HackerOne: How the Bug stole hacking

2019-12-20T19:05:22
ID H1:762510
Type hackerone
Reporter the_arch_angel
Modified 2019-12-20T19:36:07

Description

In light of the season - here's a story I wrote for you:

``` Every hacker down in Hackerone liked hacking alot, But the Bug who lived down in the source code, did not!

The Bug hating hacking! The whole Bug-hunt season! Now please don’t ask why. No one quite knows the reason.

It could be perhaps, that his impact was too low. It could be just that he was too hard to repro.

But I think that the most likely reason of all May have been that his CVSS was too small.

But whatever the reason, his skiddies or account hijackers, He stood there on hunting-eve hating the hackers,

Staring down from his app with a sour Buggy frown, At the warm-lighted monitors that glow in their town,

For he knew that every hacker down in Hackerone crew, Was busy now finding more Bugs anew!

“And their low-hanging IDORs” he snarled with a frown. “They’ll find me soon, too! I’m sure to be found!”

Then he growled, with his Bug fingers nervously drumming, “I must find some way to keep the hackers from coming!

For tomorrow, I know all my hacker foes and fiends Will wake bright and early. They’ll rush to their screens!

And then! Oh the bounties! Oh the bounties! Bounties! Bounties! There’s one thing I hate! All the BOUNTIES! BOUNTIES BOUNTIES!

Then the hackers, young and old, will sit down for a hunt, And they’ll hunt! And they’ll hunt! And they’ll HUNT! HUNT! HUNT! HUNT!

They’ll hunt on Paypal, and good ol Gitlab, For Gitlab’ an app that pays out quite fab!

And then they’ll do something I hate most of all! Every hacker down in Hackerone, the tall and the small,

They’ll stand at the ready, with their bitcoin addresses. They’ll stand close-together finding developer’s messes!”

“And they’ll hack! And they’ll hack! And they’ll HACK! HACK! HACK! HACK!” And the more the Bug thought of this hacker bug-bash, The more the Bug thought, I must stop cause this to crash!

Why for fifty-three cycles I’ve put up with it now! I must stop the hunters from hacking! But how?”

Then he got an idea! An awful idea! The Bug got a wonderful, awful idea!

“I know just what to do!” The Bug laughed in his throat. “I’ll make a quick hacker hat and hoodie coat.”

And he chuckled and clucked, “What a great buggy joke! With his hoodie and black jeans, I’ll look just like Saint Stok!”

“All I need is a 0-day.” The Bug looked around. But since 0-days are spendy, there was none to be found.

Did that stop the Bug? Hah! The Bug simply said, “If I can’t find an 0-day, I’ll make one instead!”

So he took his own keys, and his IP-address, And published it on Github, a public repo no less!

Then he loaded some bags and some sacks made of wool, On an old Stok skateboard, and a bunch of Redbull,

Then the Bug said, “Giddyap!” and the board started going, Towards the Live-event hotel where the hackers lay a-snooze in their town.

All their monitors were dark. No one knew he was there. All the hackers were all dreaming of bounties paid fair When he came to the first little laptop of the square.

“This is stop number one,” the old Buggy Stok hissed, As he climbed to the keyboard, empty bags in his fist.

Then he rooted the laptop, a fit a bit too snug, But if Stok could root it, then so could the Bug.

He got stumped only once, for a minute or two. Then he saw all the installed apps, some of which he knew

Where Tomnomnom’s tools were all installed in a row. “This Burpsuite,” he sneered, “Is the first thing to go!”

And he slithered and slunk with a smile mostly cruel, Around the whole laptop, and he torched every tool!

Metasploit, sublister, shodan, and zap! Trufflehog, censys, and every other app!

And he stuffed them in directories. And without making a racket, Moved them all over into his own s3 bucket.

Then he pivoted to next machine as quick as a flash. Why that bug even cracked the sha-256 hash!

Then he stuffed all the notes to his bucket with glee. “Now,” grinned the bug, “I will steal the bounties!”

As the Bug stole the bounties, and he started to shove, He heard a small sound like the coo of a dove.

He turned around fast, and saw a bug hoarder! Little Nahamsec, a Youtube recorder.

He stared at the bug and said, “Freddy Stok, why, Why are you taking our tools and bounties? Why?”

But, you know, that old Bug was so smart and so slick, He thought up a lie, and he thought it up quick!

“Why, my sweet little Ben,” the fake Freddy Stok lied, There’s a tool on this laptop that crashes every time.

So I’m checking it out, making a PR, my dear. I’ll hotfix it there, then I’ll bring it back here.”

And his fib fooled the streamer. Then he patted his head, And he got him a beer, and sent him to bed.

And when Ol Ben Sadegipour back with his brisk, He went back to the laptop and wiped the whole disk!

Then he moved on to the next laptop even quicker, And the last thing he took was the H1-702 sticker. The Bug couldn’t have been faster, he couldn’t have been slicker.

And the one bit of data he left on the machine, Was a picture of Ol’ Ben, for he was feeling quite mean.

Then he did the same thing to the other hacker’s lappy’s, From Tommy’s, to Santi’s, to Inti’s, to Naffy’s!

It was quarter of dawn, all the hackers still asleep, All the hackers still a-snooze, when he started to creep,

Loaded up with their tools, their notes, and their findings, Their bitcoins, their bounties, so bright it was blinding.

10 thousand feet away, to his corner of the net, He got ready to sell it, to make quite a profit.

“Pooh-pooh to the Hackers!” he was Buggishly humming. “They’re finding out now that no hacking is coming!

They’re just waking up! I know just what they’ll do! Their mouths will hang open a minute or two Then the hackers down in Hackerone will all cry boo-hoo!

That’s a noise,” grinned the Bug, “that I simply must hear!” He paused, and the Bug put a hand to his ear.

And he did a hear a sound rising over the web. It started to grow, and didn’t start to ebb.

But this sound wasn’t sad! Why, this sound sounded glad!

Every hacker down in Hackerone, the tall and the small, Was hacking without any tools or bounties at all!

And the Bug, with his buggy brain started to think He stood puzzling and puzzling. “Why aren’t in a kink?”

It came without bounties! It came without tools! It came without laptops! How am I such a fool?!

He puzzled and puzzled till his puzzler was sore. Then the Bug thought of something he hadn’t before.

Maybe hacking, he thought, comes an immunity. Maybe hacking, he thought, is all about community!

And what happened then? Well, at Hackerone they say, That the bug’s CVSS grew 3 severities that day!

And the true meaning of hacking came through, And the Bug found the strength of ten hackers, plus two!

And now his heart didn’t feel quite so tight, He whizzed with his loot through the bright morning light

With a smile to his soul, he went back to the hackers, Cherily bringing lots of snacks for the snackers

He road into Hackerone. He brought back their loot. He brought back their bounties and their tools to boot.

He brought back their Burpsuite and their plugins and cash, Brought back their browsers and Metasploit in a flash,

He brought everything back! All the rep points that he found! And he, he himself, the Bug, got his first bounty.

```

Impact

Happy Holidays and thanks for all you do. <3