Skip to content
All tags

#idor

2 posts
techguideBug Bounty from Zero

How to Write a Bug Report That Earns the Full Reward: Quality Multipliers, a One-Page Template, and Expected Value

Google multiplies the reward by 0.8, 1 or 1.2 depending on report quality across seven dimensions, and only counts what you provided before triage; later additions usually do not change it. Write to a one-page template (title, summary, preconditions, steps, impact, fix suggestion), then estimate hourly expected value as probability x amount / hours. A bigger ceiling can still lose to a small payout once the odds are low enough. Every probability and hour count in this post is an assumption, not a statistic.

#bug-bounty#security#vulnerability-research#google#microsoft#meta#idor
techguideBug Bounty from Zero

The Two Most Common Web Bugs, XSS and IDOR, and Why Google Pays Them Differently

XSS happens when a site puts user input into a page unchanged, so another person's browser runs it as code; the fix is escaping on output. IDOR happens when a server hands over whatever id it is asked for without checking the record is yours; the fix is an ownership check on the server. Google's table puts XSS under 'execute code on the client' (C0), $10,000 base on a standard Google app, and IDOR under logic flaws (S2), priced by how sensitive the exposed data is: on the same standard Google app, $3,133.7 to $31,337.

#bug-bounty#security#web-security#xss#idor#owasp