I've been doing a lot of "bug hunting" lately, and just a couple minutes ago I found something that I think is HUGE. My first high rating vulnerability!! Allow me to explain >:) In cybersecurity, and specifically penetration testing, there is a system that people use to rate the severity of the vulnerability they've just discovered called the CVSS. It basically takes into consideration a bunch of things like how easy the attack is, how much the attack affects, etc, to come up with a severity score that pentesters can use to accurately portray to their clients how serious a problem is. The values range from zero to ten, zero having no effect on the company, and 10 having a severe effect on the company. These ranges are labelled as none, low, medium, high, and critical. I explained all of that just to give you an idea of how serious the vulnerability is, but anyway...

I can't go deep into the specifics of it, but I did some scanning on a site and found that their Apache webserver is vulnerable to something called a SlowLoris or SlowHTTP attack. A SlowHTTP attack vulnerability basically allows the attacker to send partial HTTP requests to a web server, which causes the server to wait for the rest of the requests. If you send enough partial requests, the service begins to fall apart and eventually the site goes down because it's trying to handle so many requests at once. I'll admit, while testing this I may have accidentally done a lil something illegal, but we won't tell anyone about that >:) I may or may not have executed a full on DoS attack just for proof of concept, but I made sure their site stayed up so hopefully they know that I was working in good faith. Now that I think about it, I probably should've appended "Bug Bounty" to the end of my user agent or something so at least they'd no I meant no harm, but I suppose we'll see. If I get any investigators knocking on my door, hopefully the safe harbor rules will still apply to me.

Anyway though, pretty awesome moment for me, being my first big vulnerability, and hopefully my first big payout. So far I've only made $50 from bug bounties, but if this one works out, I'll be getting maybe around $500 0-0