Hello, everyone.
So in this video, we're going to see bug bounty reporting on Nancy WIBC.
So basically, Nancy, the ABC is a unit of entero that is national technical research organization,
Government of India.
So this is an initiative by government of India wherein security researchers from India as well as world
can report valid security vulnerabilities to NCW PC and can contribute in making India's critical infrastructure
safe.
So if you are able to find any valid vulnerability into any critical infrastructure or any government
website, then you can report to the APC based on your report, they will verify and they will acknowledge
you if you have sended are right to report or not.
If you have sent it a valid report, they will acknowledge you with appreciation.
So and see, the ABC is an important part for reporting vulnerabilities to secure our nation.
So let's see this.
How can we do this?
So you just have to type and see the APC dodgier without end to logging onto this website.
After logging in onto this website, you just have to scroll down.
You can read about the mission and everything.
These are the newsletters we are going to call a newsletter and we are going to see what is newsletters.
These are the updates they keep on giving on Twitter when liability disclosure, wherein we can send
a report.
If you see at the bottom of the page when liability disclosure, they have given an email address that
is out of GDP at NCW, APC Dorjee of IDOT.
And so this is the email address where we are going to send all of our security reports.
Anyone lability that you find in the application of any government website needs to be send it over
here.
Perfect.
So I'm just going to share our report, which was shared to the ABC by my student.
So this report was Accessors vulnerability and willful underachieve thought.
And so now you will see how to write an email to report to them, as well as how to write a good report.
And what are the important steps your report should cover and not miss?
So as you can see, the subject line should contain the responsible disclosure of disclosure report
as well as the subject line should contain what is the vulnerability and in what website you have found
this vulnerability.
This report needs to be send it to our GDP, as you can see, this is the body and this is a report
which was attached.
So as you can see in this report, there is a summary of excesses.
So basically, what is excessive and description of exercice, the severity as high as we can see.
And next is the bailout.
So what is the payload that is allowing us to trigger the exercise?
As you can see, an interesting payload to bypass LGT, which is a Tmall encoding complexity.
Easy.
We have done this attack from remote external.
What is the impact?
What are the affected it as well for India?
The GOP thought in that you are in itself.
What are the recommendations?
And lastly, what are the references?
Perfect.
So as you can see over here, these things should be included into our report.
Do not worry, I'm going to share this report template into the description so you guys can also utilize
this report.
Now, the most important part is the proof of concept.
As you can see, this is the PEOC, which shows that Exercice happened over here.
The figure number is a lot on her website application.
The payload again, which cost to the exercise to happen.
Again, a biopsy from the source code and again, the same payload.
So I hope you guys understood how you can write a good report which contains all the necessary information
that needs to be send it to this e-mail address.
And the e-mail addresses are Redzepi Aderet and see the ABC dodgier restart.
And so you need to shoot the email to this security email.
Yeah, so when you have sent the email to them, they will acknowledge you into 24 hours based on your
report, they will tell you that it is a valid report or an invalid report.
Now, let's go to the ANC, the APC page, and here is the interesting thing is the newsletters.
So I'm just going to click the April 2020 newsletter, which is the latest newsletter.
So whenever security researchers report vulnerabilities to ANC, the APC, they release a newsletter
every quarter that is three months and every three months.
And the list down the top, security researchers of the country who have sent in a valid report, the
maximum valid reports that you sent increases the chances of your name to appear in this newsletter
and to the top security researchers report.
So, as you can see, this is the report.
I will just scroll down.
You can read many things from your articles and news.
So basically, I will come down to and see the APC Responsible Vulnerability Disclosure Program over
here.
You can see the name that is Karthick.
So these are the top 15 security researchers and they acknowledge them for the contributions during
December 2019 to February 2020.
Perfect.
So the first student this is my student, whom I have trained has been appeared into and see the APC
newsletter.
This is the second student which is ready savola again.
I have trained her who has appeared into the newsletter and there is one more student is truly a mystery.
I have trained her to for Pokemon Hunting and these three students have been introduced into the top
15 security researchers.
Similarly, if you see the other newsletter's also my students have been in the top 15 security researchers
newsletter list price.
So I hope you guys understood how you can report vulnerabilities to and see the I how they will acknowledge
you, how you can write a good report and how you can see your name into the newsletter.
So I hope you guys understood.
Thank you.