u/BuyerFar4850

Funny incident

A situation with a bug hunter friend made me think about how triage handles old low-quality reports and duplicates.

When he was just starting out, he created multiple accounts, which I know is generally against platform or program policy. One of those accounts had a very poor report that was quickly marked invalid. Later, after he learned how to write cleaner reports, he found a more serious issue on same target and submitted it from another account because the original one had bad signal.

I ended up collaborating with him on one report, but it was later closed as a duplicate because he had already submitted something related from one of his other accounts , that was just tiny fraction of what he submitted he says.

What this made me realize is that even if a low-quality report is just sitting somewhere in the database, it can still create problems later when another report explains the issue properly. A better written report chained may still get tied back to the earlier weak submission, even if the original report failed to explain the impact clearly or ai slop related reports. He didnot show me the report but he was surprised that only basis of title they just flagged it as duplicate but the earlier report was only tiny bit of impact. I dont know if its program trying to be clever or not .

At this point, I just told him to leave it and move on lol.

reddit.com
u/BuyerFar4850 — 3 days ago

Suggestion - on blind SSRF

Hi if anyone can help me on lead ,

I am new hunter and I found a blind SSRF in an authorized bug bounty target through a server-side document conversion feature.

Confirmed:

  • Server makes DNS and HTTP requests to my OOB listener
  • Request comes from the vendor’s cloud infra
  • It follows redirects
  • Internal/metadata-style addresses seem reachable
  • I cannot read the response body, so I am not claiming data theft

I tried a few safe escalation paths but had no luck making it non-blind.

For blind SSRF reports, is this usually enough impact if internal/metadata reachability is shown? What evidence do triagers usually expect without crossing boundaries? How can i escalate ? I dont think its reportable tbh and any suggestions are appreciated.

reddit.com
u/BuyerFar4850 — 12 days ago