Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 600747c

Browse files
martijnrusschenmartijnrusschen
authored
Merge pull request Hacker0x01#438 from whisk3ykilo/program-considerations
2 parents 791e9d8 + d209e93 commit 600747c

File tree

5 files changed

+74
-1
lines changed

5 files changed

+74
-1
lines changed

‎docs/programs/authenticated-testing.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
title: "Authenticated Testing"
3+
path: "/programs/authenticated-testing.html"
4+
id: "programs/authenticated-testing"
5+
---
6+
7+
* HackerOne recommends providing credentials and contextual information to hackers wherever possible
8+
* HackerOne recommends offering elevated rewards for unauthenticated vulnerability findings
9+
* The HackerOne platform includes a secure [credential management feature](https://docs.hackerone.com/programs/credential-management.html) that allows customers to quickly upload multiple sets of credentials
10+
* Includes the ability to provision multiple roles
11+
* Essential for PrivEsc, IDOR, broken authentication, data segregation testing, etc.
12+
* Hackers can claim credentials in the platform and immediately proceed with testing
13+
14+
## Enabling Unauthenticated Testing
15+
16+
* Many HackerOne programs are interested in finding unauthenticated vulnerabilities as they can be exceptionally severe
17+
* HackerOne recommends specifying an elevated reward level for unauthenticated vulnerabilities within either the [bounty table](https://docs.hackerone.com/programs/importance-of-bounty-tables.html) or the policy
18+
* Be sure to provide clarity in your policy on what unauthenticated vulnerabilities are eligible for the elevated reward level

‎docs/programs/good-program.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,4 @@ Set up [bounty tables](bounty-tables.html) as they help hackers to see how much
2121
### Tip #5: Keep your policy up-to-date
2222
Make sure all helpful and important information is written on your [policy](policy-and-scope.html) and that you follow the [best practices for good policies](good-policies.html).
2323

24-
Keep in mind that these short tips don’t guarantee success for your program, but they do help in increasing engagement with hackers. There are a lot of other factors that can affect the success of your program such as the types of assets, the bounty amounts,
24+
Keep in mind that these short tips don’t guarantee success for your program, but they do help in increasing engagement with hackers. There are a lot of other factors that can affect the success of your program such as the types of assets, the bounty amounts, response time, time to bounty, etc.

‎docs/programs/scoping-considerations.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
title: "Scoping Considerations"
3+
path: "/programs/scoping-considerations.html"
4+
id: "programs/scoping-considerations"
5+
---
6+
7+
HackerOne programs perform testing in all different environments. What factors go into deciding which environment or [assets](https://docs.hackerone.com/programs/scope-best-practices.html) are a good fit for the hacker-powered approach? What kinds of "blockers" have the potential to reduce hacker engagement?
8+
9+
Below are some considerations that can help enable testing on more difficult assets.
10+
11+
### Hacker Access
12+
* Is the environment publicly accessible?
13+
* If not, the HackerOne [Gateway VPN](https://docs.hackerone.com/programs/hackerone-vpn.html) may be required
14+
* Do any self sign-up flows require personal information (PII) from hackers?
15+
* Are there geo-restrictions in the application to consider? SMS 2FA requirements?
16+
### Feature Coverage
17+
* Is a non-prod environment an accurate representation of production?
18+
* Is test data representative of production?
19+
* Are any features that should be tested inaccessible to hackers?
20+
* If so, can [identifying hacker traffic](https://docs.hackerone.com/programs/traffic-identification.html) help?
21+
* Do any features require hackers to spend real money? Could this be avoided or reimbursed?
22+
### Sensitive Information
23+
* Does the environment contain sensitive information such as PII or PHI that a hacker could potentially stumble onto?
24+
* Could hacker testing possibly interfere with other types of testing or activity in the environment?

‎docs/programs/traffic-identification.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
title: "Traffic Identification"
3+
path: "/programs/traffic-identification.html"
4+
id: "programs/traffic-identification"
5+
---
6+
7+
There are several ways to identify hacker testing traffic at various layers for testing/feature enablement or testing control & monitoring.
8+
9+
### Application Layer: User Allowlisting
10+
* HackerOne provides each hacker with a forwarding [email address](https://docs.hackerone.com/hackers/hacker-email-alias.html)
11+
* This email can be helpful in identifying hacker testing accounts for allowlisting within the application itself
12+
### Session Layer: HTTP Headers
13+
* Researchers may add headers to requests such as: “X-HackerOne-Research: [H1 username]”
14+
### Network Layer: IP Allowlisting
15+
* HackerOne [Gateway](https://docs.hackerone.com/programs/hackerone-vpn.html)
16+
* Hacker traffic will come from a known CIDR block
17+
* Hacker VPN traffic can be analyzed for insight into asset testing coverage
18+
* Personal IP Check-in
19+
* Limited to the [H1 Pentest](https://docs.hackerone.com/programs/product-offerings.html) product. Used in lieu of [Gateway](https://docs.hackerone.com/programs/hackerone-vpn.html)
20+
### "Human Layer": Hacker Vetting & Communication
21+
* HackerOne [Clear](https://docs.hackerone.com/programs/hackerone-clear.html) researchers
22+
* Custom alert process for each program
23+
* email, phone, [Slack, Teams, PagerDuty, and others](https://docs.hackerone.com/programs/supported-integrations.html)
24+
* HackerOne [API](https://api.hackerone.com)

‎src/pages/programs/programs-nav.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,13 @@
2222
path: /programs/using-markdown.html
2323
- title: Running a Good Program
2424
path: /programs/good-program.html
25+
items:
26+
- title: Authenticated Testing
27+
path: /programs/authenticated-testing.html
28+
- title: Scoping Considerations
29+
path: /programs/scoping-considerations.html
30+
- title: Traffic Identification
31+
path: /programs/traffic-identification.html
2532
- title: Your Program
2633
items:
2734
- title: Homepage

0 commit comments

Comments
 (0)