Bug Bounty Reports Explained

In this video, Arthur Aires walks us through two real-world deserialization RCEs that include bypassing a class allowlist and then exfiltrating data via DNS.
Techniques you'll want in your toolbox. Enjoy!

RCE via deserialization with a class allowlist bypass and DNS exfiltration with Arthur Aires 📣 Follow Arthur on Twitter: https://x.com/arthurair_es📧 Check out Case Studies: https://bbre.dev/cs✉️ Sign up for the newsletter: https://bbre.dev/nl📣 Fol...

Three years ago, Johan Carlsson was just starting out with bug bounty. Today, he’s GitLab’s TOP1, has bugs on Google and Apple programs, and a reputation as one of the best client-side hackers. Check out our interview🔥

From 0 to a top bug bounty hunter - Johan Carlsson's journey to GitLab TOP1 on Hackerone 📧 Subscribe to BBRE Premium: https://bbre.dev/premium✉️ Sign up for the mailing list: https://bbre.dev/nl📣 Follow me on Twitter: https://bbre.dev/twFollow ...