Rooted
Join
Verified credential - AccessCurrent

BM::bonginc

Bonginc

@bonginc · Operator · United States

Pentester

English
ACCESS2RANK
RANK
2 · Operator
Verified points
579
Hack The Box
Script Kiddie
TryHackMe
— · 33 rooms
Public tooling
5 ★
Issued
2026-08-16
Valid until
2027-08-29
Standing
32 of 134
Certifications held
CAPT
Demonstrated knowledge

Skills

Every channel comes from unique Daily answers. Difficulty and sustained evidence move the signal; repeats never do.

17unique answers
Strongest signal · Web & AppSec · 52/100 · Operational
WEB

Web & AppSec

52/100
Operational57% accuracy8/14 correctHard cleared↓ slipping

10 signal points to Strong · reliable evidence

NETWORK

Networks & protocols

14/100
Exploring0% accuracy0/1 correctNo difficulty clearednew signal

6 signal points to Developing · early signal

CRYPTO

Cryptography

19/100
Exploring100% accuracy1/1 correctEasy clearednew signal

1 signal points to Developing · early signal

FORENSICS

Forensics & DFIR

14/100
Exploring0% accuracy0/1 correctNo difficulty clearednew signal

6 signal points to Developing · early signal

Annex — how this was earned

13 entries. Nothing scores without one.

579 total
Credentials509

4 entries

Quizzes and labs70

9 entries

13 ledger entries back these totals. The full derivation is visible to the holder and to Rooted review.

Where your proof lands

Derived from what each verified ledger entry actually covers. You have nothing in forensics & dfir, recon & osint, cloud & containers.

  • Networks & protocols258
    Evidence
    CAPT
    70256
    bonginc
  • Code & tooling133
    Evidence
    bonginc
  • Web & AppSec124
    Evidence
    A PDF preview endpoint accepts a URL. Supplying http://169.254.169.254/latest/meta-data/ c
    POST /account/email changes the logged-in user's email using only a session cookie; a cros
    A page on another site can submit a form that changes your email while you are logged in.
    bonginc
    The search route parameterises q but concatenates sort directly into `ORDER BY ${sort}`. A
    During an authorised pentest, GET /api/invoices/184 returns your invoice. Changing 184 to
    Adding a single quote to a product ID changes the response to a SQL syntax error. What sho
    You change /users/41 to /users/42 and see another user's profile. What is this?
  • Active Directory60
    Evidence
    70256
  • Cryptography4
    Evidence
    After a breach, two hundred users with the password `summer2026` have the same stored hash
  • Forensics & DFIRno proof yet
  • Recon & OSINTno proof yet
  • Cloud & containersno proof yet

The road to Hacker

321 pts short

Everything below is priced. Pick the cheapest one and the gap closes.

  1. Claim a CVE

    Any published advisory with your name on the credit line.

    +260
    points
    81% of the gap
  2. Clear another lab

    9 lab entries scored. 1,930 points left before the lab ceiling.

    +60
    points
    19% of the gap
  3. Publish a write-up

    Explain the bug, impact and fix. Peer-reviewed write-ups score after approval.

    +180
    points
    56% of the gap
  4. Submit a vulnerability report

    A confirmed low, medium, high or critical report is the cleanest path up the ladder.

    +160
    points
    50% of the gap
  5. Own 10 more machines

    Each user or system own is worth 4 points, and rank bonuses compound.

    +40
    points
    12% of the gap
  6. Earn Security+

    Verified against your credential URL.

    +80
    points
    25% of the gap

Not one figure above was typed in by bonginc.

Read how points are earned
Get your credential
Rank requirements beyond points
  • Rank 4+ - One verified credential or one confirmed report
  • Rank 7+ - One confirmed report or one credited CVE
  • Rank 9+ - A credited CVE at CVSS 9.0+, or three critical confirmed reports