How I hacked Github again
homakov.blogspot.com
How I hacked Github again
1–10 of 202 posts
Re: How I hacked Github again
#2Impressive display of persistence, stringing together those vulnerabilities. I also see your English has gotten noticeably better :) Keep up the good work!
Re: How I hacked Github again
#3Wow, really clever stuff! Also of note is the $4,000 reward he received from GitHub's bounty program — their largest to date, according to the email.
Re: How I hacked Github again
#4> $4000 reward is OK.
$4000 !? Wow, I'd love to be able to make $4000 on the side just doing what I love.
> Interestingly, it would be even cheaper for them to buy like 4-5 hours of my consulting services at $400/hr = $1600.
This sounds like a pretty clever strategy for marketing yourself as an effective security consultant.
EDIT: $4000!? wow. so money. such big.
Re: How I hacked Github again
#5> $4000 reward is OK. $4000 !? Wow, I'd love to be able to make $4000 on the side just doing what I love. > Interestingly, it would be even cheaper for them to buy like 4-5 hours of my consulting services at $400/hr = $1600. This sounds like a pretty clever strategy for marketing yourself as an effective security consultant. EDIT: $4000!? wow. so money. such big.
According to his website, the minimum time you can buy services for is 8 hours so I'm not sure what he means here.
Re: How I hacked Github again
#6Impressive display of persistence, stringing together those vulnerabilities. I also see your English has gotten noticeably better :) Keep up the good work!
Not suggesting anything, but "your" might be the key here :-)
Re: How I hacked Github again
#7> $4000 reward is OK. $4000 !? Wow, I'd love to be able to make $4000 on the side just doing what I love. > Interestingly, it would be even cheaper for them to buy like 4-5 hours of my consulting services at $400/hr = $1600. This sounds like a pretty clever strategy for marketing yourself as an effective security consultant. EDIT: $4000!? wow. so money. such big.
According to his website, the minimum time you can buy services for is 8 hours so I'm not sure what he means here.
8 hours at 400$/hour will still only be 3200$ and he can presumably spend the remaining 4-3 hours doing more security analysis with less overhead, so it might still be cheaper to hire him as a consultant.
Re: How I hacked Github again
#8> $4000 reward is OK. $4000 !? Wow, I'd love to be able to make $4000 on the side just doing what I love. > Interestingly, it would be even cheaper for them to buy like 4-5 hours of my consulting services at $400/hr = $1600. This sounds like a pretty clever strategy for marketing yourself as an effective security consultant. EDIT: $4000!? wow. so money. such big.
I'm pretty sure Egor's first language isn't English, so OK might mean 'meh it's alright' through to 'hey this is great'. I know a few non-native speakers who do similar things.
Re: How I hacked Github again
#9> $4000 reward is OK. $4000 !? Wow, I'd love to be able to make $4000 on the side just doing what I love. > Interestingly, it would be even cheaper for them to buy like 4-5 hours of my consulting services at $400/hr = $1600. This sounds like a pretty clever strategy for marketing yourself as an effective security consultant. EDIT: $4000!? wow. so money. such big.
Perhaps that was not the tone intended. Or perhaps relative to the damage he'd be capable of causing $4000 is small.
Re: How I hacked Github again
#10Grats Egor, once again a great explanation of how these things add up into vulunerabilities.