Thread by @Jhaddix

== Trademark and Copyright Recon ==

How to find assets no other bug hunters have found.

One of my simple "secrets" for years.

Little automation exists for it.

💸💸💸

a thread🧵

🚨follow, retweet, & like for more hacker tips!🚨

1/x

When approaching a bounty, the scope is important. Not only the domain list but, all the text.

There are about ~30 paid bounty programs across the major platforms that are explicitly open scope or have the wording right under the scope section that says something like...

2/x

"If you find anything else that you believe to belong to XYZ company, report it and we will assess its validity. It may not result in a bounty"

But.. To be honest, criticals usually DO get paid.

3/x

In several of these programs, a simple trick that I use to great success is finding copyright and trademark text. For example:

"© Copyright, XYZ1212 Company, 2020" on Google.

Then use the minus operator like:

"© Copyright, XYZ1212 Company, 2020" -xyz1212.com

4/x

I have found whole new domains and tlds, that NO tester had tread before, using this simple technique.

I have found:

- Old marketing sites
- Outdated installs of software
- Build tools
- and more

Search for old years too... 1995+ and also check trademark strings.

5/x

This method, along with previous threads on SSL Parsing, and (upcoming) SNI Parsing, are the most reliable ways to find greenfield websites to hack in a bounty.

That's it!

🚨follow, retweet, & like for more hacker tips!🚨

#bugbountytips #Pentesting #redteam

6/x