diodb VS IoTGoat

Perhaps: https://disclose.io/programs/

Hi, I want to make some experience with web pentesting and I wanted to take some small bug bounty programs from disclose.io/programs/ . But to be honest I am scared that maybe I will do something wrong and I will face legal consequences 😱 . I am scared that by making the report they will see that I exploited the bug too much and put them in danger or something like that. I heard about white hat hackers reporting vulnerabilities and facing legal action but they discovered them without a bug bounty program like in this case https://www.bleepingcomputer.com/news/security/ethical-hacker-exposes-magyar-telekom-vulnerabilities-faces-8-years-in-jail/ What is your opinion about this ?

2) https://disclose.io

Helped develop coordinated vulnerability disclosure frameworks to allow security researchers to report security issues in good faith

I would also suggest contacting https://disclose.io/ and your National CSIRT team and ask for help. Good luck :)

Yeh, these are the different orgs that run programs on behalf of companies. For a list of the orgs running programs there’s about 2,300 of those here (also open-source and a contact work in progress): https://github.com/disclose/diodb

On a related note, check out IoTGoat - it's a deliberately insecure IoT firmware image based on OpenWRT that you can use to explore a lot of common design flaws in embedded Linux devices: https://github.com/OWASP/IoTGoat

We have a chapter on methodologies in the book and go into a lot of detail on how we test. We also created the free OWASP IoT Goat project - a deliberately insecure IoT firmware that you can use for a testbed.