Say you find an exploit... What do you do?

DarkerAds said:

Say you find an exploit and can exploit it for profit. and you know you can get away with it.

Would you exploit it for max profit? or would you report it to the company and hopefully have a nice reward?

Click to expand...

Gogol said:

I would disclose the vulnerability responsibly by contacting the company and giving them reasonable time to fix the issue before making it public.

In any case, I wouldn’t exploit the bug directly. I could still benefit from it either through a bug bounty or by creating a video that explains the process for others to learn from (ofcourse, after the bug has been fixed, or the time has passed).

Click to expand...

satyr85 said:

Its all about how likely are legal problems because of exploiting this expolit.

If there is no bounty program its possible that you wont get anything for reporting this exploit.

Click to expand...

DarkerAds said:

@Gogol hey, I tried to do the right thing, man!

Click to expand...

Gogol said:

Have you tried reaching out to them directly? Many companies run private bounty programs, and they usually appreciate those kinds of tips.

Click to expand...

DarkerAds said:

Thing is that I believe that management know about it, but they think it's not worth it for someone to exploit it, so they won't do anything about it, and if someone came and told them about it, their reply could be "yeah, we know about it, but it's not worth it to abuse it."

Click to expand...

Gogol said:

I don’t know, I personally think if I have the skill to detect such a vulnerability, may be I would do something constructive with the skill instead of ruining other people’s businesses. But that’s just me.

Click to expand...

MiSparrow said:

Depends on the company tbh. If it’s some greedy corp that’s already swimming in billions, I’d definitely be tempted. But honestly, most exploits get burned pretty fast, and you can get into serious trouble. Reporting it officially and getting a bounty — you sleep well, plus +100 karma for your resume. So yeah, it’s basically a choice: quick cash now or long-term reputation

Click to expand...