Inoculating Rails Auth Against Bug Bounty Hunters
summary
Kolide shows concrete bug‑bounty outcomes: a chained exploit of five weaknesses that earned a $1,350 payout and a smaller $250 report, found via HackerOne. The fixes are specific: replace naive Rails cookie sessions with a rotating session token, add continuous password checks (ZXCVBN and Have I Been Pwned via the Pwned gem), enforce time‑based multi‑factor or WebAuthn, tighten CSP with nonces/hashes, and require password re‑prompting for high‑risk actions.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 4:50Bug Bounty Programs
- 6:30Outcomes
- 7:35Attacker Perspective
- 9:08Pitfalls
- 11:34The Hacker
- 17:18Chaining Vulnerability
- 20:19Session Replay Vulnerability
- 22:22Vulnerability Analysis
- 24:38Session Revocation
- 26:33Session Setup
- 27:45Quick Fix
- 29:02Real Money
- 29:24Password Quality
- 31:24Tools
- 32:08Pwned
- 32:57Valid account enumeration
- 34:18Checklist
- 34:59MultiFactor Off
- 37:20Crosssite scripting
- 38:46CSP
- 39:57Audit Logging
- 40:18Password Be Prompting
- 41:33Active Controller Concern
- 43:06Wrap Up
related talks
42mHidden Chains: Revealing High-Impact Bugs from Bounty submissions
45m2014.10.29 - Security@Scale - Katie Moussoris, HackerOne
35mBug Bounty Hunting
37mFrom DevSecOops to Security Success: The Bug Bounty Effect at FINN.no
29mThe Smörgåsbord of web app hacking
37mThe Evolution of Rails Security
43m...But Doesn't Rails Take Care of Security for Me?
53mOpening Keynote – Dr. Katie Paxton-Fear