Burpsuite Repeater blocked by WAF (Cloudflare)

I am testing this private program and I get error code 1020 when using Repeater.

The weird part is:

- I can browse the website without getting any error

- When going to burpsuite history, the urls work perfectly (200 status). However when I forward the url to repeater it gives me error 1020

- On repeater I did not change any data from the request but it still gives me error 1020 when I forward it

Things I tried:

- change user-agent

- turn off all burp extension

Any tips or advise on this?

https://redd.it/1fftkhk
@r_bugbounty

Reddit

From the bugbounty community on Reddit

Explore this post and more from the bugbounty community

Signal Requirement Box

this message makes me stressed , i have found 3 bugs and reported it , 1 resolved and 2 triaged ( these 3 is medium severity ).
should i wait for remain 2 bugs to be resolved and report again ? i have only 3 left. ( i fear to lose all my trial reports ),
and when the signal would be calculated ? ,
and how much trial reports will be when signal is calculated ?

https://redd.it/1fft598
@r_bugbounty

Reddit

From the bugbounty community on Reddit

Explore this post and more from the bugbounty community

Hey, I am stuck and need help with bypassing the 403 error for admin directory.

Response

I was trying to bypass 403 error for admin directory and tried testing with different methodologies. I tried brute forcing User-Agents which gave 200 OK response for some of the user agents. But, still it does not show the content of the page as in the response in the attached image.

As per my assumption, it could be due to different geolocation but I am not sure. What could it be?

https://redd.it/1ffomhx
@r_bugbounty

Bug Catching Money Expectations

Hello guys, I've recently started learning hacking, in particular, training to be a bug bounty hunter one day. I don't plan on doing this as a full time job, I most likely plan on becoming a teacher, but I think this would be a nice side gig considering the relatively low teacher salaries where I come from. My question is: how realistic is it to earn money consistently doing bug bounties? If I become an experienced bug hunter (say 5+ yrs of exp) how realistic is earning say 500$ in 1-2 months time? (or doing 10hr/week amount of work) I'm not looking to score big, just small steady side income would suffice. Thanks in advance to all who answer.

https://redd.it/1f9nlvz
@r_bugbounty

Reddit

From the bugbounty community on Reddit

Explore this post and more from the bugbounty community

403 bypass

Does 403 bypass considered a bug?

https://redd.it/1f9rkxm
@r_bugbounty

Reddit

From the bugbounty community on Reddit

Explore this post and more from the bugbounty community

What's a sustainable way to be successful in bug bounties?

I have a very frustrating experience with bug bounties, where every time I get back in I give up after a few weeks and don't look back at it for a couple of months. It's like that sweet pain that hurts but you like it, I really want to be successful in bug bounty. Any tips?

https://redd.it/1f9mjuz
@r_bugbounty

Apple bug bounty

How long does you waited for first respond from apple. I reported today a p1 bug and im really excited

https://redd.it/1di3613
@r_bugbounty

Reddit

From the bugbounty community on Reddit

Explore this post and more from the bugbounty community

Why does Synack look for CPTS cert but not CBBH to start bug bounties?

So I’m doing Hack the Box CPTS certification course. I want to do Synack and that cert is listed as one of several certifications that if applicant has can skip interview process.

However, they don’t let you do this with Hack the Box CBBH certification, which I wouod think would be more relevant of the two.

Why is this? Is Synack more focused on network pentesting than web?

https://redd.it/1dhqvbo
@r_bugbounty

Reddit

From the bugbounty community on Reddit

Explore this post and more from the bugbounty community

Google yearly CTF competition ?
https://redd.it/1dhntdh
@r_bugbounty

Bug bounty help

I submitted a bug report to HackerOne's program 20-25 days ago and have not received any response from the concerned team. Despite sending multiple follow-up emails, I only received a response 12 days ago. In their reply, they stated that they had other priorities and could not address my report promptly. I was surprised by this dismissive response, especially considering that if a hacker exploits this bug, they could potentially dump 300TB of data.

https://redd.it/1dbmijt
@r_bugbounty

Reddit

From the bugbounty community on Reddit

Explore this post and more from the bugbounty community