8000 retesting by stacyspiva · Pull Request #54 · Hacker0x01/docs.hackerone.com · GitHub
[go: up one dir, main page]

Skip to content
This repository was archived by the owner on Nov 20, 2023. It is now read-only.

retesting #54

Merged
merged 1 commit into from
Oct 2, 2018
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added docs/hackers/images/retesting-5.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
37 changes: 37 additions & 0 deletions docs/hackers/retesting.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
---
title: "Retesting (beta)"
path: "/hackers/retesting.html"
id: "hackers/retesting"
---

As programs receive vulnerability reports and work on deploying fixes, they need proof that their vulnerabilities have actually been fixed. Asking hackers to verify whether a vulnerability has been fixed is a good way to secure the protection of data. Programs can elect to invite you and other hackers to retest your vulnerabilities to verify fixes.

<i>This is a new feature that is currently in the beta phase and only select programs are testing this feature out. If you’re a part of those programs, you may be invited to retest the vulnerability fixes. There’s currently no effect to reputation for participating in the retest, and there’s also no time limit to complete it.</i>

If you’re invited to retest a vulnerability, you’ll receive an invitation in your email to retest the report.

![retesting-5](./images/retesting-5.png)

To participate in the retest:
1. Click <b>View retest<./b> in your email.
2. Familiarize yourself with the contents of the report and check to see that the vulnerability has been fixed.
3. Click the <b>answer these questions<b> link in the report banner or just scroll to the bottom of the report to access the questionnaire.

![retesting-1](./images/retesting-1.png)

4. Answer these questions in the questionnaire:
* Are you able to reproduce the vulnerability?
* Are you able to identify a bypass to the fix?

![retesting-2](./images/retesting-2.png)

5. Submit a new report if you found a new vulnerability by clicking on the <b>submit a new report</b> link, and enter the report ID number in the <b>Report ID</b> field.

![retesting-3](./images/retesting-3.png)

6. Click <b>Submit</b>.
7. Click <b>Yes!</b> to finalize your submission.

![retesting-4](./images/retesting-4.png)

Upon completion, you'll be awarded with a $100 bounty.
55 changes: 55 additions & 0 deletions docs/programs/retesting.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
---
title: "Retesting (beta)"
path: "/programs/retesting.html"
id: "programs/retesting"
---

As programs receive vulnerability reports and work on deploying fixes, they need proof that their vulnerabilities have actually been fixed. Asking hackers to verify whether a vulnerability has been fixed is a good way to secure the protection of your asset’s data. You can elect to invite hackers to retest your vulnerabilities to verify fixes. Each hacker that participates in the retest will receive a $100 bounty upon completion.

<i>Inviting hackers to retest your vulnerabilities is a new feature that is currently in the beta phase. To be a part of the beta testing, please reach out to your program manager.</i>

### Set Up
There’s currently no set up on your end that’s needed to enable the feature. Your program manager will enable the feature for you.

### How It Works
Once your program manager has enabled the feature, to have hackers retest a vulnerability:
1. Choose a resolved report in your inbox that you want to assign hackers to retest.
2. Change the action picker to <b>Request retest</b>.

![retest-1](./images/retesting-1.png)

3. Click <b>Request retest</b>.

![retest-2](./images/retesting-2.png)

The original reporter as well as 4 random hackers participating in your program will be invited to retest the report through email.

![retest-3](./images/retesting-3.png)

When the hacker clicks <b>View retest</b> in the email, they’ll be able to familiarize themselves with the vulnerability report and check to see that the vulnerability is properly fixed. After they’ve tested the vulnerability, they can click the <b>answer these questions</b> link in the report banner to submit their findings.

![retest-4](./images/retesting-4.png)

The hacker will be asked to answer the following questions:
* Are you able to reproduce the vulnerability?
* Are you able to identify a bypass to the fix?

![retest-5](./images/retesting-5.png)

If they were able to identify a bypass, they can can submit a new vulnerability report and enter the report ID in the questionnaire.

![retest-6](./images/retesting-6.png)

Upon submission of the questionnaire, you’ll be notified that a hacker has completed a retest of your report within the report timeline and also through email.

![retest-7](./images/retesting-7.png)

Click on <b>View results</b> to see the status and findings of the retest efforts. If the hacker was able to find a bypass to the vulnerability, you can view the new vulnerability report.

![retest-9](./images/retesting-9.png)

Hackers that completed the retest will automatically be awarded $100. The payment is a regular bounty payment and the transaction for retesting will show in your billing overview statement.

![retest-10](./images/retesting-10.png)

<i>There’s currently no effect to reputation for verifying vulnerability fixes and there’s also no time limit for hackers to complete the retest.</i>
4 changes: 3 additions & 1 deletion src/pages/hackers/hackers-nav.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
path: /hackers/manage-notifications.html
- title: Hacker Email Alias
path: /hackers/hacker-email-alias.html
- title: Sessions
- title: Sessions
path: /hackers/sessions.html
- title: Two-Factor Authentication
path: /hackers/two-factor-authentication.html
Expand All @@ -47,6 +47,8 @@
path: /hackers/create-a-directory-page.html
- title: Credentials
path: /hackers/credentials.html
- title: Retesting
path: /hackers/retesting.html
- title: Hacker101
path: /hackers/hacker101.html
- title: 90 Day Leaderboard
Expand Down
2 changes: 2 additions & 0 deletions src/pages/programs/programs-nav.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,8 @@
path: /programs/triggers.html
- title: Hackbot
path: /programs/hackbot.html
- title: Retesting
path: /programs/retesting.html
- title: Integrations
items:
- title: Supported Integrations
Expand Down
0