Method and system for validating a vulnerability submitted by a tester in a crowdsourcing environment

1. A method for validating a vulnerability submitted by a tester in a crowdsourcing environment, the method comprising:

identifying at least one vulnerability within at least one computer resource;

receiving vulnerability data corresponding to the at least one vulnerability;

pre-processing the vulnerability data to generate structured data;

generating a replica of the vulnerability using the structured data and at least one validator, the at least one validator being configured to verify an existence of a specific type of application vulnerability;

calculating a confidence score of the vulnerability using the replica of the vulnerability and a result of the at least one validator; and

executing at least one validating instruction based on the confidence score of the vulnerability, and a threshold confidence score.

2. A method according to claim 1 , wherein the at least one validating instruction comprises an instruction to approve the vulnerability when the confidence score of the vulnerability is above the threshold confidence score.

3. A method according to claim 1 , further comprising recommending a reward for the tester when the confidence score of the vulnerability is above the threshold confidence score.

4. A method according to claim 1 , further comprising sending the vulnerability to a manual triage queue when the confidence score of the vulnerability is below the threshold confidence score.

5. A method according to claim 1 , further comprising sending the vulnerability to a manual triage queue when the server fails to generate the replica of the vulnerability.

6. A method according to claim 1 , further comprising identifying at least one executable plan for generating the replica of the vulnerability.

7. A method according to claim 6 , further comprising sending the vulnerability to the manual triage queue when the server fails to identify the at least one executable plan for generating the replica of the vulnerability.

8. A method according to claim 1 , further comprising:

generating a signature for the vulnerability using the structured data;

comparing the signature for the vulnerability with a signature of at least one pre-stored vulnerability submission; and

notifying the tester when the signature for the vulnerability is matched with the signature of the at least one pre-stored vulnerability submission.

9. A method according to claim 8 , further comprising providing a reference of the at least one pre-stored vulnerability submission to the tester when the signature for the vulnerability is matched with the signature of the at least one pre-stored vulnerability submission.

10. A method according to claim 1 , further comprising:

extracting information from the structured data;

determining a scope of the vulnerability using the extracted information; and

notifying the tester when the scope of the vulnerability is outside a scope of a bug bounty project.

11. A method according to claim 10 , wherein the notifying the tester comprising rejecting the vulnerability when the scope of the vulnerability is outside the scope of a bug bounty project.

12. A method according to claim 1 , wherein the structured data include at least parameterization of an internet protocol, a hostname, an IP address, a port, a service, a uniform resource locator (URL), a parameter, a http method, a vulnerability type, and a section of code.

13. A system for validating a vulnerability submitted by a tester in a crowdsourcing environment, the system comprising:

a testing computer configured to identify at least one vulnerability within the at least one computer resource and submit vulnerability data corresponding to the at least one vulnerability to a server; and

the server configured to:

pre-process the vulnerability data to generate structured data;

generate a replica of the vulnerability using the structured data and at least one validator, the at least one validator being configured to verify an existence of a specific type of application vulnerability;

calculate a confidence score of the vulnerability using the replica of the vulnerability and a result of the at least one validator; and

execute at least one validating instruction based on the confidence score of the vulnerability, and a threshold confidence score.

14. A system according to claim 13 , wherein the server is configured to automatically generate the replica of the vulnerability in accordance with at least one executable plan.

15. A system according to claim 13 , wherein the server is configured to:

generate a signature for the vulnerability using the structured data;

compare the signature for the vulnerability with a signature of at least one pre-stored vulnerability submission; and

notify the tester when the signature for the vulnerability is matched with the signature of the at least one pre-stored vulnerability submission.

16. A system according to claim 13 , wherein the server is configured to:

extract information from the structured data;

determine a scope of the vulnerability using the extracting information; and

notify the tester when the scope of the vulnerability is outside a scope of a bug bounty project.

17. A system according to claim 13 , wherein the structured data includes at least parameterization of an internet protocol, a hostname, an IP address, a port, a service, a uniform resource locator (URL), a parameter, a http method, a vulnerability type, and a section of code.