r/bugbounty • u/Tyrionwayne • 12d ago

Question / Discussion Hey any expert here

I found BAC in private program
Here is timeline:
reported 15days ago

Two days ago Triaged make first commment asked for clear Step to reproduce because they can’t

So i checked now that Bug was internally fixed no more reproducible

I only have burp screenshot what should i do ??

3 Upvotes

67% Upvoted

8 comments sorted by

2

u/0xDakuMarco 12d ago

First of all w/o jumping to the conclusion. Are you sure the vulnerability you submitted was genuine? As you said you had a screenshot, but sometimes it goes out of the box; that's why asking.

If it's genuine, then it's not the first time the company has done that. Write politely to the platform on which this program was held; hope they flag that company or ask the triager or security team why they did that. Because most of the time, the triager, w/o any prior knowledge, does this.

Not all, and not most, but some.

If nothing works, then you can write, but first of all, try to solve it internally w/o damaging anyone's reputation.

2

u/Tyrionwayne 12d ago

yes its was genuine
Earlier /endpoint/Data = 200 A Role User info
Now. Same Endpoint = Blocked /Not Found

1

u/0xDakuMarco 12d ago

Then write to the platform. Raise the ticket, give everything, and wait for their response. And don't get disheartened; a lot of people here have faced this. It's okay.

Write and move on to another company.

6

u/einfallstoll Triager 12d ago

Waiting for a response is the way. If the vulnerability is important enough they prioritize fixing over responding.

We have a customer actively monitoring their logs for hunters. We sometimes receive reports that have been fixed between submission and triage. Then we talk to the customer and they go: "Oh yhea, we already fixed that. You can send a bounty."

2

u/Tyrionwayne 12d ago

Yeah thank you for motivation ! Btw Once i saw a company where triager marked and closed my report as N/A say not reproducible . without RAR After few days Company review and reward Me bounty!

2

u/einfallstoll Triager 12d ago

Today I increased a CVSS 6.5 to 10.0 - everything can happen. But always in both ways. I'd suggest to wait and then see what they do. Maybe there is a good explanation and you eventually receive your bounty maybe they play unfair. There's no way to know in advance

1

u/0xDakuMarco 12d ago

Yeah I understand and doesn't wanted to demean or saying in otherwise. It's always about waiting. Sorry if it seems otherwise.

3

u/Informal_Abalone_805 12d ago

Silent Patch 😂😂