My First Big Bounty

Hi everyone,

I’m Mazin Mohamed from Sudan, final year student in Electronic Engineering, a bug hunter , and Also a CTF player.

Today I’ll talk about how I got my first bounty as a bug hunter.

I’ll call the company as target.

So it was Kinda easy finding, I used this shodan to get the IPs that belongs to the company and httpx to check if there was another live ports that didn’t show in shodan.

shodan search ssl:target --fields ip_str,port --separator " " | awk '{print $1":"$2}' | httpx -p 80,88,81,8888,8080,8081,8443,443 -o target-shodan

after I got them all I passed the file to nuclei, waited forever and Booom! when I saw the results there was log4j hit in an IP address

nuclei -l target-shodan -t ~/nuclei-templates/ -o results

I Quickly reported it to the program and Got P1 .