Alyssa Herrera, 16-Year-Old Bug Bounty Hunter, on SSRF Bugs and Working With Security Teams

Most teenagers fill their free time with Fortnite, Instagram or afternoons at the mall with friends. Alyssa Herrera, aged 16, fills hers with bug hunting. She works full time as a bug bounty hunter and security researcher in California, in the United States, and climbed to the number one spot on the US Department of Defence (DoD) leaderboards. Now she wants to pass on what she learnt along the way to the wider community. She spoke about the work she loves.

From school laptops to HackerOne

Herrera's interest in computers started in middle school. The school handed out computers to its pupils and, like plenty of children that age, she wanted to play games on the administrative systems. Her first real hacking came from trying to win admin access to a laptop the school had issued, so that she could play games on it.

Web application hacking came at about 16, when she learnt that Google ran a bug bounty programme. That sent her searching for everything she could find on bug bounties and on web application vulnerabilities, through OWASP, and in time she came across HackerOne. That, she says, is more or less how it all began.

No mentor guided her. She taught herself from blog posts and publicly disclosed reports, found the subject fascinating and fell for the work. Helping companies close off vulnerabilities before anyone exploits them is, in her words, extremely rewarding. What keeps her going is the wish to help security companies prevent breaches and raise their overall security, and the chance to be a role model for other women who might want to enter the field.

Her favourite targets are Server Side Request Forgery (SSRF) and Insecure Direct Object Reference (IDOR) issues. Her recent research has given her real respect for SSRF, which she describes as serious and widespread across many parts of web applications.

Respect on both sides of a bug report

Asked what the relationship between hackers and security teams should look like, Herrera says it should rest on respect. Security teams need to accept that hackers are not the bad guys; they are trying to help and mean no disrespect or bad faith. Hackers, for their part, should accept that security teams get things wrong sometimes. If a team closes a report as not applicable and the hacker disagrees, the best response is a clearly written explanation of why it is a real issue, backed by evidence.

She believes each side should learn from the other to build a better relationship between the hacker community and security teams. Better security programme policies would help, and she notes that the legal side of programmes is already being addressed through the legal bug bounty programme. Another step would be plain written rules telling a hacker what to do after finding a vulnerability such as an RCE or SSRF. She cites Yahoo, whose programme lists the commands a researcher should run to establish what level of access they have.

Lessons from the DoD programme

Hacking the DoD has clearly been a favourite. The most valuable lesson she took from it is never to skip a website that turns out to run an unusual content management system (CMS), one she does not recognise, or a system about whose vulnerability status little or nothing is known. That pattern, she says, has come up again and again while hunting in the DoD programme.

The hackers she follows and admires are Frans Rosen, EdOverFlow, James Kettle and Ron Chan. She likes their work and says their security research shows off interesting ideas and concepts.

Herrera also teaches the hacker community through her blog and other channels, and she thinks bounty programmes do far more to educate hackers than most people realise. In her view, they need to push back against the industry habit of hiding fixed vulnerabilities behind NDAs, because newcomers learn from the skills that working hackers put on display. Programmes should also offer safe places for discussion, so that people are shielded from outside pressure to criminalise curiosity.

Since bug hunting is how she earns her living, she is choosy about programmes. She looks for ones that respond very quickly, usually those run by HackerOne, and checks whether rewards are paid according to impact or according to the vulnerability itself. She stays away from programmes that respond poorly or whose policies are badly worded.

Her advice to anyone thinking of starting is that bug hunting is open to everyone. The community welcomes people of every skill level, she says, and no one should be afraid to ask for help, "as we are all still learning".