Bug Bounty Redacted #1: Exposed Redis and HAProxy

Welcome to our new series called Bug Bounty Redacted! In this series we will be going through reports we have submitted to bug bounty programs over the last five years.

This video series will progress in difficulty, with each episode covering some reports that have been submitted to bug bounty programs and have been rewarded.

In this episode, we cover two reports - the discovery of an exposed Redis instance and an exposed HAProxy statistics panel. The discovery process and information about the exact report is shared in this video.

Please like, comment and subscribe! We will be releasing a new video once a month. We look forward to educating you through our bug bounty reports!

[NahamSec]

Love it and love seeing you make more content man. Great work!

[BugBountyReportsExplained]

Great! Looking forward to more episodes of this series

[amit-mishra]

For some reason I am happy these videos are not seen enough

[Studiom]

This is great! Love the idea of this series!

[JaminSoch]

Love the video man! Video for video, you've got the best security research channel on Youtube (Sorry Nahamsec!). I just wish you had more videos!

[exploreThe_]

Useful - new learning - nmap scan can lead to open port exploit - bug bounty

[RespectableMan-cijb]

Thanks for sharing, looking forward to the next!

[edwardlichtner]

Thanks for a great video! It would be helpful to know which bug bounty platform you are using, which categories each of those bugs fell into and what amount of bounty they generated. Looking forward to more episodes.

[ChOkO]

As always such great content! Thanks for sharing 👊🏿😎

[simn]

Wonderful, please share the severity too. Thanks

[TaReN]

6 years ago reports which are not reproducible anymore for like 2 years? Wow

(Redis sets password by default for ~ 2 years now)

[dr.b]

1. You didn't show them a proof of concept. How were you awarded with a bounty since you didn't show them

2. Can you actually help with the particular nmap and netcat command 🙏

3. You talked about keys and config. Which exact command did you run to get those disclosed information.

4. Lastly. Please can you tell the range of bounty awarded on this type of vulnerability.

Thank you

[xbeven]

Add some live labs and your methodology

[danzosow]

You should do it weekly not yearly your contents are valuable