►
Description
William is a full time Software Developer and long-time CTF player, based out of Australia, who recently started trying his hand at Bug Bounties in his free time. When not hacking, he likes to go walking with the family and playing little known sports such as underwater hockey.
William, aka @vakzz is a top 10 hacker in our GitLab bug bounty program: https://hackerone.com/gitlab/thanks?type=team
You can learn more about William by checking out his HackerOne profile: https://hackerone.com/vakzz or see what he's up to on twitter: https://twitter.com/wcbowling.
You can also check out his HackerOne 2020 H@ctivitycon presentation, “The Journey of Finding and Exploiting a Bug in GitLab”: https://youtu.be/jBPYfN_uuRw
You can see the agenda (#AMA questions) for this chat here: https://docs.google.com/document/d/1rM5XNl_XHTYKaXBRBu7RpLyoLOUtsJtUSLvq8Jyg5xU/edit?usp=sharing
See our AMA playlist: https://www.youtube.com/playlist?list=PL05JrBw4t0Kqvvpk9PmRO6fZ0xmnKBp_s
A
All
right,
hello,
everyone
and
welcome
to
this
edition
of
get
labs.
Ask
a
hacker:
I'm
lauren,
spierner,
director
of
security,
engineering
and
research
here
at
git
lab
and
today
we're
chatting
with,
will
bowling
a
software
engineer
and
get
lab
top
10
ranked
bug
bounty
hunter.
Who
has
made
significant
contributions
to
the
get
lab
security
program
through
the
ethical
disclosure
of
many
many
vulnerabilities,
a
contributor
to
many
other
companies
and
organizations
as
well.
Alex
has
been
a
hacker
one
security
researcher
for
well
since
2015,
with
a
total
of
60
vulnerabilities
discovered.
A
B
B
I
probably
would
have
started
about
10
years
ago
as
well
and
joined
a
team
called
open
to
all
and
I
was
sort
of
from
there.
There
was
a
big
bunch
of
people
in
there
that
also
did
bug
bounties
so
sort
of
through
that
started.
Doing
a
few
bug
bounties
when
there
wasn't
any
ctfs
going
and
yeah
that's
sort
of
how
I
how
I
got
into
bug
bounties.
A
B
B
If
anyone's
used
that
yeah
and
that's
a
rails
app
a
rails
api,
you
have
amber
front
end.
Yeah
I've
been
there
just
over
five
years.
I
think
now
yeah
we're
sort
of
rapidly
expanding
at
the
moment.
So
that's
once
again
bringing
a
lot
of
new
kind
of
similar
challenges
of
increasing
load
and
yeah.
All
the
things
that
come
with
with
more
users,
which
is
which
is
good,
fun
and
challenging.
A
B
A
B
Yeah
so
most
of
the
programs
that
I
look
at
have
source
code
available
and
I
try
to
stick
with
rails
based
things
just
because
that's
something
that
I
know
really
well
and
having
limited
time
to
do
bug
bounty
it's.
It's
always
good
to
pick
something
that
you
know
pretty
well,
so
the
main
thing
I'd
use
is
just
ruby
mine,
which
is
just
the
id
I
use.
B
I
find
it's,
it's
really
quick
to
actually
to
find
things
and
and
get
your
way
around
because
of
all
the
indexing
that
it
does
and
it
indexes
all
the
gems
and
works
really
well
with
bundler
so
and
ruby
being
ruby.
You
have
all
the
source
to
all
the
gems
as
well,
which
is
great,
so
you
end
up
doing
some
pretty
deep
dives
into
all
the
different
dependencies
which
are
is
very
useful
other
than
that
probably
burp.
I
might
normally
have
running.
B
That's
really
handy
for
for
going
back
and
search.
I
pretty
much
use
the
search
and
the
repeater
on
that,
because
sometimes
you
find
something
and
you
need
to
know,
has
it
been
used
or
where
did
you
last
use
it
other
than
that
yeah
either
use
docker
for
for
quick
things,
the
gitlab
docker
setups
like
very
easy
to
get
up
and
running.
So
if
I
just
want
to
test
something
quickly,
I'll
use
that
and
for
more
in-depth
things
use
vagrant.
B
If
I
wanted
to
look
at
some
more
sort
of
low-level
stuff
that
needs
sort
of
os
access
or
kernel
access,
what
else
did
it
say
there?
Oh
yeah,
the
perf
tools
is
a
it's
like
a
set
of
different
utilities.
I
think
there's
bcc's
another
one,
which
I
have
things
like
exe
snope
or
there's
one
for
open
for
seeing
what
files
have
been
opened.
B
A
Yeah,
that's
great
stuff.
That
is
really
really
good
collection
of
tools
there
like
that
good
deal.
Our
next
question
from
dominic
also
one
of
our
gitlab
security
team
members.
He
says
hacking
is
nice.
I
like
that.
But
let's
talk
about
underwater
hockey.
It
looks
like
a
lot
of
fun.
Do
you
play
competitively
or
just
for
fun?
And
how
long
do
you
hold
your
breath?
Underwater.
B
B
And
yes,
I've
done
that,
maybe
four
four
or
five
times
I
think
and
got
a
variety
of
results
and
yeah
the
other
thing.
There
was
one
time
we
have.
It
hasn't
been
for
a
little
while
due
to
covert
but
there's
a
trans-tasman
competition,
which
is
between
australia
and
new
zealand.
So
I
managed
to
get
onto
the
team
for
that
and
play
against
the
kiwis,
which
was
heaps
of
fun
yeah.
No,
it's
just
a
it's
a
really
unusual,
but
fun
sport
and
yeah
love.
A
That
is,
that
is
awesome.
I
will
be
honest
before
pre-reading
these
questions.
The
question
set,
I
didn't
even
know
underwater
hockey
and
underwater
rugby
even
existed,
which
is
which
is
way
cool.
This
is
this
is
awesome,
I'm
I'm!
I
am
now
a
bit
obsessed
with
watching
some
of
those
videos
online.
This
is
good
stuff.
B
I
think
it's
called
the
octopus,
or
something
in
the
uk
is
another
name
for
underwater
hockey,
but
yeah
underwater
rugby
is
pretty
fun
as
well.
If
you
can
find
some
videos
of
that,
that's
played
in
the
the
dive
pool.
So
it's
five
meters
down,
oh
yeah,
with
goals
at
the
bottom
and
pretty
much
full
contact.
B
B
A
B
B
So,
whether
it's
other
reports
or
looking
at
the
patch
notes
and
things
like
that,
because
yeah
I've
found
it's
it's
often
hard
to
sort
of
fix
all
instances
of
of
the
same
bug.
So
yes,
if
there's
you
know
been
a,
I
think
when
I,
when
I
first
started
there
had
been
a
couple
of
sort
of
file
handling
bugs,
so
that
was
sort
of
the
first
area
I
was
looking
at
was
any
anything
that
was
touching
files
that
were
user
controlled
yeah.
A
B
Yeah,
so
I
think,
probably
more
permission
related
bugs
so
things
with
multiple
accounts
or
authentication
issues,
they're
just
things
that
I'm
not
really
concentrating
or
looking.
So
I
guess
I
don't
don't
spot
them
unless
I
actually
like
actively
go
and
look
for
them.
I
sort
of
more
look
at
things
where
there's
user
controlled
data
so
anywhere
that
yeah,
a
single
attacker
can
can
manipulate
things
as
opposed
to
idle
type
things.
A
A
B
I
think
they
they
tend
to
be
left
a
bit.
If
there's
not
as
much
incentive
to
to
look
for
them,
then
probably
people
are
less
likely
to
do
it.
So
so
something
like
that
or
open
redirect,
if
they're
all
the
time
they're,
not
even
in
scope,
but
if
they
are
then
there's
you
can
probably
find
one
of
them
eventually,
but
yeah
I
mean.
Luckily,
I
just
do
this
sort
of
for
fun.
B
A
Yeah
open
relay
stuff.
I've
always
been
so
surprised
that
that's
out
of
scope,
so
often
that's
that's
something.
Surely
every
security
program
every
you
know
I.t
shop
would
want
to
know
about
if
they
didn't
and
in
most
cases
most
of
these
open
relays
are
not
known
before
before
they're
disclosed.
So
a
good
good
point
on
that.
A
B
B
Like
yeah,
I
hadn't
even
thought
about
that
class
of
vulnerabilities
before
because
you,
you
think
you're
doing
everything
right
and
sort
of
escaping
certain
things
and
and
passing
things
in
as
an
array
not
not
manipulating
strings
but
then
yeah.
If
the
arguments
can
start
with
a
dash,
you
can
do
all
sorts
of
other
things
so
yeah.
B
So
if
you
have
a
helper
class
or
a
wrapper
class,
where
you
can
separate
out
your
flags
from
your
arguments-
and
I
think
this
is
what
gitlab
or
goodly
does
now
is
there's
a
separate
tool
where
these
are
the
flags.
These
are
the
arguments
and
then
you
can
have
validation
on
them
to
make
sure
that
none
of
the
the
flags
are
you
know,
user,
controlled
or
or
something
like
that.
A
Great
great
advice
really
really
sound
advice
there.
I've
also
seen
in
just
application
security
programs
in
general.
You
know
argument.
Injection
vulnerabilities
are
often
the
the
one
type
of
vulnerability
class
that
that
that
developers
oftentimes
have
a
really
difficult
time
wrapping
their
heads
around
and-
and
I
think
that's
one
of
the
reasons
why
that
tends
to
be
a
challenge
to
solve
at
times
as
well.
B
I
don't
think
there's
any
particular
area
I've.
I've
got
a
couple
of
places
that
I
want
to
sort
of
revisit,
but
they
were
just
because
they
looked
interesting
or
had
some
strange
behavior,
but
no,
I
don't
think,
there's
any
particular
spots.
Otherwise
I
would
have
would
have
spent
a
lot
more
time.
Looking
at
them.
B
A
B
Yeah,
so
I
guess
the
other
thing
is
sort
of
applying
a
few
more
novel
techniques
to
that.
So
there
was,
I
think,
one
of
the
last
patches
there
was
a
excess
leak
in
safari,
which
I've
sort
of
only
ever
seen
in
ctfs
before
which
sound
sounded
really
cool.
So
I
hope
there's
a
write-up
for
that
at
some
stage,
but
things
like
that
or
tls
poison,
which
is
sort
of
another
thing
attacking
sort
of
protocol
level
things.
A
Excellent
good
good.
Thank
you
for
that
question.
Number
eight
from
chris
one
of
our
gitlab
team
members.
If
you
don't
cover
this
in
your
answers
to
number
one,
do
you
have
any
tools
or
processes
you
really
like
for
managing
logistics
of
your
bug,
hunting
he's
looking
for
ideas,
research
notes,
exploit
code,
follow-up
tasks
etc
and
pse
loves
your
work
by
the
way.
B
No,
so
I
don't
have
a
great
system.
I
just
have
sort
of
folders
for
each
different
program
and
then
yeah
inside
that
sort
of
subfolders
for
the
different
parts
or
different
subsystems
of
those
programs.
I
usually
do
like
a
get
get
in
it
and
just
sort
of
add
everything
as
I
go
just
so.
I
have
a
bit
of
a
history
for
things
that
have
changed
and
other
than
that
I
just
sort
of
write,
write,
notes,
text
files,
but
no
nothing,
nothing
super
fancy.
I
think.
B
Maybe
if
I
spend
a
bit
more
time
doing
bug
hunting
it,
it
becomes
a
higher
priority
but
yeah.
I
think,
after
after
reading
the
article
on
how
a
few
other
people
have
been
using
gitlab
and
issues
and
projects
and
things
that
sounds
like
a
really
good
way,
so
I
might
might
have
a
bit
of
a
play
with
that,
because
it'd
be
nice
to
be
able
to
have
it
centralized,
at
least
if
I'm
on
a
different
computer.
It's
it's
annoying.
If
I
don't
have
any
of
my
notes.
A
A
Yeah
good
stuff,
good
stuff,
I
love
love.
Seeing
that
question
number
nine
is
from
heather
right
here
on
the
call
first.
Thank
you
so
much
for
agreeing
to
join
us
on
the
call.
I
I
I
echo
those
sentiments.
I
know
you
must
be
busy
with
the
job
family,
two
young,
kiddos,
a
successful
side,
job
hobby
and
also
fitting
in
the
sports
into
your
into
your
schedule.
B
Yes,
well
extra
sleep
is
always
always
pretty
nice
yeah.
This
is
a
really
tricky
question,
because
there's
there's
so
many
so
many
things
that
that
would
be
great
to
spend
that
extra
hour
with,
but
I
think
probably
one
of
the
things
that
I've
I've
certainly
noticed
it
has
been
cut
out,
is
reading
time.
So
I
used
to
do
a
quite
a
bit
of
reading
just
sort
of
fiction
books
which
I
sort
of
yeah.
B
A
I
I
can.
I
can
completely
relate
to
that,
since
having
three
little
ones
of
my
own
reading
of
books
has
nearly
stopped
and
and
since
then
I
have
personally
found
all
sorts
of
great
podcasts,
not
that
I
wasn't
listening
to
podcasts
beforehand,
but
you
know
now
I
can
listen
to
podcasts
while
changing
a
diaper
while
cooking
dinner,
while
you
know
cleaning
up
any
one
of
the
many
messes
that
are
made
throughout
the
day,
all
things
tough
to
do
while
we're
reading
a
book
so
yeah
completely
relate
to
that.
A
Our
next
question
from
rohit
another
gitlab
team
member,
thank
you
for
joining
us
in
this
aim.
Ama
first
off.
He
says
he
appreciates
that.
You
mentioned
above
that
part
of
your
bug.
Bounty
apart
from
bug
bounty.
You
also
have
a
full-time
job.
Can
you
share
some
tips
on
how
you
manage
the
full-time
job,
bug
bounty,
family,
personal
time
and
personal
time
effectively
and
then
still
manage
to
find
the
amazing
security
issues
that
you
report
to
us
here
at
gitlab.
B
That's
when
yeah,
depending
on
how
awake
I
am
I'll,
sit
down
and
do
do
a
couple
of
hours,
bug
bounty,
which
is
yes,
I
try
and
do
that.
You
know
maybe
three
or
four
times
a
week,
depending
on
different
things
and
yeah
that
sort
of
works
fine.
Until
until
I
find
an
issue
right
at
the
end
of
that
two
hours
and
then
then
I
sort
of
want
to
stay
up
and
finish
it.
A
That's
that's
incredible.
That's
incredible
to
hear
that.
That's
the
time
that
you
spend
on
on
bug
bounty
hunting.
You
know,
especially
you
know
here
at
git
lab
we
we
we
personally
know
of
the
you
know
the
two
rces
that
you
recently
submitted
to
us
this
year
and
you
know
rca
is
obviously
a
big
deal
right
and
and
and
the
time
that
it
takes
to
find
those
that
says
a
lot
about
your
your
hunting
skills
there.
So
thank
you
for
that.
B
Yeah,
I
think
that's
why
it's
well.
For
me,
it's
really
important
like
which
targets
I
choose,
because
yeah
I
do
have
such
limited
time
to
actually
be
able
to
to
work
on
it,
picking
something
that
I
know
I
can
sort
of
hit
the
ground
running
in
and
try
and
get
as
much
done
as
possible
in
the
shortest
amount
of
time
which
is
yeah.
So
I
love
having
the
source
code,
because
if
I
have
to
spend
all
my
time
scanning
different
things
and
it's
just
a
bit
of
a
waste.
A
Good
deal
good
deal
and
let's
see
our
last
question
from
me,
you
so
you
know
you're
you're
impressively
ranked
on
hackaron
on
a
number
of
bug:
brownie
programs
for
other
companies.
You
know
out
of
all
the
bug,
bounty
programs
and
all
the
bounties
you've
submitted.
What
sort
of
things
do
you
like
seeing
in
these
bug?
Bounty
programs?
What
are
they
doing?
B
B
If
a
program
allows
for
disclosure,
then
yeah,
I
guess
being
really
responsive
in
the
tickets,
there's
there's
nothing
worse
than
submitting
something
and
then
waiting
a
couple
of
weeks
for
to
hear
anything
back
and
then
it
just
sort
of
yeah.
You
lose
a
fair
bit
of
motivation,
so
I
think
yeah,
the
more
communication,
the
better
just
to
keep
you
keep
the
reporter
engaged
and
then
they're
more
likely
to
to
keep
hunting
yeah.
I
know
the
the
more
feedback
you
get.
B
I
certainly
engage
with
the
program
a
lot
more
yeah
and
gitlab
certainly
is
really
good
at
that,
even
just
like
the
bot
updates
saying
you
know
the
etas
and
things
like
that.
That
can
make
a
massive
difference,
yeah
and
then
I
guess
that's
sort
of
mentioned
before,
but
I
much
prefer
if
I
can
have
the
source
code
when
I'm
looking
at
a
program
just
because
it
it's
saved
so
much
time,
and
I
think
that
the
bugs
are
going
to
be
there,
whether
you
have
the
source
code
or
not.
B
It
just
means
that
you
don't
have
to
to
waste
a
lot
of
time.
So
if
it's
possible
for
your
company
to
make,
even
if
it's
just
part
of
it
open
source,
then
yeah
that's
a
a
big
plus
and
yeah.
I
think
all
those
things
I
mentioned
gitlab
are
already
doing
so
so
yeah.
I
think
that
you
guys
are.
You
know
one
of
the
gold
standards
for
bug,
bounty
programs,
which
is
one
of
the
reasons
why
I
keep
coming
back.
A
That's
that's
great.
Thank
you.
Thank
you
so
much
for
that.
We
appreciate
that
and
certainly
we
we
want
to
do
everything
we
can
to
continue
continually
improve
our
bug,
binding
program
and,
if
you
think
of
anything
else
that
we
could
do
better
or
differently,
please
please
let
us
know-
and
that
said
we
are
at
time
now
so
we'll
go
ahead
and
wrap
this
up.
First
off,
I
want
to
thank
everyone
for
joining
us
today.
A
This
was
a
great
discussion
and
very
specifically
will
thank
you
for
joining
us,
taking
the
time
out
of
your
busy
day
to
chat
with
us
here.
This
was
a
lot
of
fun.
I
think
we
all
learned
a
little
something
to
include
the
number
of
underwater
sports
there
are
currently
available.
So
thank
you.
Thank
you
for
all
of
that,
and
you
know
we
appreciate
all
of
your
efforts
here
at
gitlab
and
I'm
sure
we'll
be
talking
to
you
again
real
soon.