Burp Suite User Forum

Create new post

External Service Interaction - Bug Bounty?

krypt0mux | Last updated: Feb 05, 2019 06:36AM UTC

I have found an external service interaction issue on a website that is listed in hacker one, I want to send a report, but, I'm not sure how to come up with a proof of concept to send to them. I have recently reported an external service interaction bug, but the company asked for a poc and I had no idea where to begin. First of all I used burp suite pro active scanning to find the issue and then I used Collaborator to send of a valid dns payload to the server and I then after that I got a response, which is good so far. But, What do I do next in order for my bug bounty to get approved? And is showing them Burp Collaborator payload response enough?

Liam, PortSwigger Agent | Last updated: Feb 06, 2019 11:51AM UTC

Blake, we'd recomend contacting the bug bounty program and asking for clarification of their requirements. If you need assistance verifying a Burp issue, you can send any relevant information to support@portswigger.net.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.