mongo (@mongobug) profile picture

mongo

@mongobug

I like bug bounty programs and breaking things that other people have built. I love kudos.
bugcrowd.com/mongo
Joined February 2015
  • Tweets1.5K
  • Following197
  • Followers10.6K
15Media
Photo by mongo (@mongobug)Photo by mongo (@mongobug)Photo by mongo (@mongobug)Photo by mongo (@mongobug)Photo by mongo (@mongobug)Photo by mongo (@mongobug)Photo by mongo (@mongobug)Photo by mongo (@mongobug)Photo by mongo (@mongobug)
Replying to @mongobug
@mongobug is the greatest
mongo (@mongobug) profile picturemongo@mongobug24 Apr 2024
Replying to @justdionysus
Solved it (a friend sent it to me) and it was pretty fun and different :) ty
1
9
1,486
Apparently people are now holding on to low-medium-high bugs and submitting only crits because otherwise they get less invites on BB platforms? (heard this about H1, but probably true for others). Algorithmic failure if so
3
17
5,777
Someone who reports 10 crits and 5 lows should not logically be "ranked" lower than someone who reports 10 crits and 5 lows (they just reported all they came across). Thoughts or insights into the algorithms, @jobertabma @Hacker0x01 ?
1
6
2,200
I’ve loved watching how the @elonmusk @Twitter thing has impacted #InfoSec — meaning — people who do nothing but tweet all day and are defined by their egos and twitter identity have been freaking the fuck out — people who actually do the work really don’t care. Thoughts?
26
12
5
148
Can't wait for all the crybabies to finally "go to Mastodon" so my feed can stop being all about Elon and Twitter. If you're leaving, close your account and stop tweeting
2
4
34
Perhaps not popular opinion: 99% of "XSS ATO" reports are bullshit, XSS is full access to the account in most cases, you're already in the account and in the browser. Stop trying to increase the impact on that RXSS and find more impactful bugs instead
6
5
71
Let me be clear, Jonathan Scott @jonathandata1 is NOT a mobile security/malware/spyware researcher. Jonathan is neither a skilled bug bounty hunter, nor a mobile security/malware/spyware researcher Jonathan is a professional in fake news marketing.
This Post is from a suspended account. Learn more
4
7
64
Exactly what I've been saying for years. But perhaps you put it more clearly. :)
Julien | MrTuxracer 🇪🇺 (@MrTuxracer) profile pictureJulien | MrTuxracer 🇪🇺@MrTuxracer9 Dec 2020
VDPs are meant to be a simple see-something-say-something way of getting vulnerability reports. Therefore, IMO, VDPs must be without ANY incentives and without ANY scope definition - the only thing required is a safe harbor statement. xitter.cf/mongobug/status/133662…
11
I dont get it either. And this ties to things I said years ago re VDPs being rewarded with "kudos" etc. Also the comments regarding how this is actually detrimental to bug hunters by devaluing the economy are spot on.
ramsexy (@plmaltais) profile pictureramsexy@plmaltais7 Dec 2020
I still don't understand why some hackers are working for some free energy drinks, and then even promote the company afterwards. I guess posting your big stack of energy drinks online gets you a lot of clout, congrats!
Image from ramsexy (@plmaltais)
1
2
1
59
Within a few years all of these Bug Bounty Platforms will be gone if they don't do some adjustments. It wont matter at all if they have 200k or 500k "active" bug hunters. They don't see it yet, but eventually will have to. I look forward to it.
1
2
18
Growing userbase is great but when you alienate the smaller base that really was driving your business.. eventually you find they all went elsewhere. You'll find the big userbase that you still have wont really drive the business anymore. Plenty of examples from other industries.
1
1
15
Just :clap: at this. I don't know Guido but have seen him consistently release code/info/bugs to everyone.
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
1
18
You're not just getting bugs, you get the code to find yet more bugs!
1
This claim about election fraud is disputed
1
8
I’m involved in a new independent academic study of #bugbounty programs and platforms, focusing on the challenges that hackers face: vulnstudy.cs.umd.edu/betterb… Please help us make #bugbounty better by participating! (focus group participants will receive a $20 gift card) please RT! – at Santa Clara, CA
9
113
14
174
Last but not least, our 2019 #BuggyAwards Most Valuable Hacker is @mongobug
Image from bugcrowd (@Bugcrowd)
2
4
2
57
Increasing trend of "recon, recon" tweets make me wonder how much attention the main assets on bug bounty programs are getting these days; it seems the game has shifted more to finding obscure/outdated assets before anyone else, to score a few easy bug submissions
12
20
7
160
In the name of pain, suffering, development, and fresh content, I'm going to be live streaming a new series. I aim to start next week. I blogged (for the first time in ages) to share the details. Pleas have a read, and join me! buffered.io/posts/new-livest…

New Livestream Series

TL;DR We’re going to build a .NET implementation of Meterpreter live on stream. Together. From scratch. Read on for all the details! The Backstory I remember kicking off my first ever live stream on...

buffered.io
19
51
7
158
I love Kudos more than anything else in life. @Hacker0x01 would you consider renaming "reputation" to "kudos"?
3
1
52
With all the billion dollar corporations running either Kudos-only or Reputation-only programs, I wish we could agree on a common currency, as it would make it easier to manage. My bank refuses to convert between Kudos and Reputation, for instance.
6
2
1
52
Load more