Skip to content
Archive

Post

Back to deliverables

0 _0x77
0x77 🐙
@_0x77

又碰到一个想白嫖漏洞的项目方:@osmosis。 我只是想先问清楚你们的 bounty 怎么给、按什么标准给,结果问了半天都不肯说,还一直让我先把漏洞交出来。 这个漏洞已经可以复现,真被利用了可能损失几十万美元。连最基本的赏金规则都不愿意讲清楚,还指望安全研究员无条件把漏洞送上门? 那就这样吧。 @evilcos

photo photo

· 16K Views

2 Reposts 49 Likes 12 Bookmarks
replies reposts likes
12 replies collected of 17 X reports
Cos(余弦)😶‍🌫️ @evilcos · 124K

@_0x77 @osmosis It's still more reliable to have a bug bounty platform handle the process and act as a communication intermediary. Your two seem to be communicating in a rather adversarial way. 😂

original · zh

@_0x77 @osmosis 还是需要漏洞赏金平台来走流程及充当沟通中介会更有保障,你们两沟通看去就挺对立的😂

1 3
Jason傑森 🇭🇰 | 🛠️ @cheuk_baby · 16K

@_0x77 @osmosis This kind of project team deserves to be taught a lesson for being taken advantage of.

original · zh

@_0x77 @osmosis 这种项目方活该被白嫖教育

幣圈小黃鴨 @imd8964 ·

@_0x77 @osmosis 直接搞錢~🤝讓他們先提出付款,再退款

Richard_buildAI @Richard_buildai ·

@_0x77 @osmosis It sounds like this problem could be solved by @ai2humannetwork. The project team could release a task to the platform, and after the hacker finds the vulnerability, they could submit evidence to verify the platform's settlement funds.

original · zh

@_0x77 @osmosis 听起来这个问题可以放在@ai2humannetwork 去解决,项目方发布任务到平台 黑客找到漏洞后提交证据验证 平台结算资金

.简Yap @w201300 ·

@_0x77 @osmosis If you "keep" it for them first, they will naturally be eager to lower their attitude and negotiate.

original · zh

@_0x77 @osmosis 先替他们“保管”一下,自然会屁颠屁颠放低态度来协商。

1
CosmosMan宇宙侠 😈 @iCosmosMan ·

@_0x77 @osmosis They don't have a penny to their name.

original · zh

@_0x77 @osmosis 他们有个鸡毛钱

1
忘山 @stam_325 ·

@_0x77 @osmosis I really don't recommend digging for free if there's no bounty platform. They won't reply to messages.

original · zh

@_0x77 @osmosis 没赏金平台的真不建议去挖了,白嫖的,不回消息了。。

0x哈基蜂 @baibainebai ·

@_0x77 @osmosis They'll just rake in hundreds of thousands of dollars, then they'll open a bounty.

original · zh

@_0x77 @osmosis 几十万刀直接撸光啊,到时候他们就开赏金了

AI OPENCLAW @AIFilm_Studio ·

@_0x77 @osmosis Share bug to me. For learn….

云中鹤 @YZH168 ·

@_0x77 @osmosis Honestly, in a place like crypto, what's the point of using bounties? Just test it out, exit, and then join the mixed coin market. How much money can you possibly make from bounties?

original · zh

@_0x77 @osmosis 说实话 币圈这种地方你拿啥赏金啊 直接测出来一波直接走然后进混币不就好了 赏金能有多少钱

Lucifiel @LucifielHack ·

@_0x77 @osmosis It's okay, it's better than what I did. At least you're just getting something for free, while I'm being falsely accused of professional extortion and I reserve the right to take legal action.

original · zh

@_0x77 @osmosis 没事,比我这好,至少你只是白嫖,我这还反过来造谣说我是职业敲诈,保留法律诉讼权力呢

Oᒪᗪ 𝗦𝗜𝗫 ✦ @w3bD4nny ·

@_0x77 @osmosis Since that's the case, then you should get the funds sorted out first. Then they'll sheepishly negotiate on their own.

original · zh

@_0x77 @osmosis 既然这样 那你先吧资金搞出来。然后他们自己会灰溜溜的谈判

2 replies whose parent comment X withheld

Cos(余弦)😶‍🌫️ @evilcos · 124K

@_0x77 @osmosis That's really rough...

original · ja

@_0x77 @osmosis 真粗暴...

1
0x77 🐙 @_0x77 · 106K

@evilcos @osmosis Money is hard to earn, and life is hard to bear.

original · zh

@evilcos @osmosis 钱难赚,屎难吃

1 1

These were collected in full; the comment they answer was not returned by X.