The Bug Bounty Hunter

TL;DR I discovered a one-click account takeover vulnerability in a popular Indonesian Android app called Tokopedia . Th...

Guillaume Kermarrec, who oversees L’Oréal’s Bug Bounty Program and threat/vulnerability management generally for the iconic cosmetics brand, discussed L’Oréal’s hopes for a live Bug Bounty it held in partnership with YesWeHack. Kermarrec, who works at L’Oréal’s CyberDefense Center, reflected on the company’s preparations for the event, which took place in the summer of 2024 during LeHACK, France’s largest hacker convention. He also explained why they decided to open their scopes to some of Europe’s most talented ethical hackers in the context of an intensive, in-person competition. You can also watch highlights from this live hacking event 👉

And read more about the event in our roundup of the scopes, final leaderboard, feedback from hunters, and the benefits of live Bug Bounties 👉

👀👀 Signup for DevSecCon 👉🏼 snyk.co/dscnahamsec LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍 📚 If you want to learn bug bounty hunting from me:

💻 If you want to practice some of my free labs and challenges:

💵 FREE $200 DigitalOcean Credit:

🔗 LINKS: 📖 MY FAVORITE BOOKS: Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities -

Hacking APIs: Breaking Web Application Programming Interfaces -

Black Hat GraphQL: Attacking Next Generation APIs -

🍿 WATCH NEXT: If I Started Bug Bounty Hunting in 2024, I'd Do this -

2023 How to Bug Bounty -

Bug Bounty Hunting Full Time -

Hacking An Online Casino -

WebApp Pentesting/Hacking Roadmap -

MY OTHER SOCIALS: 🌍 My website -

👨‍💻 My free labs -

🐦 Twitter -

📸 Instagram -

👨‍💻 Linkedin -

WHO AM I? If we haven't met before, hey 👋! I'm Ben, most people online know me online as NahamSec. I'm a hacker turned content creator. Through my videos on this channel, I share my experience as a top hacker and bug bounty hunter to help you become a better and more efficient hacker. FYI: Some of the links I have in the description are affiliate links that I get a a percentage from.

Hacking Hackers - Even the software used by teams of offensive security professionals is prone to standard web application vulnerabilities.

Welcome to another blog in the series of Advance Frida Usage. This blog post demonstrates how to use Frida’s Stalker APIs to trace instructions as they execute in a app in real time.

Learn about DORA, the new EU regulation for digital operational resilience, and how to meet the requirements with pentesting.

We are back and testing out a new episode format focusing more on discussion than summaries. We start talking a bit about the value of learning hacking by iterating on the same exploit and challenging yourself as a means of practicing the creative parts of exploitation. Then we dive into the recent Intel SGX fuse key leak, talk a bit about what it means, how it happened. We are seeking feedback on this format. Particularly interested in those of you with more of a bug bounty or higher-level focus if an episode like this would still be appealing? If you want to share any feedback feel free to DM us (@__zi or @specterdev) or email us at media [at] dayzerosec.com

The Resource Owner Password Credentials(ROPC) is one of the Open Authentication(OAuth) flow with a “password” grant type. This grant type…

What is Dependency Confusion?