This past weekend a client of mine had a pretty annoying taste of XSS (cross-site scripting) injection. A script kiddie found a couple of unfiltered forms which allowed users to input enough HTML to be able to raise a prompt on the homepage.
Nothing serious. All user data was secure. But after having to spend well over an hour scrubbing the database looking for any other possibly more discrete attacks, I decided to delve deeper into what bigger players have been doing in order to mitigate these sort of attacks.
One site led to another, and next thing I know I'm reading articles by so called White Hat Hackers, describing their day-to-day and the currently booming bug-tracking business.
White Hat Hackers are the good guys of the online security industry. They research and develop testing methodologies to safeguard against security threats on a system. They learn to think and act like a malicious hacker, preemptively launching attacks evil-doers may perpetuate in order to prevent them.
In previous years I had read about how Google and Facebook pay rewards for finding security bugs.
What I wasn't aware of is how profitable being a true security bounty hunter could be.
I won't include any figures since I haven't received a single payout for this sort of business. Yet. But I do intend to find out if things are as good as they've been painted.
In writing this post I'm creating a precedence. Leaving a trail if you may. Given the current state of affairs with big-brother-like figures world-wide having access to my data and taking into account that my browser history is about to begin looking quite a bit shady, I'd rather leave no loose ends which I may regret later.
I intend to seriously pursue White Hat Hacking as a side-business. But, before initiating any activity related to White Hat Hacking I want to make clear what I intend to do and what I will most definitely avoid doing:
First of all, I will do no harm. When talking about online security, we speak of keeping users' data safe. Altering or disclosing user data without consent is harmful. I will do neither.
Any of what will be my so-called "hacking activities" will only be performed after written consent and agreement is provided from the party/parties in charge of the systems which will be scrutinized. The same is to be for any monetary gain to be made from these activities.
In order to complete any of my "hacking activities" I will only use tools which can be acquired through legal means.
I will denounce to the appropriate authorities anything uncovered through the analysis of a system that, to my knowledge, would be deemed illegal.
The information gathered through my "hacking activities" will only be used to provide a report to the party in charge of the pertaining analyzed system.
I will put user data safety above any monetary gain.
Having stated the previous, I can only say I feel quite excited about the things I'm about to learn. Knowledge is power, and I see a big potential to do a lot of good and make the web a lot safer with this knowledge.