Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Austin M. on Becoming a Level 5 Researcher in Just 3 Months
Guest:
Austin M.
Published:
Updated:
Duration:
16 min
Episode summary
Austin M., a member of the Synack Red Team, climbed to Level 5 status in just three months, an uncommon pace even within SRT’s vetted community of ethical hackers.
In this episode of WE’RE IN!, Austin walks through his hacker origin story and the skills, habits and strategies that got him there so fast.
What separates researchers who plateau from those who reach the top tier? How much of elite-level pentesting comes down to technical skill versus persistence and pattern recognition? What should someone brand new to bug bounty hunting focus on first?
Don’t miss Austin’s playbook for compressing years of learning into months.
Listen to the episode
S4 E12 · Austin M. on Becoming a Level 5 Researcher in Just 3 MonthsWE'RE IN! Podcast · 16 min
Key takeaways
Inspect tokens for hidden identifiers On a U.S.-only financial services target, a low-privilege user never saw the admin user ID in requests, but it was inside the JWT, and using it gave Austin control of the entire platform.
Smaller pools mean better odds Austin prefers Synack because he competes with hundreds of researchers instead of thousands, and U.S.-only and FedRAMP targets narrow the field further.
A denial can be a push forward Austin was denied SRT membership the first time for lacking certifications, then passed the OSCP and reapplied successfully.
Reuse public techniques on new targets He reads HackerOne Hacktivity reports and bug bounty newsletters, then applies those techniques on Synack, where they often work too.
Skip low-value bugs Treating time as money, Austin avoids findings like CAPTCHA bypasses and focuses on IDORs, authorization issues, and SQL injection.
Notable quotes
If you inspected your JWT token, inside was your admin user ID, and I used that and was able to compromise the entire platform.
And funny enough, I actually got denied my first time around. And that kind of pushed me to try harder.
…the one thing I love about this field is that you can never stop learning.
So I don't want to go after the low hanging fruit, like the captcha bypasses, like that's not worth it to me. So I go after the heavy hitters.
Questions this episode answers
How do you become a level 5 Synack Red Team researcher?
Researchers start at level 1 and move up by getting vulnerabilities accepted by the VulnOps team, earning pay and points. Austin hit level 5 in about three months, which he said takes others years. Read this section
What is patch verification in bug bounty?
After a client accepts a vulnerability and attempts a fix, it sends the finding back to the researcher to check whether the patch works or can be bypassed, with back and forth until it is fixed. Read this section
How is Synack different from HackerOne or Bugcrowd?
Austin says public programs pit you against about 10,000 people and payouts can take weeks to months, while on Synack you compete with around 300 researchers and triage is very fast. Read this section
What certification helps you get into the Synack Red Team?
Austin recommends the OSCP because it is respected by Synack and in professional work. He had experience but not the certifications to back it up when he was first denied. Read this section
About the guest
Austin is a Synack Red Team (SRT) member who reached level 5 about three and a half months after joining. At the time of recording, he works as a security consultant at a cybersecurity firm, doing penetration tests daily, and hunts on Synack in his remaining time. He holds a degree in cybersecurity and earned his OSCP after his first SRT application was denied.
Hello, and welcome to the latest episode of WE'RE IN brought to you by Synack. I'm Josh Mason, solutions architect. And with me today is one of our Synack Red Team members, Austin.
Thanks for having me. I really appreciate it. Yeah, man. Austin, you've been on the Synack Red Team for a bit now. And most of our listeners have an idea of what the Synack Red Team does, but it's been a minute. Do you mind sharing kinda what you do as a Synack Red Team member?
Of course. So I've been on Synack, Synack Red Team for about three months, three and a half months. So, you know, I know other people on your podcast have been here for years and years. So I'm pretty much a newbie compared to everybody else. But part of my day to day on Synack is I am responsible for reporting vulnerabilities ethically. So I go through, see what I can find, and it's my responsibility to produce the best looking report I can, and ship it off to Synack to review and send to the client.
No. No. So there's a variety of different targets on Synack. So I kinda do a little bit of bunny hopping. So I'll I'll spend a, you know, maybe a day or so on a target, and if I get bored, I'll swap to another target, and it's pretty much like hopping all over the place. So, yeah, lots to choose from. Lots to choose from.
Correct. Yes. Yeah, so it's not like, you know, I can boot up and go hack Microsoft. There's specific... There's a specific scope and a specific set of targets that I'm legally allowed to test on. So, yeah.
Yeah. I think Microsoft's a level eight client. So... Yeah. So you've been here for three months, you said. And I know we start at like level one, and then you've gotta turn in certain level vulnerabilities and get those accepted by the VulnOps team. And they're looking for, is it exploitable? Can they duplicate it? Is your... Like, the information that you put into the form to go to the client is all that accurate? And then based off of that, you get paid, and you get points, and that's how you move up and up the different levels. What level are you at now? So currently,
I'm level five. So I'm at the top of the food chain right now. I'm I'm kinda shocked that I hit level five in the time frame that I did. I've talked to some other people, and it's taken them years to hit level five. So I was pretty blown away when I got that email saying like, hey, congratulations, you hit level five. So definitely was a shock.
Nice. Well, what's what's different about you? Are you... Have you been pentesting things since you were, you know, able to read? Or what what's kind of your hacker origin story?
So, in terms of my origin story, I mean, I've always been infatuated with computers. From a young age, I actually did a lot of like video game mods. So I used a program called Cheat Engine, which is a debugger to like, inflate like my health or like, the items that I had. So then I was like, okay, like, this is pretty cool. And you know, as time and time went on, and I grew older, the WannaCry ransomware back in 2017 hit and I was like, Woah, like, didn't realize that something could affect so many people. And I was like, this is a field I definitely want to dive into. And then in 2018, when WikiLeaks happened, with like, the big NSA scandal with the spyware tools, I was like, this is the field I definitely want to spend the rest of my life in.
This is just so fascinating. And so so, you know, once a college, I got my degree in cybersecurity. And that's kind of my origin story as a hacker. And then during my day to day, I am a security consultant for a cybersecurity firm. So I do a lot of pentests daily, non Synack. And, yeah, I spend the rest of my time on Synack content.
So I have a bunch of buddies who are in the Synack Red Team program. They're kind of my mentors, I definitely wouldn't be where I am today without them. So an insider threat, Logue and Fertim, all three are very well established Synack Red Team members. And I believe Logue is on the circle of trust, as well. So they kind of got me connected with Synack. And funny enough, I actually got denied my first time around. And that kind of pushed me to try harder. What happened was I just didn't have enough certifications at the time, and didn't build up my experience. So as soon as I got that denial letter, I immediately worked on my OSCP, passed that, and reapplied, and I was able to get in.
Nice. That's awesome. There's... I've been denied a lot of things, and then you gotta gotta hack your way in. So I very much understand. What's been your favorite part of being on the Synack Red Team?
Honestly, so there is, you know, a lot of public programs, like HackerOne and Bugcrowd. Those are some of the most popular open source bug hunting platforms in the world. Issue with them is they're very competitive. So you can find a lot of valid issues, a lot of them critical high, you know, and they pay well, except it's you versus 10,000 people. So it's very hard to get a bug that actually sticks and lands. What I like about on Synack is the competition is much shorter, like much smaller. So, you know, instead of going against 10,000 people, you're going against 300 people. And on top of that, especially if you're in some special cohorts, or for example, since I'm from The United States, I get to hunt on FedRAMP targets, the competition even gets smaller. So that's what I love about Synack is there's not a lot of competition and the triage time is insanely fast.
Like, for example, I had three SQLis I submitted two days ago, and they're already triaged... They got triaged yesterday. On these public programs like HackerOne, Bugcrowd, you know, resolution can take weeks to months, and it takes a while to get your payout. So, you know, I'm very grateful for Synack.
I have, I just did a patch verification the other day on my FedRAMP target. Nice. Patch, anyone who's listening doesn't know what a patch verification is, It's where you submit a valid vulnerability, the client deems it as an actual security issue. And they kick it back to you once they've attempted a patch for you to verify, hey, does this patch work? And if not, how can it be bypassed? And it's essentially a big back and forth between you and the client. If it's not patched, it'll get kicked back, and then they'll kick it back, and it's just a back and forth.
Yeah. Is it... How do you feel about that? I know you do pentesting as a consultant. You've probably done bug bounty in the past, it sounds like. Is this different?
so in my day to day job, do a lot of back and forth between clients. Like, for example, you know, I'll find multiple vulnerabilities on a client's web app, and usually how it works is, once they feel like they've patched it, they send me a message and they're like, hey, can you double check that this is patched? So this is really nothing new. It's... I I see it a lot of times on HackerOne where where they'll invite you and be like, can you test this to make sure that it's, you know, patched? And then they'll send you like $50 or however much they deem is necessary for patch verification.
I get that. I get that. I hear that from a lot of Synack Red Teamers. Yeah. We've had Ty and Adam on WE'RE IN recently, and they have said the same things. Is there a favorite target or not... Don't tell me the company or the organization, but has there been one that you've just loved working with? And do you have any stories, without too many specifics, of why?
So there was a financial services platform that was on Synack, and it was a United States only target. So that I haven't anytime I see United States only target, kind of a light bulb goes off in my head. Because I'm like, you know, I'm one of only 100 people hunting on this, maybe not even that many, maybe it might be smaller than that. And I was assigned a bunch of different roles. So like, there's an administrator, there was a fraud administrator, there was a regular customer role, and it was a dashboard. So what you could do is if you were a fraud administrator, like, could go in and configure fraud fraud amounts. And if you're an administrator, you could do things like user configs and all that stuff. But the default role had no permissions on the dashboard. If you logged into the dashboard, it would just be a blank page.
And to do these, like, privileged requests, there was an admin user ID that was appended onto every request. Now from this low privileged user, you never got that. You could never see a request where you could get your admin user ID, except when you inspected your JWT token. If you inspected your JWT token, inside was your admin user ID, and I used that and was able to compromise the entire platform. And essentially do every single action on that on that financial services application. So that was that was a really cool app.
Really hard too. That's pretty huge. If someone was interested in joining the Synack Red Team, you've recently gone through the process. You've been denied and came back. Would you recommend to someone who's like, you know what? I like pentesting. I wanna be on that team.
Honestly, from my experience, I would highly recommend getting some certifications. You know, not, I feel like I was kind of conquering the infinity stones, collecting all these certifications. But I would say the one certification to go after is definitely the OSCP. Because not only does it look good towards Synack, it looks good in your professional life, because it's a very high, highly sought after certification. It's very hard to. So I really like a challenge, and OSCP definitely was a big challenge. So highly recommend knocking out some certifications because my issue was I had a a decent chunk of experience, just not the certs to back it up. So definitely knock out those certs.
That's huge. That's huge. My only pentesting cert is eJPT. Security junior pentester. And I took that so that I could rewrite the course and make version two.
It is often something I hear, and it's good to have a few of those under your belt to get into the system. That makes a lot of sense. What about just someone in general? You've you've been in cybersecurity for a bit now. Not necessarily a Synack Red Team member, but what piece of advice would you have for anyone who's, you know, they saw something in the news like you did, a few things, and went, I wanna be in cybersecurity. You've been here for a minute now. What piece of advice would you have?
Always keep learning. This field constantly changes on a day to day basis. So one of the things I like is I have a very short attention span. So if I learn if I learn everything about a field, I can get very bored very quickly. And the one thing I love about this field is that you can never stop learning. There's always something to learn. And especially if you take that push to learn different techniques, you can open yourself up to a variety of opportunities. So like, for example, what I do is I actively scour HackerOne's Hacktivity reports, and also some various, like bug bounty newsletters. And I'll research some techniques, learn different things, and then I'll apply it to Synack. And I've noticed a lot of the times that the same techniques that other people use tends to work on Synack as well. And especially if you push yourself to learn more material, you can find yourself climbing up the ranks really fast.
That makes a lot of sense. Do you have a specialty? I know I've talked to Ty and he likes a lot of the understanding the underlying business systems and the flows. I've talked to a few who are big into injection. They just go and they find everything that they can inject and see what works there. Some folks are really big on to IDOR. You have like a specialty?
Yeah. My specialty, I would say, is authorization and injection issues. That's kinda what I spend a lot of my time hunting on Synack for, because I also like to, you know, like time is money for me. So I don't want to go after the low hanging fruit, like the captcha bypasses, like that's not worth it to me. So I go after the heavy hitters. So I specialize in a lot of IDORs, auth issues, like, for example, that financial services platform. I just completely demolished their authorization schema. So... And and SQL injections as well. I've been getting into that. There's some Synack Red Team members who are very well versed and have kinda taken me under their wing, which I I appreciate. But like, I'm definitely not a pro in injections by any means. But that is definitely something I'm working towards.
I get that. That's awesome. Well, Austin, it has been great talking with you. Folks, if you enjoyed this, subscribe, like, and share with your friends, and join us again for the next WE'RE IN podcast. Thank you.
