Kusagadzikana Kwezvidziviriro Nemibairo (Vulnerabilities And Bounties)
Tinobhadhara mibairo (bounties) pamusoro pekusagadzikana kwezvidziviriro kana nyaya dzine chekuita nechengetedzo dzinowanikwa. Kuti mubhadharwe, zvinotevera zvinofanira kuva zvechokwadi.
#1 Kusagadzikana kunofanira kuva kwakasiyana
Kana tikagamuchira mishumo yakawanda, wekutanga kuzivisa ndiye achawana mubairo. Tinogona kubhadhara, sezvatinoona, mari diki yekuzivisa kwechipiri kuti tikurudzire kuwanikwa kwemamwe mune ramangwana.
#2 Kusagadzikana kunofanira kugona kudzokororwa
Hatibhadhari kusagadzikana kupi zvako kusingagoni kudzokororwa. Hatibhadhari mibairo pamavhidhiyo eYouTube anoratidza kusagadzikana kusingagoni kudzokororwa.
#3 Kunofanira kuva nemamiriro ekurwisa
Kurwisa kunofanira kuva nekugona kugovera kuburikidza nemasystem edu. Ndapota tsanangurai kugona kugovera. Semuenzaniso, kushandisa API yedu uye wobva wanyora zvikripiti zvine ngozi hazvibvumirwi nokuti hazvisiyani nekungonyora peji rine zvikripiti zvine ngozi.
| Boka | Mienzaniso | Mubairo |
| Kuitisa kodhi kuri kure | Command injection, deserialization bugs, sandbox escapes | $200 – $800 |
| Kupinda pasina muganhu muna file system kana database | SQL injection, arbitrary file read/write | $500 – $2,000 |
| Zvikanganiso zveLogic zvinoburitsa kana kudarika zviridzo zvakakosha zvechengetedzo | Direct object reference, privilege escalation, remote user impersonation, account takeover | $200 – $1,000 |
| Kusagadzikana kweMepu Chengetedzo | Improper map exposure, secure-map data leak | $100 – $500 |
| Kuitisa kodhi pa client | Stored XSS, reflected XSS | $100 – $500 |
| Kumwe kusagadzikana kwechengetedzo kwakakodzera | CSRF, clickjacking, info disclosure, open redirect | $25 – $200 |
Mashandisirwo anoitwa kuziva huwandu hwemibairo
Boka rimwe nerimwe riri pamusoro rine huwandu hwekubhadhara. Kwainoguma ripoti rakakodzera mukati mehuwandu hwayo kunoenderana nezvinhu zvitatu:
Pfuma yekubvumirwa inodiwa kuti iishandiswe. Zvikanganiso zvisingade kuzivikanwa zvinoguma pamusoro pehuwandu. Zvikanganiso zvinoda mushandisi akazivikanwa zvinoguma pakati. Zvikanganiso zvinoda mamiriro ane pfuma yakakosha (team admin, team owner, paid plan, internal staff) zvinoguma pasi.
Kukura kwekukanganisa. Kusagadzikana kunokanganisa mushandisi wese kana mepu yese kunobhadhara zvakawanda kupfuura kusagadzikana kunokanganisa akaundi imwe chete kana timu imwe chete yauri kurwisa ari mairi kare.
Kugona kudzorerwa. Kukuvara kungadzorerwa nemushandisi akakanganiswa kuburikidza nenzira dzakajairika (semuenzaniso, kugadzirisazve password) kunobhadhara zvishoma kupfuura kukuvara kunogara kana kunoda kupindira kwedu kuti kudzorerwe.
Mhando yeripoti inobvumawo. Ripoti rakajeka rine proof of concept inoshanda, kuongorora chikonzero chepamusoro, uye mazano ekugadzirisa rinogona kuwana pamusoro pehuwandu kunyangwe kana kukanganisa kwetekinoroji chete kwaizoguma pakati. Mishumo isina hanya kana yekufungidzira inogona kuwana pasi.
Zvakadzika kunze kwechikamu
Zvinotevera hazvikodzeri mubairo:
Mepu dzemuzinda dzisina mugari. Mepu dzisina muridzi dzinogona kugadziriswa nemunhu ose chinhu chemuzinda chakapfuura nguva refu. Kuchengeta pamusoro pemepu isina mugari hakusi kusagadzikana.
Mepu dzisina kunyorwa (Unlisted) (URL-as-credential). Mepu dzisina LockView dzinoitwa kuti dzive dzinowanikwa nemunhu ose anoziva URL, senge vhidhiyo yeYouTube isina kunyorwa. Kupinda kana kuchengeta mepu yakadaro nekuziva map code yayo kunoitwa nechinangwa.
Software yevamwe yatinochengetera asi tisingachengete. Nyaya dziri muGeoServer, Tomcat, kana mamwe mastack evamwe akaiswa pamwe chete nemasevhisi edu. Ndapota ripotai izvi kuvachengeti vepamusoro vazvo.
Misoro yechengetedzo yausipo isina mamiriro ekurwisa chaiwo. Mishumo pamusoro peCSP, X-Frame-Options, HSTS, nezvimwe isina exploit inoshanda haikodzeri.
Rate limiting zvega. Kushaikwa kwerate limiting pa endpoints pasina rate limiting yakakosha kuchengetedzo, pasina mamiriro ekushandisa zvisina kunaka akaratidzwa.
Kushandiswa kweAI
Tinoshandisa AI kuita kuongorora kwekutanga kwekuronga. Dzimwe nguva inoita zvikanganiso, tinoita ongororo dzevanhu pamwe nepamwe, asi kana muchifunga kuti AI yaita kukanganisa kukuru pakutanga, wedzerai nyaya (note) kuripoti nemamwe mamiriro nezvimwe..compromise any
Kushandiswa kweBurp / Endpoints
Tinoshandisa maturusi senge burp pakuongorora kwakakurumidza. Kazhinji tinoda kuti musaite scans idzi pamusoro pedu nokuti kurova nezviuru zvezvikumbiro kunongoisa mutoro usingadiwi pamaseva edu.
Kuti tikuponese nguva heano mamwe maendpoints:
https://www.scribblemaps.com/
(Kana muchiita scan vharai nzira ye /maps/ nokuti izvi zvichatumira mascanner mubhomba risingaperi)
https://team.scribblemaps.com
https://manage.scribblemaps.com
https://widgets.scribblemaps.com
https://api.scribblemaps.com
https://data.scribblemaps.com
Mibhadharo
Hapana zvivimbiso pamusoro penguva dzekubhadhara. Tinogovera bhajeti yemwedzi nemwedzi, nyaya dzakakomba dzichibhadharwa dzekutanga nguva dzose. Tinobhadhara chete kuburikidza ne wise kana paypal.
Kurasikirwa Nemubairo
Kuongorora kana kugamuchira ripoti kunogadzira kukodzera mubairo, kwete kodzero isina mamiriro yekuuwana. ScribbleMaps inogona kudzikisa kana kubvisa mubairo wose kana chikamu kana maitiro omunhu anoongorora achityora mitemo iyi kana mitemo yekuzivisa kwakanaka kunoitwa pamwe chete. Kurasikirwa kunoitwa sezvinoona ScribbleMaps; chikonzero chinonyorwa paripoti uye chinozivisirwa muongorori.
Mubairo wawaizobhadharwa unogona kurasikirwa nekuda kwechero chezvinotevera:
- Kuzivisa pachena kusati kwakwana kana kutyisidzira. Kuzivisa kusagadzikana — kana kutyisidzira kuzviita — pachena, kuvamwe, kana kuburikidza nemakanzuru eparutivi/zvekutaurirana ScribbleMaps isati yagadzirisa nyaya yacho uye yabvumira kuzivisa. Kuzivisa kunoitwa pamwe chete mamiriro eprogiramu.
- Kumanikidza, kutyisidzira, kana kutambudza. Kuisa kusazivisa pamusoro pekubhadharwa; kutyisidzira kana kumanikidza vashandi; kana kushandisa support, billing, kana makanzuru emuongorori kukumbira mari zvakare nezvakare kana nenzira yekutuka. Mibvunzo yemamiriro emubairo inofanira kuendeswa kuburikidza ne bounty portal, iyo ScribbleMaps ichapindura.
- Zvitupa zvakawanda kana zvakapetwa. Kushandisa akaundi yemuongorori inopfuura imwe, kana kutumira mibairo yeakaundi dzakasiyana kuadhiresi yekubhadhara imwe chete, kuti uwedzere huwandu hwemishumo kana mibairo.
- Kubatana kana mhinduro dzakagadzirwa. Kubatanidza mishumo kuburikidza neakaundi dzakasiyana, kushandisa akaundi kana mepu yemumwe mubatanidzwa se“mukuvadzwi” muproof of concept, kana kugadzira mamiriro edata isingagoni kugadzirwa neprodhaka wobva wataura data inobuda seyakabuda.
- Kuedza kuri pasi kana spam yakazvimiririra. Kutumira zvakawanda zvakabuda mu scanner zvakazvimiririra, marondedzero emalaibrari akare/CVE, kana zvinhu zvinozivikanwa zviri kunze kwechikamu (ona Zvakadzika kunze kwechikamu) pasina exploit inoratidzwa, chaiyo kuScribbleMaps.
- Kuedza kunokuvadza kana kusiri pamutemo. Kupinda, kushandura, kana kutora data yevamwe vashandisi kupfuura zvishoma zvinodiwa kuratidza nyaya; kuderedza kana kuramba sevhisi; kunyengera vashandi kana vashandisi; kana chero chiitiko chakarambidzwa nechikamu cheprogiramu kana mutemo unoshanda.
- Kunyepa kana chinyengo. Kunyepa nhanho dzekudzokorora, uchapupu, mazuva ekuwana, kana kuzivikanwa.
Zvinyorwa (Notes).
- Kurasikirwa kunogona kuva kwechikamu (mubairo wakadzikiswa) kana kwakazara ($0).
- Ripoti rakasimbiswa rinorasikirwa nekuda kwemaitiro akaipa harichakodzeri zvakare pamhinduro imwe chete.
- Mitemo iyi inoshanda kubva panguva yekutumira uye inodzokororwa muchiziviso chekugamuchirwa chinotumirwa kana ripoti rabvumirwa.
Kutumira Ripoti (To Submit a Report)
Ndapota shanyirai: https://api.scribblemaps.com/vulnerabilities
Saiti iyi inewo mirayiridzo yekutumira mishumo kuburikidza neAI. Munofanira kupinda kuti mutumire ripoti.
Zvekutemera mutemo
Hatigoni kupa mibairo kuvanhu vari pamarondedzero emasanctions, kana vari munyika (semuenzaniso Cuba, Iran, North Korea, Sudan neSyria) dziri pamarondedzero emasanctions. Imi muri vanopindura pamusoro pezvinokonzerwa nemutero zvichienderana nenyika yamunogara uye mugari wenyika. Pangavawo nezvimwe zvirambidzo pakugona kwenyu kupinda zvichienderana nemutemo wenzvimbo yenyu.
Ichi hachisi makwikwi, asi ndiprogiramu yekuedza uye yemibairo yakasarudzika. Munofanira kunzwisisa kuti tinogona kukanzura progiramu chero nguva, uye sarudzo yekuti tibhadhare mubairo kana kwete inofanira kuva yedu chete.
Zvechokwadi, kuedza kwenyu hakufanirwi kutyora mutemo upi zvawo, kana kukanganisa kana kuvharira data risiri renyu.
Zvakagadziridzwa kekupedzisira