The document discusses the importance of CVEs (Common Vulnerabilities and Exposures) and provides a roadmap for identifying and reporting vulnerabilities. It emphasizes learning from reviewing source code, understanding different coding styles, and writing effective reports. The author shares insights about common vulnerabilities and the submission process for bug reports.

1. FIND YOUR 1ST CVE
Shreya Pohekar
NULL AHEMDABAD

2. Who am I???
Chapter lead Infosec girls | Ex-lead Null bhopal
About Me
Developer
Security Researcher
I blog at shreyapohekar.com
Follow me
Twitter - @shreyapohekar
LinkedIn - Shreya Pohekar
https://codevigilant.com/author/shreya_pohekar/

3. CVE's in a nutshell
Why have a CVE
The standard roadmap
Learnings ???
Vulnerabilities to look for while hunting
Where to submit bugs
Contents
Topics to be covered
Any interesting story from my findings-
The benefits of having the source code

4. COMMON VULNERABILITIES AND EXPOSURES
A number given to a vulnerability identified.
WHO'S A CNA ?
CVE numbering authority.
CVSS ??
Common vulnerability scoring system. Helps identifying the
criticality of the vuln found.
CVE's in a
nutshell
https://codevigilant.com/author/shreya_pohekar/

5. Why should you have a CVE???

6. Choose a target just like you do in bugbounty
Set the code locally
Move from code to feature or feature to code
Found a vulnerabiity? Create a report
Submit
The road map

7. Major Learings
BECOME GOOD AT WEB PENTEST
Explore different vulnerabilites around web.
LEARN SOURCE CODE REVIEW
Reading lots of code gives immense understanding of the
application. Also, makes you capable in identifying the vulnerable
code as you see it.
LEARN TO WRITE GOOD CODE
Reading code also exposes us to different coding styles and best
practices.
REPORT WRITING
You learn about how to build a well-formated, correct report.

8. XSS - Reflected/ Stored
SQLI - Try with lower privilege levels
RCE - file uploads being common place to look to
XXE and insecure deserialization
Directory traversal and directory listings
SSRF - Check everytime you get an URL input field
Vulnerabilities
to look for

9. Submit you bugs
https://cve.mitre.org/cve/request_id.html

10. Bounties with CVEs
https://huntr.dev/

11. Any interesting story
from my findings
&
The benefits of having the
source code handy
HTTPS://SHREYAPOHEKAR.COM/BLOGS/DONT-JUST-SANITIZE-BUT-
ALSO-ESCAPE-A-FABLE-OF-SANITIZE_TEXT_FIELD/