termes de nombre de clients et de nombre de hunters, conforme aux standards de sécurité et normes juridiques européennes.

Page 1 of 3

Powered by WordPress & Theme by Anders Norén