Opening Keynote – Dr. Katie Paxton-Fear
summary
Shows concrete bugs and payouts: a graphql multipart endpoint reveals server tech, a Jackson deserialization chain triggers an application‑level DoS and nets a $2,000 bounty split; a CRUD bug exposes private fields (a $775 bounty); a mobile quiz API includes correct answers in JSON, enabling full automation in minutes and earning a $50 duplicate bonus. Workflow uses Burp, Postman, Frida with SSL kill‑switch on an iPad Mini, and Kite Runner for discovery, stressing button‑click reconnaissance, batching pitfalls, and practical exploitability.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:03Keynote background
- 3:31Bug bounty hunting
- 5:43Read the docs story
- 14:14CRUD vulnerabilities
- 17:49Performance vs security
- 23:51API hacking skills
- 27:20Free API hacking course
- 28:02API security future
- 30:58Q&A
- 31:20Identifying APIs in an environment
- 34:10Bounty hunter goals
- 38:02APIs in apps
- 39:08API security trends
- 40:53Chaotic API hacking
- 47:19Bug hunting balance
- 48:04GraphQL introspection
- 49:26API pentesting path
- 51:34Closing
related talks
29mThe Smörgåsbord of web app hacking
42mHidden Chains: Revealing High-Impact Bugs from Bounty submissions
43mHow The Hack?
58mModern web application bugs
41mI’m an API Hacker and Here’s How I Hack Everything from the Military to AI
27mCommon Application Security Mistakes that Enable Automated Attacks
37mFrom DevSecOops to Security Success: The Bug Bounty Effect at FINN.no
32mSaving Bug Bounties from AI Slop