Day 10: Live Bug Hunting, Target Scope Mapping & Asset Reconnaissance (Sony on HackerOne)

1. Live Bug Hunting & Program Selection

In today's intensive hands-on session at BugXploit, our instructors Birendra Sah and Bishal Shrestha transitioned the workshop from isolated lab configurations (DVWA, Metasploitable 2) to real-world live reconnaissance on public targets.

Before launching any vulnerability assessment, a professional security researcher must understand the bug bounty ecosystem. We started by exploring public crowdsourced platforms, analyzing program classifications across Bugcrowd and HackerOne:

2. Target Analysis: Sony on HackerOne

To conduct a structured, compliant live reconnaissance exercise, we selected the official public program for Sony hosted on HackerOne:

Instructors emphasized that reading the policy is 50% of the battle. Before typing a single command or visiting target subdomains, we verified:

• Eligible In-Scope Domains: Assets owned and operated by Sony (e.g., *.sony.com, select PlayStation web applications, and corporate regional portals).
• Strict Out-of-Scope Exclusions: Denial of Service (DoS/DDoS), physical security attacks against Sony facilities, social engineering / phishing targeting Sony employees, third-party hosted software (e.g., Zendesk, Salesforce) unless misconfigured directly by Sony.
• Safe Harbor Protections: Guaranteeing that legitimate security research conducted strictly within the stated rules will not result in legal action under anti-hacking statutes.

3. Deep-Dive: Corporate Asset Mapping via Crunchbase

One of the most valuable operational techniques introduced today was using Crunchbase (https://www.crunchbase.com/) as an intelligence and scope-expansion engine.

4. DNS Enumeration via DNSDumpster

To convert corporate knowledge into actionable network targets, we utilized DNSDumpster (https://dnsdumpster.com/), an asynchronous DNS reconnaissance tool that pulls data from passive DNS databases, certificate transparency logs, and public zone records.

Key Insights Gained from DNSDumpster:

• Cloud vs On-Premise Footprint: We observed that while critical edge traffic is routed through Akamai and Amazon CloudFront CDNs, certain regional subdomains still resolve directly to Sony Corporation of America AS11351 IP blocks.
• TXT Record Intelligence: Inspecting TXT records revealed third-party enterprise services in use (Microsoft 365, DocuSign, Google Cloud Verification), helping researchers understand their corporate authentication ecosystem.

5. Application Flow & HTML Injection Probing

Once target endpoints were mapped, we initiated manual application flow analysis on public Sony web portals. Rather than firing automated vulnerability scanners (which can degrade server performance and violate program rate limits), our instructors demonstrated precise manual probing:

Step-by-Step Flow Modeling:

1. Traffic Flow: Observing navigation paths: Landing Page → Global Region Selector → Product Catalog → Search Functionality → Account Login / Sign Up.
2. Parameter Identification: Tracking query parameters passed in GET requests during search operations (e.g., https://www.sony.com/en/search?q=wh2_test).
3. Reflection Checking: Determining whether user-supplied input in the search query is reflected in the resulting HTML source code.

<!-- Server Response Rendered in DOM -->
<div class="search-query-display">
  Results for: &lt;h1&gt;TheWH2_Test&lt;/h1&gt;
</div>

6. Advanced Google Dorking for Sensitive Endpoints

Instructors guided us through advanced search engine operator queries (Google Dorks) to discover indexed login portals, developer staging environments, and administrative interfaces across Sony's massive domain estate:

7. JWT Architecture & Decoding via JWT.io

When inspecting the authentication headers on Sony's modern customer portals and API gateways, we encountered JSON Web Tokens (JWT) used for stateless session management:

{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "sony-auth-key-02"
}

{
  "sub": "usr_2026bx90",
  "name": "Chandan Kumar Thakur",
  "role": "user",
  "iss": "auth.sony.com",
  "exp": 1789500000
}

RSASHA256(
  base64Url(header) + "." +
  base64Url(payload),
  privateKey
)

Vulnerability Testing Vectors for JWTs Explained:

• Base64URL is NOT Encryption: Instructors demonstrated that anyone possessing the token can paste it into jwt.io and immediately read the payload. Developers must never store plaintext sensitive secrets (passwords, social security numbers, internal API keys) inside claims.
• Algorithm Confusion Attacks: Testing whether the backend server accepts "alg": "none" (which disables signature verification completely) or accepts an asymmetric RS256 token signed symmetrically with HS256 using the public key as the secret. (Sony's authentication servers strictly validated RS256 signatures against their public JWKS key endpoints).
• Privilege Escalation Tampering: Attempting to modify "role": "user" to "role": "admin". If the signature is verified properly on every request, the backend immediately rejects the forged token with a 401 Unauthorized error.

8. Parameter Tampering & Open Redirect Testing Vectors

Next, we examined authentication routing URLs that contain return parameters after a user successfully signs in. For example:

https://account.sony.com/login?return_to=https://www.sony.com/dashboard

An Open Redirect vulnerability occurs when an application accepts untrusted user input that specifies an external URL and redirects the user's browser to that destination without validation. Attackers use this to execute high-credibility phishing campaigns or steal OAuth authorization codes.

Bypass Techniques Tested:

9. Secure Account Provisioning via Temp-Mail

To progress further into authenticated functionality (account settings, profile updates, notification preferences), researchers must create live test accounts.

Why Security Researchers Use Disposable Email Services:

• Inbox Isolation: Prevents personal and work email accounts from being inundated with corporate newsletters, confirmation alerts, and telemetry emails from target companies.
• Multi-Account Testing (IDOR & BOLA): To test Insecure Direct Object References (IDOR), a tester requires at least two distinct user accounts (e.g., User_A and User_B). Temp-Mail allows researchers to rapidly provision isolated accounts with distinct email addresses.
• Rate Limiting & Verification Token Testing: Analyzing email confirmation token longevity, token randomness, and whether email addresses containing special characters (e.g., user+test@domain.com) bypass backend filters.

10. Key Takeaways & Safe Harbor Principles