Writing secure software is hard and even the biggest companies are making some mistakes. There is a need to both learn secure coding and to find bugs in web applications. If you have ever wondered how to start hunting for bugs, then my story is definitely for you. Have you sent an email in your life? Or a POST request? Have you seen Base64 encoded data? If the answer to these questions is yes, then congratulations – you have the required technical knowledge and you could have found some serious security issues in Google. In this talk, I will share my story of finding my first three web application bugs in Google products. The goal of the talk is to show you that all you need is a hacker’s mindset, free time and lots of curiosity to be a successful bug hunter - or at least that's how I started hunting for bugs. I will demonstrate the bugs and fixes in hands-on examples.
