Adding guidance.md

bugcrowd · Oct 16, 2024 · 286fea9 · 286fea9
1 parent 8070209
commit 286fea9
Show file tree

Hide file tree

Showing 14 changed files with 26 additions and 1 deletion.
diff --git a/...entication_and_session_management/excessive_json_web_token_lifetime/guidance.md b/...entication_and_session_management/excessive_json_web_token_lifetime/guidance.md
@@ -0,0 +1,5 @@
+# Guidance
+
+Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed up triage time and result in faster rewards. Please include specific details on where you identified the vulnerability, how you identified it, and what actions you were able to perform as a result.
+
+Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC).
diff --git a/...b_token_(JWT)_lifetime/recommendations.md → ...son_web_token_lifetime/recommendations.md b/...b_token_(JWT)_lifetime/recommendations.md → ...son_web_token_lifetime/recommendations.md
diff --git a/...json_web_token_(JWT)_lifetime/template.md → ...ssive_json_web_token_lifetime/template.md b/...json_web_token_(JWT)_lifetime/template.md → ...ssive_json_web_token_lifetime/template.md
diff --git a/...d_session_management/secret_questions_used_for_account_verification/guidance.md b/...d_session_management/secret_questions_used_for_account_verification/guidance.md
@@ -0,0 +1,5 @@
+# Guidance
+
+Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed up triage time and result in faster rewards. Please include specific details on where you identified the vulnerability, how you identified it, and what actions you were able to perform as a result.
+
+Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC).
diff --git a/...on_management/secret_questions_used_for_account_verification/recommendations.md b/...on_management/secret_questions_used_for_account_verification/recommendations.md
@@ -2,4 +2,4 @@
 
 Do not use secret questions for user verification. 
 
-Other methods of user verification that do not rely on potentially guessable and static information should be used. For example, two-factor authentication. 
+Other methods of user verification that do not rely on potentially guessable and static information should be used. For example, Two Factor Authentication (2FA). 
diff --git a/...ient_security_configurability/weak_json_web_token_hashing_algorithm/guidance.md b/...ient_security_configurability/weak_json_web_token_hashing_algorithm/guidance.md
@@ -0,0 +1,5 @@
+# Guidance
+
+Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed up triage time and result in faster rewards. Please include specific details on where you identified the vulnerability, how you identified it, and what actions you were able to perform as a result.
+
+Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC).
diff --git a/...JWT)_hashing_algorithm/recommendations.md → ...oken_hashing_algorithm/recommendations.md b/...JWT)_hashing_algorithm/recommendations.md → ...oken_hashing_algorithm/recommendations.md
diff --git a/...token_(JWT)_hashing_algorithm/template.md → ...n_web_token_hashing_algorithm/template.md b/...token_(JWT)_hashing_algorithm/template.md → ...n_web_token_hashing_algorithm/template.md
diff --git a/...ive_data_exposure/sensitive_information_disclosed_in_json_web_token/guidance.md b/...ive_data_exposure/sensitive_information_disclosed_in_json_web_token/guidance.md
@@ -0,0 +1,5 @@
+# Guidance
+
+Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed up triage time and result in faster rewards. Please include specific details on where you identified the vulnerability, how you identified it, and what actions you were able to perform as a result.
+
+Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC).
diff --git a/...n_json_web_token_(JWT)/recommendations.md → ...osed_in_json_web_token/recommendations.md b/...n_json_web_token_(JWT)/recommendations.md → ...osed_in_json_web_token/recommendations.md
diff --git a/...losed_in_json_web_token_(JWT)/template.md → ...n_disclosed_in_json_web_token/template.md b/...losed_in_json_web_token_(JWT)/template.md → ...n_disclosed_in_json_web_token/template.md
diff --git a/...sensitive_data_exposure/sensitive_information_disclosure_robots_txt/guidance.md b/...sensitive_data_exposure/sensitive_information_disclosure_robots_txt/guidance.md
@@ -0,0 +1,5 @@
+# Guidance
+
+Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed up triage time and result in faster rewards. Please include specific details on where you identified the vulnerability, how you identified it, and what actions you were able to perform as a result.
+
+Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC).
diff --git a/...isclosure_-_robots_txt/recommendations.md → ..._disclosure_robots_txt/recommendations.md b/...isclosure_-_robots_txt/recommendations.md → ..._disclosure_robots_txt/recommendations.md
diff --git a/...ation_disclosure_-_robots_txt/template.md → ...rmation_disclosure_robots_txt/template.md b/...ation_disclosure_-_robots_txt/template.md → ...rmation_disclosure_robots_txt/template.md
Original file line number	Diff line number	Diff line change
Expand Up		@@ -2,4 +2,4 @@

		Do not use secret questions for user verification.

		Other methods of user verification that do not rely on potentially guessable and static information should be used. For example, two-factor authentication.
		Other methods of user verification that do not rely on potentially guessable and static information should be used. For example, Two Factor Authentication (2FA).