Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 37ce0ee

Browse files
stacyspivastacyspiva
committed
retesting update for hacker book
1 parent 0be07eb commit 37ce0ee

File tree

3 files changed

+36
-26
lines changed

3 files changed

+36
-26
lines changed

‎docs/hackers/images/retest-findings-form.png

121 KB
Loading

‎docs/hackers/images/retest-invitation-email.png

46.1 KB
Loading

‎docs/hackers/retesting.md

Lines changed: 36 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -4,46 +4,56 @@ path: "/hackers/retesting.html"
44
id: "hackers/retesting"
55
---
66

7-
As programs receive vulnerability reports and work on deploying fixes, they need proof that their vulnerabilities have actually been fixed. Asking hackers to verify whether a vulnerability has been fixed is a good way to secure the protection of data. Programs can elect to invite you and other hackers to retest your vulnerabilities to verify fixes.
7+
As programs receive vulnerability reports and work on deploying fixes, they need proof that their vulnerabilities have actually been fixed. Retesting enables programs to ask hackers to verify whether a vulnerability has been fixed in order to secure the protection of their data. If you submit a valid vulnerability report, programs can elect to invite you to retest the vulnerability to verify the fixes.
88

9-
><i>There’s currently no effect to reputation for participating in the retest. Although there’s no time limit, we recommend you to complete the retest within 24 hours after accepting the invitation.</i>
9+
Upon successful completion of a retest, you’ll receive $50 in bounty as well as +2 reputation.
1010

11-
If you’re invited to retest a vulnerability, you’ll receive an invitation in your email to retest the report.
11+
### How it works
1212

13-
![retesting-1](./images/retesting_update_2.png)
13+
If you’ve submitted a valid vulnerability for a report, the program can request to have you retest the vulnerability to make sure it’s been fixed.
1414

15-
If you're the original reporter of the report, you'll also receive an email asking you to participate in retesting your report.
15+
If you’re invited to retest the vulnerability, you’ll receive a notification in your email to retest the report.
1616

17-
![retesting email for original reporter](./images/retesting-6.png)
17+
![retest hacker invitation email](./images/retest-invitation-email.png)
1818

1919
To participate in the retest:
20-
1. Click <b>View retest invitation</b> in your email.
21-
2. <b>Accept</b> or <b>Reject</b> your invitation for retesting. <i>Note: The invitation is only valid for 24 hours.</i>
2220

23-
![retesting invitation](./images/retesting-2b.png)
21+
1. Click **View retest** in your notification email.
22+
2. Check to see that the vulnerability has been fixed.
23+
3. Submit your findings in the **Retest findings** form at the bottom of the report. The form consists of these fields:
24+
* Are you able to reproduce the vulnerability report?
25+
* Please provide us with a short summary of how you retested the vulnerability and upload any attachments of your validations.
2426

25-
3. Familiarize yourself with the contents of the report and check to see that the vulnerability has been fixed.
26-
4. Click the <b>answer these questions</b> link in the report banner or just scroll to the bottom of the report to access the questionnaire.
27+
![retest form](./images/retest-findings-form.png)
2728

28-
![retesting-2](./images/retesting_update_3.png)
29+
4. Click **Submit**.
2930

30-
5. Answer these questions in the questionnaire:
31-
* Are you able to reproduce the vulnerability?
32-
* Are you able to identify a bypass to the fix?
31+
The program can either approve or reject your results. If they choose to:
3332

34-
![retesting questionnaire](./images/retesting_update_1.png)
33+
Action | Scenario | Details
34+
------ | -------- | -------
35+
**Approve and resolve** the retest | You say the vulnerability is fixed. | You’ll be awarded a $50 bounty. <br><br>The report will close and will be marked as *Resolved*.
36+
**Reject** the retest | You say the vulnerability is fixed. | The program will provide you with a summary explaining why they’ve rejected the retest. They can choose to request another retest for the vulnerability. <br><br>The status of the report will be changed to Triaged. the report will be changed to *Triaged*.
37+
**Approve** the retest | You say the vulnerability is not fixed. | You’ll be awarded a $50 bounty. <br><br>The report will move back to *Triaged* and will stay open for the program to implement a fix.
38+
**Reject** the retest | You say the vulnerability is not fixed. | The program will provide you with a summary explaining why they’ve rejected the retest. The program can choose to request another retest for the report. <br><br>The status of the report will be changed to *Triaged*.
3539

36-
6. Submit a new report if you found a new vulnerability by clicking on the <b>submit a new report</b> link, and enter the report ID number in the <b>Report ID</b> field.
40+
### Claiming Retest Opportunities
41+
If you’re not the original hacker, and the original hacker of the report chooses to reject the retest, you and other hackers can claim the retesting opportunities depending on your retesting rights.
3742

38-
![retesting-4](./images/retesting-4b.png)
43+
If the program is:
3944

40-
7. Provide a short summary of how you retested the vulnerability and upload any attachments of your validations.
45+
Program Type | Details
46+
------------ | --------
47+
Private | If you’re part of the private program offering retests, you can find and claim the retesting opportunities under **Hacker Dashboard > Retesting**.
48+
Public | You’ll be able to claim retests for programs where you submitted at least 1 valid vulnerability (the report is resolved or triaged) under **Hacker Dashboard > Retesting**.
4149

42-
![retesting summary and attachments example](./images/retesting-5c.png)
50+
To claim a retest:
51+
1. Go to **Hacker Dashboard > Retesting**.
52+
2. Click **Claim retest** for the retest you’re interested in. Keep in mind that you can only claim and work on 1 retest at a time. Upon claiming a retest, you’ll have 24 hours to complete the retest.
53+
3. View steps 3 and 4 in the section above to complete the retest.
4354

44-
8. Click <b>Submit</b>.
45-
9. Click <b>Yes!</b> to finalize your submission.
46-
47-
![retesting-5](./images/retesting_update_4.png)
48-
49-
Upon completion, you'll be awarded with a $50 bounty.
55+
### Managing and Viewing Retests
56+
You can keep track of all of your retesting work under Hacker Dashboard > Retesting. You’ll be able to:
57+
* Claim open retests
58+
* See which retest you need to complete and the time you have left to complete it.
59+
* View all of your completed retests

0 commit comments

Comments
 (0)