>

🚀 We've added new community writeups and a Web3 section! Click here to see what's new.

🐛 Bug Bounty Hunting Search Engine

Made with ❤️ by @payloadartist
NEW
Example search: http://bugbountyhunting.com/?q=keyword
Showing 1337 random writeups. Use the search bar to find more.
✍️ [Writeup][Bug Bounty][Tokopedia] Manipulation of Likes in Product Reviews [EN]
✍️ An inconsistent CSRF
✍️ Abusing Arbitrary File Deletes To Escalate Privilege And Other Great Tricks
✍️ How I was able to see likes and dislikes count even though is hidden by victim | YouTube #2
✍️ Chaining Three Bugs to Access All Your ServiceNow Data
✍️ CVE-2022-21661: Exposing Database Info Via Wordpress SQL Injection
✍️ My Disclosed Report about Basic auth Api details at Reverb.com
✍️ XSS Vulnerability in Twitter [https://twitter.com] (Write Up)
✍️ Twitter’s Vine Source code dump - $10080
✍️ Another 1500$: CR/LF Injection
✍️ OVE-20210809-0001 Visual Studio Code .ipynb Jupyter Notebook XSS (Arbitrary File Read)
✍️ Relative Path File Injection: The Next Evolution in RPO
✍️ Indirect UXSS issue on a private Android target app
✍️ How I found my first RCE | by Vrushabh Lakhani
✍️ Exploiting CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability
✍️ WordPress 5.1 CSRF to Remote Code Execution
✍️ PII Leakage - Revealing Secrets
✍️ A technique to semi-automatically find vulnerabilities in WordPress plugins
✍️ ICloud.com DOM-Based XSS! #BugBounty
✍️ Reflected XSS on www.yahoo.com
✍️ Logical Flaw Resulting Path Hijacking
✍️ How I was able to get account takeover via IDOR form JWT
✍️ A business logic error bug worth 600$
✍️ Cross Domain Referrer Leakage
✍️ HDiff: A Semi-automatic Framework for Discovering Semantic Gap Attack in HTTP Implementations
✍️ [web3] Tranchess Liquid Staking Deposit First-Run Vulnerability Analysis | Kalos
✍️ Compromising Garmin’s Sport Watches: A Deep Dive into GarminOS and its MonkeyC Virtual Machine
✍️ Cloning internal Google repos for fun and… info?
✍️ 3 Easy cash via cache
✍️ New macOS vulnerability, Migraine, could bypass System Integrity Protection
✍️ Process injection: breaking all macOS security layers with a single vulnerability
✍️ Facebook Vulnerability: Non-unfriendable user in /hacked workflow
✍️ Chromium: Same Origin Policy bypass within a single site a.k.a. "Google Roulette"
✍️ Counter-Strike Global Offsets: reliable remote code execution
✍️ Discoure themes OS Command Injection
✍️ Simple CORS misconfig leads to disclose the sensitive token worth of $$$
✍️ Stored XSS in message.alibaba.com ($2,000)
✍️ v1 Instance Metadata Service protections bypass
✍️ Detecting Jackson deserialization vulnerabilities with CodeQL
✍️ CSRF + Open Redirect To Account Takeover
✍️ MS Enterprise app management service RCE. CVE-2022-35841
✍️ PII Data Leakage and US$1500 Bounty
✍️ Cross Site Scripting (XSS) Reflected in one of the subdomains of “General Motors”(Bugbounty)
✍️ Java Exploitation Restrictions in Modern JDK Times
✍️ Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032) – Overview and Mitigations
✍️ Part 2
✍️ Securing Developer Tools: A New Supply Chain Attack on PHP
✍️ Exploiting a double-edged SSRF for server and client-side impact
✍️ Open Redirection - QR Code Magic
✍️ Old GitHub Profile Takeover!
✍️ How I found the Grafana zero-day Path Traversal exploit that gave me access to your logs
✍️ Exploiting dynamic rendering engines to take control of web apps
✍️ How I Was Able To TakeOver Any Account On One Of Europe's Largest Media Companies
✍️ Breaking Down Barriers: Exploiting Authenticated IPC Clients
✍️ Phantom Secrets: Undetected Secrets Expose Major Corporations
✍️ CVE-2022-22947: SpEL Casting And Evil Beans
✍️ Saving more than 100,000 website from a Watering Hole attack
✍️ An Effective 5 min recon leads to a Hall of Fame
✍️ Bug Bounty: Fastmail
✍️ New npm Flaws Let Attackers Better Target Packages for Account Takeover
✍️ Unlock any blur text/picture without membership/subscription on Scribd.com |By Neuchi
✍️ HTTP Request Smuggling + IDOR
✍️ Dangling DNS Records on surf-test.xwf.internet.org (Amazon EC2)!
✍️ File Upload to RCE
✍️ Adobe bug bounty using IDOR, Confidential data leaks
✍️ Remote code execution and elevation of local privileges in Mitel Unify OpenStage and OpenScape VoIP phones
✍️ [VDP] Reflected XSS in Facebook’s Mirror Websites | by Hacking articles
✍️ Bypassing Amazon Kids+ Parental Controls
✍️ XSS “403 forbidden” bypass write up
✍️ Methodological approach to find business logic bugs
✍️ [P2O Vancouver 2023] SharePoint Pre-Auth RCE chain (CVE-2023–29357 & CVE-2023–24955)
✍️ SecStory: How I Found Multiple P1 Vulnerabilities without Recon
✍️ Vine User’s Private information disclosure
✍️ $1600 Bounty on a Main Domain
✍️ XSS, RCE & HTML File Upload in same endpoint
✍️ Multiple vulnerabilities in Danfoss Storeview Web
✍️ IDOR leads to leak Private Details
✍️ MY First Bug In Hackerone
✍️ A supply-chain breach: Taking over an Atlassian account
✍️ Detecting Server-Side Prototype Pollution
✍️ Dumping LSA secrets: a story about task decorrelation
✍️ How I Earned $750 Bounty Reward From AT&T bug Bounty -Adesh Kolte
✍️ How I found 5 store XSS on a private program. Each worth “1,016.66$”
✍️ Is Math.random() Safe? from missing rate limit to bypass 2fa and possible sqli
✍️ Disclose the Instagram account linked to a Facebook user account or page
✍️ XSS On Twitter [Worth 1120$]
✍️ How does my recon win $250 in 15 minutes
✍️ Analysing Crash Messages To Achieve Blind Root Command Injection
✍️ 2FA Bypass via Logical Rate Limiting Bypass
✍️ Amazon Bypass Open Redirect
✍️ Think Outside the Scope: Advanced CORS Exploitation Techniques
✍️ Exploiting Hibernate Injection in "Order by" Clause (Oracle database)
✍️ [IDOR] Delete saved credit cards from any Business Manager Account — Facebook Bug Bounty
✍️ Weird Vulnerabilities Happening on Load Balancers, Shallow Copies and Caches
✍️ Facebook BugBounty: Intercept incoming friend requests of Victim add/accept to your facebook account
✍️ Remotely permanent crash any Instagram user via permanent DoS in user DM's.
✍️ View orders and financial reports lists for any page shop.
✍️ How did I found RCE on SHAREit which rewarded $$$ bounty
✍️ GraphQL IDOR leads to information disclosure
✍️ Denial of service in Facebook Fizz due to integer overflow (CVE-2019-3560)
✍️ Finding SQL injections fast with white-box analysis — a recent bug example
✍️ Destroying Armies and Villages through Cross-Site Scripting - Bug Bounty Write-up
✍️ Csrf Bypass Using Cross Frame Scripting
✍️ How did we find the same vulnerability in 9 Android Apps
✍️ Bypass Plan Restriction & Get 350$ Bounty
✍️ CVE-2018-13784: PrestaShop 1.6.x Privilege Escalation
✍️ Poisoning your Cache for 1000$ - Approach to Exploitation Walkthrough
✍️ How spending our Saturday hacking earned us 20k
✍️ How we was able to takeover whole organization via Privilege Escalation
✍️ From . in regex to SSRF — part 2
✍️ Unauthenticated Remote Code Execution in Cisco Nexus Dashboard Fabric Controller (formerly DCNM)
✍️ Account Take Over (Via an API)
✍️ Duplicate CSRF… Leads to
✍️ Adobe Acrobat hollowing out same-origin policy
✍️ Blockchain Network is Secured! But not the apps and their Integrations
✍️ Full Team Takeover
✍️ Chaining our way to Pre-Auth RCE in Metabase (CVE-2023-38646)
✍️ How I upgraded my privileges to the administrator of Odnoklassniki’s url shortener
✍️ WordPress Plugin Confusion: How an update can get you pwned
✍️ [Responsible disclosure] How I could have hacked 62.5 million Zomato Users
✍️ IDOR on clientauthconfig.googleapis.com
✍️ A 7500$ Google sites IDOR
✍️ HTTP Parameter Pollution - It’s Contaminated
✍️ $900 Blind XSS
✍️ Exploiting an SQL injection with WAF bypass
✍️ Arbitary File Upload too Stored XSS - Bug Bounty
✍️ Unrestricted file upload in Rocket TRUfusion Enterprise <= 7.9.6.0
✍️ $500 getClass
✍️ Business Logic Vulnerabilities Series: A brief on Abusing Invitation Systems
✍️ Stored Iframe Injection + CSRF = Account Takeover 😎😎
✍️ BugBounty: How I Cracked 2FA (Two-Factor Authentication) with Simple Factor Brute-force !!! 😎
✍️ From Shodan Dork to Grafana 📊Local File Inclusion
✍️ Pwning Microsoft Azure Defender for IoT | Multiple Flaws Allow Remote Code Execution for All
✍️ Exploits Explained: Persisting Through a Client-Side Prototype Pollution
✍️ Bypassing file upload filter by source code review in Bolt CMS
✍️ Alternative link
✍️ Bug Bounty - Cross-site request forgery is a thing
✍️ [IDOR] $400 — Deleting Other Project in Shopee
✍️ Unauthenticated Command Injection Vulnerability in VMware NSX SD-WAN by VeloCloud
✍️ Alternative link
✍️ Critical vulnerability on TP-Link service or how I got 0$
✍️ How i found blind XSS in Apple
✍️ Never Stop at Banner Grabbing
✍️ EN | Account Takeover via Web Cache Poisoning based Reflected XSS
✍️ In GUID We Trust
✍️ How I found the most critical bug in live bug bounty event?
✍️ Union Based Sql injection Write up ->A private Company Site
✍️ Bug Bounty — Advanced Manual Penetration Testing Leading to Price Manipulation Vulnerability
✍️ Getting PHP Code Execution and leverage access to panels,databases,server
✍️ Github Organization Takeover By Claiming Owner Invitation
✍️ New Wine in Old Bottle - Microsoft Sharepoint Post-Auth Deserialization RCE (CVE-2022-29108)
✍️ Independently Secure, Together Not So Much – A Story Of 2 WP Plugins
✍️ Bug Bounty Experience: Unvalidated Redirection Vulnerability
✍️ CVE-2021-26084
✍️ Finding bugs on Chess.com
✍️ Security Advisory: NETGEAR Routers FunJSQ Vulnerabilities
✍️ Tale of Account Takeovers (Part-2)
✍️ Mining Node.js Vulnerabilities via Object Dependence Graph and Query
✍️ Finding XSS in a million websites (cPanel CVE-2023-29489)
✍️ Part 2
✍️ Stealing User Information Via XSS Via Parameter Pollution
✍️ Oracle Cross Site Scripting Vulnerability -Adesh Kolte
✍️ From nothing to AWS credentials
✍️ Privilege Escalation | stealing user’s point | Bugcrowd
✍️ How do I Bypass Payment when a Subscription ends so I don’t have to pay for my subscription
✍️ SD-PWN Part 2 — Citrix SD-WAN Center — Another Network Takeover
✍️ Neglected DNS records exploited to takeover subdomains
✍️ Universal Code Execution by Chaining Messages in Browser Extensions
✍️ File Disclosure via .DS_Store file (macOS)
✍️ SSRF in PDF renderer using SVG
✍️ Abusing Facebooks `Call To Action` To Launch Internal Deeplinks
✍️ Google Bug Bounty: CSRF in learndigital.withgoogle.com
✍️ SiriSpy - iOS bug allowed apps to eavesdrop on your conversations with Siri
✍️ A New Vector For “Dirty” Arbitrary File Write to RCE
✍️ Van1338: Design Flaw in Riot Vanguard: $6,000
✍️ How I made more than $30K with Jolokia CVEs
✍️ Luminate Store Basics defacement and potential takeover
✍️ U.S. Department of Defense - Info Disclosure and SQLi Writeup
✍️ Malicious redirect on mailroom.prezi.com
✍️ The Castle’s Latrine
✍️ Protonmail XSS — Stored
✍️ Error Based MSSQL Injection | Everything Vulns
✍️ SQL injection through User-Agent
✍️ Multiple Address Bar Spoofing Vulnerabilities In Mobile Browsers
✍️ Microsoft bug bounty writeup
✍️ How I Reported a DoS Vulnerability to AWS
✍️ IIS-Default-Page-to-Information-Disclosure
✍️ How i found a vulnerability that leads to access any users’ sensitive data and got $500
✍️ How I found (P2) Broken Authentication with Zero Skill of Hacking
✍️ Bragging Rights(Part 1): Short story of a bug wave
✍️ mysqlnd/pdo password buffer overflow leading to RCE (CVE 2022-31626)
✍️ The Story of Blind SSRF leads to internal Host discovery.
✍️ XSS In sports.tw.campaign.yahoo.net
✍️ Alternative link
✍️ How two dead accounts allowed remote crash of any instagram android user
✍️ Internet Explorer has a URL problem
✍️ Multiple vulnerabilities in Nokia BTS Airscale ASIKA
✍️ XSS Stored On [ Outlook Web — Outlook Android App ]
✍️ Remote Stealth Brute-force of Oracle Database Passwords
✍️ Contentful Access Token Disclosure in Android APK
✍️ IAM Whoever I Say IAM :: Infiltrating VMWare Workspace ONE Access Using a 0-Click Exploit
✍️ Unauthorized Access To Admin Panel via Swagger
✍️ How I Bypassed Netflix Profile Lock?
✍️ Lock Screen Bypass Exploit of Android Devices (CVE-2022–20006)
✍️ (POC) Update business fyi message as Facebook page analyst
✍️ I Earned $3500 and 40 Points for A GraphQL Blind SQL Injection Vulnerability.
✍️ 2nd RCE and XSS in Apache Struts before 2.5.30
✍️ Bypassing Google’s authentication to access their Internal Admin panels
✍️ IDOR “Insecure direct object references”, my first P1 in Bugbounty
✍️ Hundreds of internal servicedesks exposed due to COVID-19
✍️ Alternative link
✍️ Bug Hunting Journey of 2019
✍️ Exploiting the Source Engine (Part 1)
✍️ How I Paid For My Holiday With Bug Bounty
✍️ How To Hack PayU – And Buy 10x More For The Same Price
✍️ My secret to API privesc: Tapping compromised web servers
✍️ De-Anonymization attacks against Proton services
✍️ Remote Code Execution in Melis Platform
✍️ #BugBounty —” Database hacked of India’s Popular Sports company”-Bypassing Host Header to SQL injection to dumping Database — An unusual case of SQL injection.
✍️ Modeling Malicious Code: Hacking In 3D
✍️ How I Hacked the Microsoft Outlook Android App and Found CVE-2019-1105
✍️ Okta For Red Teamers
✍️ Reflected XSS in Django REST Framework Api at MapBox Subdomain
✍️ Yahoo – Root Access SQL Injection – tw.yahoo.com
✍️ Bypassing required reviews using GitHub Actions
✍️ Bug HTML Injection On Tokopedia !
✍️ Alternative link
✍️ Multi-factor Auth Bypass with Password Reset Function
✍️ [2/3] XSS Through The Front-Door @ GitLab
✍️ Fickle PDFs: exploiting browser rendering discrepancies
✍️ Hijacking GitHub Repositories by Deleting and Restoring Them
✍️ Leaking AWS Metadata - The Unusual Way
✍️ CSRF Token Bypasss — A Tale of my $2k bug
✍️ Break Me Out Of Sandbox In Old Pipe - CVE-2022-22715 Windows Dirty Pipe
✍️ Exploiting Laravel based applications with leaked APP_KEYs and Queues
✍️ Who Contains the Containers?
✍️ Hacking Terraform State for Privilege Escalation
✍️ CVE-2016-3473
✍️ $1800 worth Clickjacking
✍️ Account takeover through register functionnality
✍️ How I could have deleted any photo from Facebook
✍️ [web3] Critical bug in Talent Protocol found by okkothejawa & 𝗌𝗂𝗀𝗁
✍️ Accessing Restricted Documents With Extra JSON Body Content
✍️ NCIIPC VDP Bug : Open Redirection Vulnerability In Govt. Site !!
✍️ Story of my two (but actually three) RCEs in SharePoint in 2018
✍️ Exploiting an HTML injection with dangling markup
✍️ SQL injection in harvard subdomain
✍️ Cors Blimey: The power of chaining CORS
✍️ Enroll in Facebook Ad-break program without Facebook approval
✍️ self XSS to stored XSS [ think out the box]
✍️ CSRF leads to account takeover in Yahoo!
✍️ Edmodo — IDOR to view private files of any class
✍️ Bypass rate limit to enumeration users through Google Drive
✍️ MongoDB NoSQL Injection with Aggregation Pipelines
✍️ Hacking — Always check out the Images
✍️ Account Takeover Vulnerability :)
✍️ Discovering 7 Open Redirect Bypasses and 3 XSS Bypasses Within a Single Program Using the Same Parameters
✍️ How We hacked (bypassed) Admin Panel just by JS file
✍️ #bugbounty How I Takeover Microsoft Store.
✍️ Expose business email and payment account balance of any Facebook commerce page.
✍️ Moodle Blind SQL injection via MNet authentication
✍️ How I hacked all the [REDACT] Agents accounts
✍️ Bypassing XSS Filtering at Anchor Tag
✍️ [1500$ Worth — Slack] vulnerability, bypass invite accept process
✍️ It took me only 5 minutes to find an RCE on Bentley
✍️ Hunting Insecure Direct Object Reference Vulnerabilities for Fun and Profit (PART-1)
✍️ How I earned \(\) by finding confidential customer data including plain-text passwords!
✍️ Reflected XSS in Zomato
✍️ From data leak to account takeover
✍️ Taking over Azure DevOps Accounts with 1 Click
✍️ Breaking the Barrier: Admin Panel Takeover Worth $3500
✍️ Hacking Apple Security Report System
✍️ [web3] 88mph Function Initialization Bug Fix Postmortem. This is a postmortem of a vulnerability… | by Immunefi | Oct, 2021 | Medium
✍️ DoS Across Facebook Endpoints
✍️ Leaked Salesforce API access token at IKEA.com
✍️ Lucky Bug Which Let Me Change Name of Every Accounts at a Single Click
✍️ Airbnb – Ruby on Rails String Interpolation led to Remote Code Execution
✍️ Uncovering a Command Injection, $2400 Bounty
✍️ HTML Injection(Unique Exploitation)
✍️ RCE in Citrix ShareFile Storage Zones Controller (CVE-2021-22941) – A Walk-Through
✍️ Facebook PageAnalyst Could Add oneself as Moderator on Group
✍️ Bug Bounty : Account Takeover Vulnerability POC
✍️ Blind OS Command Injection
✍️ The Tale Of SSRF To RCE on .GOV Domain
✍️ Fuzzing and credentials leakage..awesome bug hunting writeup
✍️ A Developer's Nightmare
✍️ CORS Misconfiguration -> PII Leak
✍️ CVE-2020–9854: “Unauthd” - (three) logic bugs ftw!
✍️ Multiple XSS
✍️ Exploiting Lambda Functions for Fun and Profit
✍️ Unauthorized access to any Facebook user’s draft profile picture frames
✍️ Somebody Call The Plumber, GraphQL is Leaking Again…
✍️ TL;DR
✍️ How I bypassed 2 Factor Authentication
✍️ Your Amiibo’s Haunted
✍️ My Bug Bounty Journey and My First Critical Bug — Time Based Blind SQL Injection
✍️ Access to staging environment via User-Agent string
✍️ Autodesk Fusion 360 <= 2.0.12887 “Insert SVG” Blind XXE
✍️ Discovering and Exploiting a XML External Entity (XXE) Vulnerability in a Public Bug Bounty Program
✍️ How I could have read your confidential bug reports by simple mail?
✍️ I Own Your Customers !!!
✍️ TRAP; RESET; POISON; - Taking over a country Kaminsky style
✍️ I mean, IDOR is NOT only about others ID
✍️ DOS via cache poisoning
✍️ Chains on Chains: Chaining multiple low-level vulns into a Critical.
✍️ Unveiling Vulnerabilities: Loose Permissions in Salesforce Lightning Pose Data Security Threats
✍️ Abusing Azure Hybrid Workers for Privilege Escalation – Part 2: An Azure PrivSec Story
✍️ XSS that can pay your Bills :)
✍️ Multiple vulnerabilities in Cisco Unified Communications Manager version 11.5.1
✍️ How I was able to spoof any Instagram username on Instagram shop
✍️ Reflected XSS Primagames.com
✍️ Bypass CSRF With ClickJacking Worth $1250
✍️ A Classical Account Takeover Case via Multiple Bypasses
✍️ Lightning Components: A Treatise on Apex Security from an External Perspective
✍️ Breaking Parser Logic: Gain Access To NGINX Plus API — Read/Write Upstreams.
✍️ Account Takeover via improper input validation
✍️ G Suite - Device Management XSS
✍️ An Unusual Tale of Email Verification Bypass
✍️ Parsing the DOM elements of Other pages via XSS: A Bug Bounty Story
✍️ Restriction is not a promise : Privilege escalation on Google.
✍️ Securing Databricks cluster init scripts
✍️ How I got my first big bounty payout with Tesla
✍️ CVE-2020-9759 - Getting root on webOS
✍️ How i Hacked Scopely with “Sign in with Google”
✍️ Bypassing Safe Links in Exchange Online Advanced Threat Protection
✍️ URLs in img tag aren’t passed through safe_image.php which lead to exposure of Facebook users IPs.
✍️ Part 2 - Exploiting a blind format string
✍️ Got Another XSS using Double Encoding
✍️ Hunting for XSS with CodeQL
✍️ Stealing user passwords through a VPN’s SSO
✍️ CVE-2022-30526 (Fixed): Zyxel Firewall Local Privilege Escalation
✍️ Continuing the Citrix Saga: CVE-2023-5914 & CVE-2023-6184
✍️ Checkmk: Remote Code Execution by Chaining Multiple Bugs (1/3)
✍️ Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling
✍️ How can i get SQL Injection
✍️ CVE-2023–24625 / IDOR in Faveo Service Desk
✍️ chaining improper authentication to idor and no rate limit for mass account takeover
✍️ From Discovery to Disclosure: ReCrystallize Server Vulnerabilities
✍️ Finding and exploiting race condition vulnerability on facebook server
✍️ Playing Dominos with Moodle's Security (1/2)
✍️ Weird “Subdomain Take Over” pattern of Amazon S3
✍️ What is kong & why we’re relying on it
✍️ Hello: I’m your Domain Admin and I want to authenticate against you
✍️ SSD Advisory – XenForo RCE Via CSRF
✍️ CVE-2022–36635 — A SQL Injection in ZKSecurityBio to RCE
✍️ How I found a bug in Apple within just in 5min.
✍️ Xiaomi Execute Arbitrary JavaScript
✍️ Subdomain Misconfiguration lead to AWS S3 Buckets Reader
✍️ [POC] Cross-Site Scripting on Garuda Indonesia Website
✍️ A Creative Way To Get Someones YouTube Videos Deleted + A Copyright Strike Against Their YouTube Channel
✍️ Breaking Bitbucket: Pre Auth Remote Command Execution (CVE-2022-36804)
✍️ Subdomain Takeover: How a Misconfigured DNS Record Could Lead to a Huge Supply Chain Attack
✍️ Sysdreams
✍️ Admin Disclosure of Facebook Business all Pages by normal employees:
✍️ Hacking Swisscom’s End-to-End Encrypted Cloud Storage for $4,000
✍️ Airbnb – Chaining Third-Party Open Redirect into Server-Side Request Forgery (SSRF) via LivePerson Chat
✍️ Alternative link
✍️ Stored XSS at Trello.com
✍️ Tesla Motors blind SQL injection
✍️ A student's dream: hacking (then fixing) Gradescope's autograder
✍️ Hey Developer, Give me your API keys.!!
✍️ Update: Want to take over the Java ecosystem? All you need is a MITM!
✍️ Exploiting Redash instances with CVE-2021-41192
✍️ Django Privilege Escalation – Zero To Superuser
✍️ Hacking a Bank by Finding a 0day in DotCMS
✍️ Subdomain Take Over Worth 100£
✍️ Bypassing XSS filters using Double Encoding
✍️ BBP Writeup Series #1 – Turning “useless” HTMLi on [REDACTED] into a P1
✍️ Bugcrowd’s Domain & Subdomain Takeover vulnerability!
✍️ My New Discovery In Oracle E-Business Login Panel That Allowed To Access For All Employees Information's & In Some cases Passwords At More Than 1000 Companies
✍️ Telegram users' privacy has been violated again. Messenger representatives demand not to disclose details
✍️ CVE-2022-4908: SOP bypass in Chrome using Navigation API
✍️ [RCE] Remote code execution at api.PrivateProgram.com (CVE-2017-5638)
✍️ Hijacking Someone Else’s DCSync
✍️ CVE-2022-41343
✍️ Critical Local File Read in Electron Desktop App
✍️ Privilege Escalation Leads to making authenticated actions (payment processing, creating invoices.. etc)
✍️ Open Redirect In Flock | My First Swag pack
✍️ Fiverr email restriction bypassed | Bounty 100$
✍️ Admin Panel Bypass without the credentials
✍️ Stories Of IDOR
✍️ Full Account Takeover (Android Application)
✍️ [web3] Taking Home a $20k Bounty With Oasis' Platform Shutdown Vulnerability | Trust
✍️ The forgotten IPFS vulnerabilities
✍️ cURL audit: How a joke led to significant findings
✍️ Account takeover via stored xss
✍️ Dodging OAuth origin restrictions for Firebase spelunking
✍️ If It’s a Feature!!! Let’s Abuse It for $750
✍️ Circumventing Browser Security Mechanisms For SSRF
✍️ ArtiPACKED: Hacking Giants Through a Race Condition in GitHub Actions Artifacts
✍️ From Intigriti challenge to a Vue.js script gadget
✍️ Okta Response to Security Report
✍️ Massive Users Account Takeovers(Chaining Vulnerabilities to IDOR)😲
✍️ The Confused Mailman: Sending SPF and DMARC passing mail as any Gmail or G Suite customer
✍️ Sensitive Information Disclosure: Web Cache Deception Attack
✍️ Leaked Credentials gives access to internalfb.com
✍️ Bypassing 2-Factor Authentication for Facebook Business Manager (Bounty: 1000 USD)
✍️ $10k host header
✍️ Replying Comments On Someone’s LiveStream From Page is Posted as Personal Identity
✍️ Tale of a Misconfiguration in Password Reset
✍️ Write up – $1,000 usd in 5 minutes, xss stored in outlook.com (ios browsers)
✍️ It’s the Little Things : Breaking an AI
✍️ Google Stored XSS in Payments
✍️ Vulnerability Spotlight: CVE-2023-0264
✍️ Neighbourhood Watch - Hikvision Intercom Eavesdropping
✍️ CSRF through URL with # tag parameter
✍️ Joomla Password Reset Vulnerability And A Stored XSS For Full Compromise
✍️ DLL Hijacking – Finding Vulnerabilities In pestudio 9.52
✍️ Chaining rate limiting for account lockout
✍️ Server Side Request Forgery - A Forged Document
✍️ #BugBounty — “User Account Takeover-I just need your email id to login into your shopping portal account”
✍️ Stealing local storage data through XSS
✍️ Business Logic Errors - A Logic Destruction
✍️ lateralus (CVE-2023-32407) - a macOS TCC bypass
✍️ 4300$ Instagram IDOR Bug (2022)
✍️ Missing Authentication in ZKTeco ZEM/ZMM Web Interface
✍️ Multiple vulnerabilities on Chamilo 1.11.18
✍️ How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE!
✍️ Chaining vulnerabilities to criticality in Progress WhatsUp Gold
✍️ Password Reset Token Leak via X-Forwarded-Host
✍️ Demo
✍️ Undermining Microsoft Teams Security by Mining Tokens
✍️ How I was able to do Mass Account Takeover[Bug Bounty]
✍️ How I hacked one of the biggest Airline in the world
✍️ Gaining access through error-based SQLi using WebSockets
✍️ No RCE? Then SSH to the box!
✍️ Deleting account via support ticket
✍️ CVE-2023-36844 And Friends: RCE In Juniper Devices
✍️ Finding Reflected XSS In A Strange Way
✍️ Copy Drag — Paste Drop
✍️ Exploiting Hardcoded Keys to achieve RCE in Yellowfin BI
✍️ Manipulating Encrypted Traffic for Manual and Automation
✍️ Reposted [2017]: LinkedIn Hacker’s Experience
✍️ Leaked SQL Error Leading To XSS And Another BSQLi
✍️ Misconfigured $3 Bucket - A Semi Opened Environment
✍️ The “P5” Link Injection Story
✍️ [web3] Misc. bug in - found by Kiki
✍️ Journeys in Quoteless and Multi Reflection XSS
✍️ Subdomain Takeover in Azure: making a PoC
✍️ From One Vulnerability to Another: Outlook Patch Analysis Reveals Important Flaw in Windows API
✍️ Asus Cross Site Scrpting And Directory Listing Vulnerability
✍️ Privilege Escalation via Account Takeover on NodeBB Forum Software — Bug Bounty (512$)
✍️ IDOR leads to account takeover
✍️ Google Security Misconfiguration Leads to Account Takeover !
✍️ [web3] Critical bug in Ocean Protocol found by merkle_bonsai
✍️ How a simple IDOR become a $4K User Impersonation vulnerability
✍️ How I earned 500$ by uploading a file: write-up of one of my first bug bounty
✍️ From PostAuth RCE to PreAuth RCE on Liferay Portal
✍️ How Recon helped me to to find a Facebook domain takeover
✍️ Never Connect to RDP Servers Over Untrusted Networks
✍️ How I leveraged an interesting CSRF vulnerability to turn self XSS into a persistent attack?
✍️ Sorting Your Way to Stolen Passwords
✍️ One Way to Find Hidden IDOR Vulnerability
✍️ Story of a Information Disclosure and an Account Takeover | by Karthi
✍️ Comma is forbidden! No worries!! Inject in insert/update queries without it
✍️ A misconfigured Apache Airflow to AWS Account Compromise
✍️ Re-moo-te Code Execution in Mailcow: Always Sanitize Error Messages
✍️ Roles allowing to abuse Entra ID federation for persistence and privilege escalation
✍️ Symfony Debug Mode + Another Vector for AWS keys
✍️ Token Brute-Force to Account Take-over to Privilege Escalation to Organization Take-Over
✍️ SysmonEoP
✍️ Posting on groups as people whenever their email was known by an attacker
✍️ User’s location diclosure in the “Nearby Friends” feature. $15,500 Bounty
✍️ Yeah! I got P2 in 1 minute - Stored XSS via Markdown Editor
✍️ Prezi (map.prezi.com) Path Traversal
✍️ XXE at Bol.com
✍️ Step-by-Step Walkthrough of CVE-2022-32792 - WebKit B3ReduceStrength Out-of-Bounds Write
✍️ Privilege Escalation in Microsoft Windows
✍️ Stealing a few more GitHub Actions secrets
✍️ Information Disclosure Vulnerability in Adobe Experience Manager affecting multiple companies including Microsoft, Apple, Amazon, McDonald’s and many more.
✍️ Unauthenticated SSRF on Havoc C2 teamserver via spoofed demon agent
✍️ The Database Handover | A Dumb Mistake | Critical BUG
✍️ [VDP] How a lazy bug bounty hunter got a place on NASA HOF, an XSS story | by TRFFNSEC
✍️ No Database No Table, how do you do MSSQL Injection?
✍️ Disclose any main and 3rd party contributors email address and movie local path thru XML file in Plex TV - plex.tv (Write Up)
✍️ RCE due to Dependency Confusion — $5000 bounty!
✍️ Account Take Over Vulnerability in Google acquisition [Famebit]
✍️ Account Take Over by Response Manipulation
✍️ Multiple Vulnerabilities in Proxmox VE & Proxmox Mail Gateway
✍️ How I got 22000$ worth ethereum
✍️ Redwood Report2Web XSS and Frame injection
✍️ SSRF vulnerability in AppSheet - Google VRP
✍️ XSS via X-Forwarded-Host header
✍️ Upgrade from LFI to RCE via PHP Sessions
✍️ My First Bug: How I Was Able to Bypass the WAF and Uncover a Reflected XSS
✍️ [3/3] Cache Poisoning & Lateral Movement @ GitLab
✍️ Account Takeover via Custom OTP, No User Interaction Required!
✍️ Super FabriXss: From XSS to an RCE in Azure Service Fabric Explorer by Abusing an Event Tab Cluster Toggle (CVE-2023-23383)
✍️ NTLM Credential Theft in Python Windows Applications
✍️ [web3] DFX Finance Rounding Error Bugfix Review. This is a postmortem of a vulnerability… | by Immunefi | Sep, 2022 | Medium
✍️ Exploiting an unknown vulnerability
✍️ Create hidden comment by blocking an Admin: Facebook Bug Bounty 2020
✍️ X Forwarded for SQL injection
✍️ Inf0rM@tion Disclosure via IDOR
✍️ SVG files and Java code execution
✍️ Getting a RCE — CTF Way
✍️ “Like” Bypass on Customer Reviews — €500 bounty
✍️ Hardcore RCE via directory name for $3.000
✍️ Stealing HttpOnly Cookie via XSS
✍️ Azure HDInsight Riddled With XSS Vulnerabilities via Apache Services
✍️ Pwning eBay - How I Dumped eBay Japan’s Website Source Code
✍️ We were vulnerable - how a security company could have vulns
✍️ Zip Slip meets Artifactory: A Bug Bounty Story
✍️ P1 Vulnerability in 60 seconds
✍️ Breaking SIP With Apple-signed Packages
✍️ How I CSRF’d My First Bounty!
✍️ SQL Injection for Noobs | by Hacking articles
✍️ XSS in Edmodo within 5 Minute (My First Bug Bounty)
✍️ How to narrow recon giving me $$$$ Bounty
✍️ Facebook Vulnerability: Hiding from the view of Business Admin in the Business Manager
✍️ Reflected XSS via AngularJS Template Injection
✍️ Metadata service MITM allows root privilege escalation (EKS / GKE)
✍️ Escaping Adobe Sandbox: Exploiting an Integer Overflow in Microsoft Windows Crypto Provider
✍️ How I Managed to Create Unauthorized Comments on Facebook Live Stream
✍️ Modify users profiles of techprep.fb.com
✍️ How I was able to take over accounts in websites deal with Github as an SSO provider
✍️ GKE Autopilot Node Compromise via startup-script
✍️ Deep Dive into Open Source Bug Bounty
✍️ Identity-Aware Proxy Misconfiguration- Google Cloud Vulnerability
✍️ Android Browser Same Origin Policy Bypass < 4.4 - CVE-2014-6041
✍️ 0day writeup: XXE in uber.com
✍️ Love Story Of A Account Takeover (Chaining Host Header Injection To Takeover Someones Account)
✍️ The Unknown Hero-App Logic Bugs
✍️ Disclose Instagram Personal Private Archived posts when switching to Professional account through creative hub
✍️ Google Bug: Posting on groups as any user’s behalf
✍️ Facebook Account Recovery Form (CONFLICTING)
✍️ Remote Code Execution on Western Digital PR4100 NAS (CVE-2022-23121)
✍️ XSS in Yahoo Subdomain
✍️ Oracle WebLogic - Multiple SAML Vulnerabilities (CVE-2018-2998/CVE-2018-2933)
✍️ Lethal Injection: How We Hacked Microsoft's Healthcare Chat Bot
✍️ How Misconfigured API leaked user private information?
✍️ Finding vulnerabilities in curl 7.83.0 without reading a single-line of C code
✍️ How a YouTube Video lead to pwning a web application via SQL Injection worth $4324 bounty
✍️ How I bypassed 2fa in a 3 years old private program!
✍️ Reflected XSS on Error Page
✍️ From empty page to POST based JSON XSS
✍️ Cache Deception Without Path Confusion
✍️ Stealing your data using XSS
✍️ [web3] Discovering and Fixing a Critical Vulnerability in Polygon zkEVM
✍️ How I Scored 2K Bounty via an IDOR
✍️ Link Injection Manipulation at admin.google.com
✍️ How I found my way into Instagram’s Ganglia, and a bug with Facebook likes.
✍️ The story of a [P5] that lead me to a [P3] find
✍️ Automating reflected XSS with burp-suite Intruder
✍️ Finding and reporting a Gatekeeper bypass exploit with help from Mac Monitor
✍️ The massive bug at the heart of the npm ecosystem
✍️ P1 Bug — PII information disclosure
✍️ CORS bug on GOOGLE’s 404 page REWARDED!!!
✍️ CVE-2022-40361 Writeup
✍️ “How Companies Need to Widen There Scopes”
✍️ How I snooped into your private Slack messages [Slack Bug bounty worth $2,500]
✍️ Uploading files to api.techprep.fb.com
✍️ Pentest-Story: Empirum password decryption
✍️ Account Takeover with rate limit bypass
✍️ IBM HMC Exploit CVE-2021-29707
✍️ draw.io CVEs
✍️ Cengage LTI Session Management Leakage
✍️ P1: Critical - Discovering and Foiling a Threat Actor
✍️ XSS on a Jira Subdomain | by lnxcs
✍️ How I hacked Altervista.org
✍️ Full account takeover worth $1000 Think out of the box
✍️ Full Account Takeover via Changing Email And Password of any User through API Parameters
✍️ (ZOHO) Manage Engine Desktop Central – SQL Injection / Arbitrary File Write
✍️ How I able to Takeover 10 subdomains in a Private Program ?
✍️ Disclosure of Pending Roles for any Facebook Page
✍️ Sending Message as page being an analyst/ advertiser?
✍️ A Simple SQL Injection in an Air Force Website
✍️ SVG SSRFs and saga of bypasses
✍️ A Simple bypass of Registration Activation that Lead to many Bug -
✍️ IDOR revealing Images cdn links | by Susan wagle
✍️ How I was able to bypass the current password?
✍️ My experience of Hacking The Dutch Government
✍️ How I found read/write access to the personal data of 3 million users of an E-commerce website?
✍️ Hacking Smartwatches for Spear Phishing
✍️ [Yahoo Bug Bounty] Unauthorized Access to Unisphere Management Server Debugging Facility on https://bf1-uaddbcx-002.data.bf1.yahoo.com/Debug/
✍️ Recursive Amplification Attacks: Botnet-as-a-Service
✍️ Git Arbitrary Configuration Injection (CVE-2023-29007)
✍️ Binarly Finds Six High Severity Firmware Vulnerabilities In HP Enterprise Devices
✍️ Windows 10 RCE: The exploit is in the link
✍️ Pre-Auth SSRF To Full MailBox Access (Microsoft Exchange Server Exploit)
✍️ ADCS ESC13 Abuse Technique
✍️ Technical Advisory – Apple macOS XAR – Arbitrary File Write (CVE-2022-22582)
✍️ Technical Advisory – Multiple Vulnerabilities in Nagios XI
✍️ 1-800-Flowers Credentials and message log leak via facebook.com/facebook
✍️ Parallels Desktop Toolgate Vulnerability
✍️ Advanced CSRF Exploitation
✍️ [No Bounty] [Nespresso] A story of how I almost got free coffee for life
✍️ One Misconfig (JIRA) to Leak Them All- Including NASA and Hundreds of Fortune 500 Companies!
✍️ How I get an easy Blind SSRF by just reading writeups
✍️ Advisory | NetModule Router Software Race Condition Leads to Remote Code Execution
✍️ Wordpress Plugin Update Confusion - The full guide how to scan and mitigate the next big Supply Chain Attack
✍️ PoC video
✍️ A tale of a full Business Takeover — Red Team Diaries
✍️ Cannot Delete Post on Facebook Group: Facebook Bug Bounty
✍️ Unauthorized Disclosure of Video Thumbnails in Facebook Workplace
✍️ pcextreme.nl fake bug bounty
✍️ Chain The Bugs to Pwn an Organisation ( LFI + Unrestricted File Upload = Remote Code Execution )
✍️ Diving Into Pre-created Computer Accounts
✍️ Bug Writeup: FBCTF IDOR
✍️ IDOR - Inside the Session Storage
✍️ Android Reddit App leaks images
✍️ Writing my Medium blog to complete account takeover
✍️ Improper Access Control — My Third Finding on Hackerone!
✍️ LDAP anonymous login story of my 3 simple P3 findings
✍️ A business Logic issue worth $1500
✍️ “Please do not make it public” - Vulnerabilities in Sogou Keyboard encryption expose keypresses to network eavesdropping
✍️ How an Akamai misconfiguration earned us USD 46.000
✍️ Ghost Sites: Stealing Data From Deactivated Salesforce Communities
✍️ How I XSS’ed Uber and Bypassed CSP
✍️ CVE-2024-2448: Authenticated Command Injection In Progress Kemp LoadMaster
✍️ XSLeaking with my best bud SOP
✍️ 900$ XSS in yahoo ( Recon Wins )
✍️ Directory Traversal, SQL Injection and Server-Side Request Forgery
✍️ Abusing MySQL clients to get LFI from the server/client
✍️ Little bug, Big impact. 25k bounty
✍️ PHP deserialization attacks and a new gadget chain in Laravel
✍️ The Case of the Missing Cache Keys
✍️ Cookie Based Self-XSS to Good XSS
✍️ Razer mobile PIN verification bypass $1k Bug
✍️ Multiple vulnerabilities in Oracle EBS
✍️ [web3] Aurora Infinite Spend Bugfix Review ($6m Payout). This is a postmortem of a vulnerability… | by Immunefi | Apr, 2022 | Medium
✍️ Back to the 90s: Fujitsu “IP series” Real-time Video Transmission Gear Hard Coded Credentials
✍️ Account Takeover via Access Token Leakage
✍️ Unique Rate limit bypass worth 1800$
✍️ Misconfigured s3 bucket leads to Sensitive Data exposure(No super controls )
✍️ Exploiting Cache Poisoning via Unkeyed Parameters and Headers in a Drupal Application
✍️ Potential Remote Code Execution Vulnerability Discovered In HSQLDB
✍️ How i was able to chain bugs and gain access to internal okta instance
✍️ Security Implications of URL Parsing Differentials
✍️ Account Takeover via OTP Bruteforce (Apigee API)
✍️ CVE-2023-24941: Microsoft Network File System Remote Code Execution
✍️ Decoding a $😱,000.00 htpasswd bounty
✍️ Discovering 5 XSS Vulnerabilities In a Simple Way With Xssor.go
✍️ How we abused Slack's TURN servers to gain access to internal services
✍️ How I downed acronis.com in 2 minutes — Lucky bug write up
✍️ How I made $2000 with URL REDIRECTION?
✍️ My Account Takeover Writeup: $5000
✍️ How I hacked 74k users of a website.
✍️ Bad.Build: A Critical Privilege Escalation Design Flaw in Google Cloud Build Enables a Supply Chain Attack
✍️ From Finding AWS S3 Bucket to Sensitive Data Exposure
✍️ $10,000 for automatic email confirmation bug in Microsoft's Edge browser
✍️ How I dumped PII information of customers in an ecommerce site?
✍️ A tale of zero click account takeover
✍️ How I can take over any user’s account with their mobile number
✍️ Google bug bounty for security exploit that influences search results
✍️ Un3xpected DoS Attack on Profile Pictur3
✍️ DOM Cross-Site Scripting Via postMessage in AnnounceKit
✍️ Why ORMs and Prepared Statements Can't (Always) Win
✍️ From MQTT Fundamentals to CVE
✍️ [socket.io] Cross-Site Websockets Hijacking
✍️ How I accessed the Sensitive document which I had already deleted
✍️ New Attack Paths? AS Requested Service Tickets
✍️ I Love Lucee: Building Lucee Extensions for Remote Code Execution
✍️ Zero-Day: Hijacking iCloud Credentials with Apple Airtags (Stored XSS)
✍️ Escalating from Logic App Contributor to Root Owner in Azure
✍️ Bruteforcing Instagram account’s passwords without limit.
✍️ [web3] Critical bug in Polygon found by Ashiq Amien
✍️ Hiding from a custom list is possible on who sees our post is possible making victim not remove them from the list.
✍️ URL Redirection To DOM XSS on Hackerone Programs — Bug Bounty Tuesday
✍️ Subdomain Takeover Through Expired Cloudfront Distribution | live.lamborghini.co
✍️ 3 Minutes & XSS!
✍️ Perform substring search for emails even if Workplace admin hides email profile field.
✍️ FortiNAC - Just a few more RCEs
✍️ Admin capabilities around your ears
✍️ How I got a trip to amsterdam through bug bounty
✍️ R-XSS -> CSRF bypass to account takeover/
✍️ Here’s how I could’ve ridden for free with Uber
✍️ Unlocking the Weak Spot: Exploiting Insecure Password Reset Tokens
✍️ Spoofing SaaS Vanity URLs for Social Engineering Attacks
✍️ Making the Facebook app more secure - $8500 bounty
✍️ [web3] High bug in Wormhole found by Marco Nunes worth 50k
✍️ From Wayback Machine To Account Takeover
✍️ #BugBounty — Adding Money Using Response Modification
✍️ Account Takeover in $Million Company?
✍️ Crowdsource Success Story: From an Out-of-Scope Open Redirect to CVE-2020-1323
✍️ Hey Google ! - Delete my Data Properly — #GoogleVRP
✍️ Writeup for CVE-2023-39143: PaperCut WebDAV Vulnerability
✍️ Security and Privacy of Social Logins (II): PostMessage Security in Single Sign-On
✍️ Bypassing 2FA using OpenID Misconfiguration
✍️ How I was able to Bypass Philips Authentication
✍️ Write-up: BlogEngine .NET - 0day Discovery
✍️ Taking over Uber accounts through voicemail
✍️ Persistent Distorted Posts Issue and Unremovable Content in Facebook Group
✍️ The first step to PWN2OWN - A sad one
✍️ Handlebars template injection and RCE in a Shopify app
✍️ DOS & Stored HTML Injection Bug Bounty Writeup
✍️ Subdomain Takeover worth 200$
✍️ Automating xss identification with Dalfox & Paramspider
✍️ Official Telegram Web Client ClickJacking Vulnerability – When crypto is strong and client is weak
✍️ Hacking Chess.com: My Journey to Unlock Premium Bots on the Android App
✍️ How Redirects work on Facebook? Technical breakdown
✍️ PII data exfiltration within minutes
✍️ Hacking AI: System and Cloud Takeover via MLflow Exploit
✍️ Vocera Report Server Pwnage
✍️ Broken links hijacking and CDN takeover
✍️ How I discovered a 1000$ open redirect in Facebook
✍️ Nick’s infrequently updated blog
✍️ Alternative link
✍️ [web3] Optimism Censorship Bug Disclosure
✍️ RCE In Adobe Acrobat Reader For Android(CVE-2021-40724)
✍️ Calling Home, Get Your Callbacks Through RBI
✍️ Hacking a Smart Home Device
✍️ CSRF account takeover in a company worth 1B$
✍️ Password Not Provided - Compromising Any Flurry User’s Account [Yahoo Bug Bounty]
✍️ Laravel debug mode left on at Zouikwatzeggen.nl leaks admin credentials & potentially submitted reports of improper behaviour at Amsterdam University Medical Centers
✍️ Unremovable Tags In Facebook Page Reviews
✍️ Account Take Over Due to AWS Cognito Misconfiguration | by Deshine
✍️ CRLF Injection — xxx$ — How was it possible for me to earn a bounty with the Cloudflare WAF?
✍️ API DOCS takeover on Readme.io
✍️ My First LFI
✍️ Guest Blog Post: Leaking silhouettes of cross-origin images
✍️ Elevation of privileges from Everyone through Avast Sandbox to System AmPPL (CVE-2021-45335, CVE-2021-45336 and CVE-2021-45337)
✍️ Open URL redirects to grab FB OAuth Tokens
✍️ Chaining Tricky OAuth Exploitation To Stored XSS
✍️ You Are Not Where You Think You Are, Opera Browsers Address Bar Spoofing Vulnerabilities
✍️ Bypassing WAF for $2222
✍️ I figured out a way to hack any of Facebook’s 2 billion accounts, and they paid me a $15,000 bounty for it
✍️ [web3] Critical bug in Balancer V2 found by kankodu worth 250k
✍️ Takeover seller accounts worth billions & millions
✍️ A Twist in the Code: OpenMeetings Vulnerabilities through Unexpected Application State
✍️ Apache SCXML Remote Code Execution
✍️ Discord embed spoofing
✍️ White Hats - Nepal
✍️ Rxss inside href attribute - Bypassing lots of weird checks to takeover accounts!
✍️ Stealing passwords from infosec Mastodon - without bypassing CSP
✍️ Zoom Session Takeover - Cookie Tossing Payloads, OAuth Dirty Dancing, Browser Permissions Hijacking, and WAF abuse
✍️ Microsoft SharePoint's 'Follow' Feature XSS (CVE-2017–8514) -Adesh Kolte
✍️ Universal RCE with Ruby YAML.load
✍️ CVE-2022-36413 Unauthorized Reset Password of Zoho ManageEngine ADSelfService Plus
✍️ Hacking AWS Cognito Misconfiguration to Zero Click Account Takeover
✍️ npm search RCE? - Escape Sequence Injection
✍️ BLIND SSRF in *.stripe.com due to Sentry Misconfiguration
✍️ The $1,000 worth cookie
✍️ Escalating Privileges like a Pro
✍️ Breaking Appointments and Job Interview Schedules With Malformed Times
✍️ Facebook Vulnerability: Unremovable facebook group admin
✍️ Nokia email app pwnage
✍️ Exploiting S3 bucket with path folder to Access PII info of A BANK
✍️ Exfiltrating Data from Sandboxed Documents
✍️ #BugBounty — How I was able to read chat of users in an Online travel portal
✍️ Shells And SOAP: Websphere Deserialization To RCE
✍️ CVE-2023-2825 Analysis And Exploit
✍️ 2fa Bypass by changing Request method
✍️ Ability to login as google staff in Google Cloud Community
✍️ OTP Bypass - Developer’s Check
✍️ Outdated PHP Version leads to RCE
✍️ How I was able to delete Google Gallery Data [IDOR]
✍️ Exploits Explained: Default Credentials Still a Problem Today
✍️ Bypassing Account Suspension Using Anonymous Posting | Facebook Bug Bounty
✍️ Group expert's pending expertise request leaking on Facebook
✍️ Story about Facebook Oauth Account Takeover
✍️ Playing With iframes: Bypassing Content-Security-Policy
✍️ High severity vulnerability fixed in WordPress Elementor Pro plugin.
✍️ can I speak to your manager? hacking root EPP servers to take control of zones
✍️ Ability to find Facebook employee’s test accounts which lead to the disclosure of internal information.
✍️ Code execution as root via AT commands on the Quectel EG25-G modem
✍️ Multiple Vulnerabilities In Extreme Networks ExtremeXOS
✍️ Vulnerability in Hangouts Chat: from open redirect to code execution
✍️ HTTP Request Smuggling on business.apple.com and Others.
✍️ Bypass TCC via iCloud
✍️ This is how I managed to win $2000 through Facebook Bug Bounty
✍️ Privilege Escalation in Google Cloud Platform’s OS Login
✍️ Discovering Deserialization Gadget Chains in Rubyland
✍️ Turning Google smart speakers into wiretaps for $100k
✍️ Subscribe to the list of requesters to join a Facebook live video using MQTT
✍️ All About Hackerone Private Program Terapeak
✍️ Facebook Vulnerability: Unremovable Co-Host in facebook group events
✍️ 403 Forbidden Bypass Leading to Admin Endpoint Access.
✍️ [CVE-2022-1786] A Journey To The Dawn
✍️ Self-XSS to Stored XSS
✍️ Content-Security-Policy Bypass to perform XSS using MIME sniffing
✍️ How I compromised 1500 accounts/month with no technical skill
✍️ Uncovering a ChromeOS remote memory corruption vulnerability
✍️ One Click To Account Takeover
✍️ CVE-2021-22929 – Brave Browser 1.27 and below permanently logs the server connection time for all v2 tor domains to ~/.config/BraveSoftware /Brave-Browser/tor/data/tor.log
✍️ View Other User Private Livestream Data
✍️ Sign up for Brand Collabs Manager on behalf of other page admins – Privilege Escalation
✍️ IDOR leads to Data leakage and Profile Update
✍️ Vulnerability in Linux containers – investigation and mitigation
✍️ Admin disclosure of Facebook verified pages/ Disclose Facebook employee assigned to help a verified page.
✍️ How I hacked one of the biggest airlines group of the world
✍️ Stealing your Paytm information using XSS
✍️ Miracle - One Vulnerability To Rule Them All
✍️ CSRF in partners.facebook.com
✍️ Remote Denial-of-Service with Chrome
✍️ PoC: The easiest 125 Euro’s I Ever made
✍️ Exploit Archeology - Exploiting an old unknown Server Side Browser
✍️ Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws
✍️ Facebook exploit – Confirm website visitor identities
✍️ $$$ bounty in less 3 minutes from a google dork
✍️ Breaking Application’s Logic to DOS Attack
✍️ Automating Unsolicited Richard Pics; Pwning 60,000 Digital Picture Frames
✍️ Exploit Development – A Sincere Form of Flattery
✍️ Microsoft Copilot: From Prompt Injection to Exfiltration of Personal Information
✍️ High Signal Detection and Exploitation of Ivanti's Pulse Connect Secure Auth Bypass & RCE (CVE-2023-46805 & CVE-2024-21887)
✍️ Tale of XSS in Angular
✍️ Self XSS + Login CSRF + OAuth = Account Takeover
✍️ Catching bugs in VMware: Carbon Black Cloud Workload Appliance and vRealize Operations Manager
✍️ [ GCP 2022 ] Few bugs in the google cloud shell
✍️ DOM-Based XSS | Bug Bounty Writeup
✍️ Zoom RCE from Pwn2Own 2021
✍️ IDOR (at Private Bug Bounty Program) that could Leads to Personal Data Leaks
✍️ Forced Browsing to Access Admin Panel
✍️ [web3] Critical bug in dHEDGE found by Quantish worth 500
✍️ (POC) Untrim any live video on Facebook
✍️ ModSecurity DoS Vulnerability in JSON Parsing (CVE-2021-42717)
✍️ CVE-2024-21378 — Remote Code Execution in Microsoft Outlook
✍️ Frappé Technologies ERPNext Server Side Template Injection
✍️ Reflected XSS + Possible Server Side Template Injection in HubSpot CMS ( All Websites Uses HubSpot was affected )
✍️ How Misconfigured and Vulnerable Devices Could Expose Your Company to Physical and Cyber Threats
✍️ Look at what i found in Comodo
✍️ This Man Thought Opening A TXT File Is Fine, He Thought Wrong. MacOS CVE-2019-8761
✍️ Lamborghini
✍️ How I got access to many PIIs through a source code leak
✍️ XSS attacks on Googlebot allow search index manipulation
✍️ Story Behind Sweet SSRF.
✍️ A Curious Case From Little To Complete Email Verification Bypass
✍️ A Case Study of API Vulnerabilities
✍️ Simple Remote Code Execution Vulnerability Examples for Beginners
✍️ XSS in hidden input fields
✍️ Cache-Key Normalization - What could go wrong?
✍️ 10 golden minutes for taking over a Chess.com account
✍️ [web3] Raydium Tick Manipulation Bugfix Review. This is a postmortem of a vulnerability… | by Immunefi | Jun, 2024 | Medium
✍️ From NTAuthCertificates to “Silver” Certificate
✍️ VSCode Remote Code Execution advisory
✍️ PHP Supply Chain Attack on Composer
✍️ Daniel Maksimovic
✍️ Identity Confusion in WebView-based Mobile App-in-app Ecosystems
✍️ The 100+ Million Person Data Disclosure
✍️ [web3] $10k Bug Bounty on DFX Finance
✍️ Senstive Information Leak Lead To join any Organisation
✍️ Understanding GitLab EE/CE Account TakeOver (CVE-2023-7028)
✍️ LPE via StorSvc
✍️ XSS Is Love <3 !
✍️ XSS in GMail’s AMP4Email via DOM Clobbering
✍️ SSRFing the Web with the help of Copilot Studio
✍️ Symantec Messaging Gateway authentication bypass
✍️ Unsubscribe any user’s e-mail notifications via IDOR
✍️ Export Facebook audience network reports of any business
✍️ PII at Your Fingertips: How I Stumbled Upon an Easy-to-Find Data Leakage Vulnerability @ Swisscom
✍️ Hack crypto secrets from heap memory to exploit Android application
✍️ Armaan Patha
✍️ CVE-2019-17004—Semi Universal XSS affecting Firefox for iOS
✍️ Blind SQL Injection at fasteditor.hema.com
✍️ Universal XSS in Android WebView (CVE-2020-6506)
✍️ Discovering Zero-Day Vulnerabilities in McAfee Products
✍️ Parameter pollution bug at twitter
✍️ Bypassing the AWS WAF protection with an 8KB bullet
✍️ SSRF on PDF generator.
✍️ PII Disclosure of Apple Users ($10k)
✍️ 4,500 of the Top 1 Million Websites Leaked Source Code, Secrets
✍️ Unraveling The Story of Multiple Admin Panel Compromises
✍️ How I earned $800 for Host Header Injection Vulnerability
✍️ Elasticsearch A Easy Win For Bug Bounty Hunters || How To Find and Report
✍️ Authentication bypass on Ubiquity’s Single Sign-On via subdomain takeover
✍️ Unauthenticated Cache Purge
✍️ Galactical Bug Hunting: How we discovered new issues in CD Projekt Red’s Gaming Platform
✍️ Open-redirect [in email]
✍️ Trick to bypass rate limit of password reset functionality
✍️ Reporting - Amazon 1 click device XSS
✍️ Exploits Explained: 5 Unusual Authentication Bypass Techniques
✍️ Open Redirection into Bentley System
✍️ My First Critical Bug In HackerOne Platform
✍️ Yahoo phpinfo.php disclosure
✍️ ModSecurity: Path Confusion and really easy bypass on v2 and v3
✍️ [Hacking Bank] The Second Story of Finding Critical Vulnerabilities on Banking Application
✍️ Hacking TMNF: Part 1 - Fuzzing the game server
✍️ suPHP - The vulnerable ghost in your shell🎯Business Logic Flaw in Google Acquisition! (Hall Of Fame)🎯
✍️ CVE-2022-21449: Psychic Signatures in Java
✍️ $3133.70 Google Dialogflow IDOR Vulnerability
✍️ Google Chrome display locking fuzzing
✍️ Paypal stored XSS + Security bypass
✍️ The Art of IDOR: 7 IDORs in Edm0d0
✍️ Dynamic Linq Injection Remote Code Execution Vulnerability (CVE-2023-32571)
✍️ Hyperlink Injection - Easy Money (sometimes)
✍️ How I could have been the administrator for all Dutch companies and create invoices. And still can be…
✍️ The Not So Pleasant Password Manager
✍️ [web3] Report: Scroll Mainnet Emergency Upgrade on 2025-04-25 - General - Scroll
✍️ Multiple Kernel Vulnerabilities Affecting All Qualcomm Devices
✍️ Bypassing Instagram’s stories restriction
✍️ How I was able to modify and delete any user’s data file (filestack API)
✍️ Lab by @datadoghq
✍️ Operation Crack: Hacking IDA Pro Installer PRNG from an Unusual Way
✍️ Reflected XSS on Stack Overflow
✍️ How I earned $500 from Google - Flaw in Authentication
✍️ How I got paid premium plan for free on many popular websites
✍️ From XSS to RCE (dompdf 0day)
✍️ Practical Exploitation of Error Based Sql Injection
✍️ How i got 7000$ in Bug-Bounty for my Critical Finding.
✍️ How I was able to buy t-shirt for €1 — Payment Price Manipulation
✍️ Phone number validation bypass through url path manipulation .
✍️ Never Give Up, The Story Behind a Dupe-To-Triaged
✍️ QNAP Poisoned XML Command Injection (Silently Patched)
✍️ Weaponizing Middleboxes for TCP Reflected Amplification
✍️ Second Order XXE Exploitation
✍️ Let’s steal some tokens!
✍️ CVE-2022-22655 - TCC - Location Services Bypass
✍️ XSS in the AWS Console
✍️ Proxytoken: An Authentication Bypass In Microsoft Exchange Server
✍️ XSS via Angular Template Injection
✍️ Critical information disclosure on Wappalyzer.com
✍️ Inspect Element leads to Stripe Account Lockout Authentication Bypass
✍️ #BugBounty — How I was able to delete anyone’s account in an Online Car Rental Company
✍️ CVE-2021-22555: Turning \x00\x00 into 10000$
✍️ [RCE] Remote code execution at api.PrivateProgram.com (CVE-2017-5638)
✍️ IBM Datapower Exploit CVE-2020-5014
✍️ The AccountTakeOver Killing Chain
✍️ Multiple vulnerabilities in UCOPIA <= 6.0.7 (CVE-2022-44719 / CVE-2022-44720)
✍️ Subdomain Takeover via Leadpages Services on Tiktok
✍️ FakesApp: A Vulnerability in WhatsApp
✍️ Exploiting a difficult Out-Of-Band XXE via FTP connections.
✍️ Account Takeover Using Re-Register [ Bug Bounty ]
✍️ One Payload to XSS Them All!
✍️ How to bypass a 2FA with a HTTP header
✍️ HTTP Desync Attack (Request Smuggling) - Mass Account Takeover at a Cryptocurrency based asset and 121 other websites
✍️ Centreon map vulnerability
✍️ Unauthorized Sign-up on Subdomain of Subdomain leading to Organization takeover worth $2000
✍️ A Simple IDOR to Account Takeover
✍️ How I was able to see Private Video Uploader Via Facebook Rights Manager.[Responsible Disclosure]
✍️ The trouble with Microsoft’s Troubleshooters
✍️ [web3] Critical bug in Interlay found by pwning.eth worth 200k
✍️ Account takeover by OTP bypass
✍️ [Responsible disclosure] How I could have booked movie tickets through other user accounts
✍️ Injecting Java In-memory Payloads For Post-exploitation
✍️ Hook, Line, and Phishlet: Conquering AD FS with Evilginx
✍️ $1800 in less than an hour.
✍️ Transforming a Domain into the Matrix (an open redirect story)
✍️ SSD Advisory – Zyxel VPN Series Pre-auth Remote Command Execution
✍️ Long Live the Pwn Request: Hacking Microsoft GitHub Repositories and More
✍️ Spokeo Bug bounty Experience
✍️ The Invincible Kid
✍️ Zero Click account Takeover
✍️ Re-dressing Instagram – Leaking Application Tokens via Instagram ClickJacking Vulnerability!
✍️ Two Factor Authentication Bypass [ $50 ]
✍️ Unauthenticated RSFTP to Command Injection
✍️ Instagram App Access Token
✍️ Stored XSS in Google Nest
✍️ Exploiting Authentication in AWS IAM Authenticator for Kubernetes
✍️ Blog: OmniSpace, from automated 0day XSS to RCE
✍️ ClamAV Critical Patch Review
✍️ A short tale of Account verification bypass
✍️ [web3] Medium bug in Ocean found by Shanmuga Bharathi. N worth 5k
✍️ Defeat the HttpOnly flag to achieve Account Takeover | RXSS
✍️ Tesla paid me $10,000 because of Directory Indexing
✍️ Story of Blind SQL with a typo error.
✍️ Request Smuggling In Major Crypto Site — road to disappointment
✍️ HTTP Request Smuggling CL.TE
✍️ SSRF leads to access AWS metadata.
✍️ Skype extension: All functionality broken? Still exploitable!
✍️ The Story of My First Reflected XSS
✍️ Self XSS to Good XSS Clickjacking
✍️ DOM Based XSS in Private Program
✍️ Account takeover through password reset
✍️ The journey from Google Honorable Mention to Hall of Fame.
✍️ Google Docs 'ClickJacking' (Information Disclosure)
✍️ Broken Access Control & Stored XSS - Easy Hunt
✍️ When Cookie Hijacking + HTML Injection become dangerous
✍️ A Story of mishandling the Chunked Data (CVE-2018-17082)
✍️ [demo.paypal.com] Node.js code injection (RCE)
✍️ Came looking for SSRF and found XSS
✍️ Unzipping Dangers: OpenRefine Zip Slip Vulnerability
✍️ This is how I was able to view anyone’s private email and birthday on Instagram
✍️ $2,373
✍️ XSS on Google{5.000$}-Google Vulnerability Reward Program (VRP)
✍️ AWS S3 bucket misconfiguration - Paytm
✍️ CRLF injection in blockchain.info
✍️ Authentication Bypass Vulnerability in Mura CMS and Masa CMS (CVE-2022-47003 and CVE-2022-47002)
✍️ #BugBounty — Exploiting CRLF Injection can lands into a nice bounty
✍️ A Pain in the NAS: Exploiting Cloud Connectivity to PWN your NAS: Synology DS920+ Edition
✍️ Leaking All Users Google Drive Files
✍️ A weird XSS
✍️ Owncloud: details about CVE-2023-49103 and CVE-2023-49105
✍️ How I was able Find mass leaked AWS s3 bucket from js File
✍️ Chaining Improper Authorization To Race Condition To Harvest Credit Card Details : A Bug Bounty Story
✍️ I received a Bank offer in my mailbox and discovered an IDOR vulnerability - $5,000 bounty - @bxmbn
✍️ CVE-2022-37734: graphql-java Denial-of-Service
✍️ SonicWall Discovers Critical Apache OFBiz Zero-day -AuthBiz
✍️ Leaking ObjRefs to Exploit HTTP .NET Remoting
✍️ Broken session management leads to bypass 2FA and Permanent access to Facebook user’s
✍️ SSD Advisory – Exchange Server GetWacInfo Information Disclosure Vulnerability
✍️ Proofpoint Discovers Potentially Dangerous Microsoft Office 365 Functionality that can Ransom Files Stored on SharePoint and OneDrive
✍️ Bypassing .NET Serialization Binders
✍️ AWS Fixes Data Exfiltration Attack Angle in Amazon Q for Business
✍️ 17 vulnerabilities in Sharp Multi-Function Printers
✍️ Exploiting embedded mitel phones for unauthenticated remote code execution
✍️ Open Sesame: Escalating Open Redirect to RCE with Electron Code Review
✍️ How i got $15000 Reward by Apple - Information Disclosure
✍️ XS-Searching Google’s bug tracker to find out vulnerable source code
✍️ LFI in Apigee portals
✍️ HubSpot Full Account Takeover in Bug Bounty
✍️ One company: 262 bugs, 100% acceptance, 2.57 priority, millions of user details saved.
✍️ Param Hunting to Injections
✍️ Spoofing 802.11 Wireless Beacon Management Frames with Manipulated Power Values Resulting in Denial of Service for Wireless Clients
✍️ Trying to hack Redis via HTTP requests
✍️ Bypassing Character Limit - XSS Using Spanned Payload
✍️ Account verification code bypass lead to a $4000 bounty
✍️ Send()-ing Myself Belated Christmas Gifts - GitHub.com's Environment Variables & GHES Shell
✍️ Insufficient Redirect URI validation: The risk of allowing to dynamically add arbitrary query parameters and fragments to the redirect_uri
✍️ A Developer’s Nightmare: Story of a simple IDOR and some poor fixes worth $1125
✍️ GL.iNET GL-MT300N-V2 Router Vulnerabilities and Hardware Teardown
✍️ How I was able to bypass WAF and find the origin IP and a few sensitive files
✍️ How i hacked BBC mail servers
✍️ Breaking Business Logic - Part: 2^7 = 1
✍️ Facebook leak referrer data
✍️ Missing Authorization check in Facebook Pages Manager
✍️ A 250$ CSS Injection — My First Finding on Hackerone!
✍️ Hacked Dutch Government Website. All I got was this l̶o̶u̶s̶y̶ cool T-Shirt.
✍️ Weird bug to steal users credentials
✍️ Oracle Server Side Request Forgery (SSRF) Metadata
✍️ OAuth Misconfiguration found in small time-window of attack
✍️ Abusing JSON Web Token to steal accounts — 3000$
✍️ QUEST KACE Desktop Authority Pre-Auth Remote Code Execution (CVE-2021-44031)
✍️ $4500 bounty - How I got lucky
✍️ Discourse SNS webhook RCE
✍️ One Endpoint, Two Account Takeovers
✍️ Linux Kernel GSM Multiplexing Race Condition Local Privilege Escalation Vulnerability (CVE-2023-6546)
✍️ 1000$ for Open redirect via unknown technique [BugBounty writeup]
✍️ [web3] Unprotected Swap Function: A ERC777 Reentrancy Vulnerability. Introduction | by Heuss | Jun, 2023 | Medium
✍️ DOM-Based XSS for fun and profit $$$! | Bug Bounty POC
✍️ How Sigstore quickly patched an upstream vulnerability
✍️ MSRC is confused! 😕
✍️ CVE-2021-2471 MySQL JDBC XXE
✍️ Chaobin Zhang
✍️ A Unique XSS Scenario in SmartSheet || $1000 bounty
✍️ CVE-2022-32223 Discovery: DLL Hijacking via npm CLI
✍️ Stored XSS on the DuckDuckGo search results page
✍️ Google Books X-Hacking
✍️ Exploiting an N-day vBulletin PHP Object Injection Vulnerability
✍️ Exposing Local Web Servers in Popular Mac & Windows Software
✍️ Subdomain Takeover via Wufoo Service in a Private Program
✍️ Edmodo Bug Bounty Writeup
✍️ Blackbox Cookie Testing — How I Cracked The Admin’s Cookie
✍️ Reply To Instagram Stories where privacy of who can reply is set to ‘Nobody’. (Part 2)
✍️ [web3] Med: Brahma.fi Curve Miscalculations May Cause User Withdraws to Fail | Trust
✍️ Simple logical Bug turned into a bounty
✍️ Dangerous Import: SourceForge Patches Critical Code Vulnerability
✍️ Reversing Citrix Gateway for XSS
✍️ One Bug at a Time: $1,500 worth of XSS
✍️ OLX Bug Bounty: Reflected XSS
✍️ The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)
✍️ Alternative link
✍️ Part-I
✍️ Alternative link
✍️ Intigriti XSS Challenge July 2024 — Finding a new DOMPurify bug
✍️ SSD Advisory – TP-Link TL-WR840N Stack Buffe Overflow DOSy
✍️ How we exploited a remote code execution vulnerability in math.js
✍️ CVE-2020-9964 - An iOS infoleak
✍️ UBER Wildcard Subdomain Takeover | BugBounty POC
✍️ My write-up in hacking IBM’s administration panel and getting SQLi on it
✍️ UnOAuthorized: Privilege Elevation Through Microsoft Applications
✍️ Tarfile: Exploiting the World With a 15-Year-Old Vulnerability
✍️ Full Account Takeover via Open Redirection
✍️ [VDP] Crashing your LinkedIn app with a connection request | by Hacking articles
✍️ Voice Confusion When Commenting On Watch Party
✍️ How Scanning Your Projects for Security Issues Can Lead to Remote Code Execution
✍️ Unveiling Remote Code Execution in AI chatbot workflows 💵
✍️ Gitlab Project Import RCE Analysis (CVE-2022-2185)
✍️ My 2nd 4digit Bug Bounty From Facebook
✍️ [web3] APWine Incorrect Check of Delegations Bugfix Review. This is a postmortem of a vulnerability… | by Immunefi | Jul, 2022 | Medium
✍️ Blind SQL injection with a little WAF
✍️ Apache Example Servlet leads to \(\)
✍️ Another Admin panel
✍️ Storing Passwords - A Journey Of Common Pitfalls
✍️ Exploiting new-era of Request forgery on mobile applications
✍️ Password Bypass and Something Else…
✍️ Persistent XSS (Unvalidated oEmbed) at Medium.com
✍️ Stored XSS Leads to Plaintext Password Disclosure
✍️ How I made my first $$$ from finding a bug in Facebook
✍️ CVE 2022–24082, RCE in the PEGA Platform — Discovery, Remediation & Technical Details (Long Live JMX!!!)
✍️ Reacting to myself finding an SSRF vulnerability in Google Cloud
✍️ Cache-Key Normalization - What could go wrong?
✍️ EJS, Server side template injection RCE (CVE-2022-29078) - writeup
✍️ Airbnb – When Bypassing JSON Encoding, XSS Filter, WAF, CSP, and Auditor turns into Eight Vulnerabilities
✍️ How Abusing AWS CloudFormation Led to a Total Takeover of an AWS Environment
✍️ Jumping to the hell with 10 attempts to bypass devil’s WAF
✍️ The Secret Parameter, LFR, and Potential RCE in NodeJS Apps
✍️ OLX Reflected XSS on Resend Code link !!
✍️ [Critical] Bypass CSRF protection on IBM
✍️ Issue 1040755: Security: Another “universal” XSS via copy&paste
✍️ Critical Vulnerability through OSINT only
✍️ IDOR, Content Spoofing and Url Redirection via unsubscribe email in Confluent
✍️ Privilege escalation leads to deleting other user’s account and company Workspace [Access Control]
✍️ Major Security Flaws in Popular QuickBlox Chat And Video Framework Expose Sensitive Data Of Millions
✍️ Relution Remote Code Execution via Java Deserialization Vulnerability
✍️ Write-up - Love story, from closed as informative to $3,500 USD, XSS stored in Yahoo! iOS MaiL app
✍️ How I earned $$$$ through Stored XSS
✍️ How I was able to see likes and dislikes count even though is hidden by victim | YouTube #3
✍️ Vimeo SSRF with code execution potential.
✍️ Hacker's Guide to Directory/Endpoint Enumeration
✍️ Zero click vulnerability in Apple’s macOS Mail
✍️ CVE-2022-31749: WatchGuard Authenticated Arbitrary File Read/Write (Fixed)
✍️ Kud I Enter Your Server? New Vulnerabilities in Microsoft Azure
✍️ HackerOne report
✍️ BreakingApp – WhatsApp Crash & Data Loss Bug
✍️ Stored XSS on Edmodo
✍️ Hacking YouTube for #fun and #profit
✍️ Cache poisoning of wget
✍️ Protected Users: you thought you were safe uh?
✍️ Hall of Fame Vice Media ? hacking while sleepy…
✍️ Get your Microsoft account hijacked by simply clicking connect button -Adesh Kolte
✍️ Plormbing Your Prisma ORM With Time-based Attacks
✍️ [web3] Critical bug in Hourglass (old) found by ABDul Rehman worth Not Paid
✍️ All your PostgreSQL databases are belong to us
✍️ How did I find Log4j vulnerability via Static Code Analysis and receive €€€ bounty?
✍️ RC4 Is Still Considered Harmful
✍️ [Bug Bounty] Email Content Injection
✍️ Facebook Bug Bounty Reports
✍️ A Pain in the NAS: Exploiting Cloud Connectivity to PWN your NAS: WD PR4100 Edition
✍️ [Business Logic Bug] Bypassing Nickname Feature
✍️ A picture that steals data
✍️ Abusing URI Parsers for fun and profit
✍️ Oauth Misconfiguration lead to complete account takeover
✍️ Blind SSRF to Port Scanning through response time
✍️ Exploiting a Single Request for Multiple Vulnerabilities
✍️ CVE-2023-6483: Improper/missing API authentication in ADiTaaS v5.1
✍️ Why I walked away from $30,000 of DJI bounty money
✍️ Blind XSS against a Googler
✍️ Stealing Downloads from Slack Users
✍️ CVE-2022-32898: ANE_ProgramCreate() multiple kernel memory corruption
✍️ Generate online votes using Race Condition Vulnerability in Woobox Web Application (Write Up)
✍️ How recon helped me to find an interesting bug…
✍️ Bypassing CloudTrail in AWS Service Catalog, and Other Logging Research
✍️ How I Found My First Bug in Android App
✍️ Auth Bypass in Google Assistant
✍️ HTML Injection and a dream in Google Chrome for Linux (Write Up)
✍️ Reverse Engineering Coin Hunt World’s Binary Protocol
✍️ How I found RCE But Got Duplicated
✍️ Exploitation of Openfire CVE-2023-32315
✍️ Missing Bricks: Finding Security Holes in LEGO APIs
✍️ SSRF & Google HOF(Hall of Fame)
✍️ Hacking the Dutch Government
✍️ The Nightmare of Apple's OTA Update: Bypassing the Signature Verification and Pwning the Kernel
✍️ Apple TV for Fire OS code execution
✍️ New Vulnerability in protobufjs: Prototype Pollution - CVE-2023-36665
✍️ Bug-Bounty | FASTMAIL [topicbox.com: Privileges Escalation > Organization Takeover]
✍️ CSV injection at Comment Section.
✍️ From an Innocent Client-Side Path Traversal to Account Takeover
✍️ [web3] Stacks DoS Bugfix Review. This is a postmortem of a vulnerability… | by Immunefi | Feb, 2024 | Medium
✍️ Complete information disclosure using Broken Access Control
✍️ Finding 0day to hack Apple
✍️ This Microsoft Windows RCE Vulnerability Gives an Attacker Complete Control
✍️ Easy $$$ via API params manipulation leading to bypassing the email verification block
✍️ Hundreds of hundreds sub-secdomains hack3d! (including Hacker0ne)
✍️ Blind Command Injection - It hurts
✍️ Drupal Insecure Default Leads To Password Reset Poisoning
✍️ GoogleMeetRoulette: Joining random meetings
✍️ A Simple IDOR which should not be missed on dating site ;)
✍️ Private bug bounty \(,\)$ USD: “RCE as root on Marathon-Mesos instance”
✍️ [Google VRP] SSRF in Google Cloud Platform StackDriver
✍️ FabriXss (CVE-2022-35829): How We Managed to Abuse a Custom Role User Using CSTI and Stored XSS in Azure Fabric Explorer
✍️ Privilege escalation on private program.
✍️ Readme.com Account Takeover
✍️ Get Page Inbox notifications for any Facebook page
✍️ Logging Passwords in Plaintext in Azure Arc
✍️ PandoraFMS - Pre-Auth Remote Code Execution
✍️ Journey through Google referer leakage bugs.
✍️ Account Take over via reset password
✍️ Bugcrowd report
✍️ Blind XSS in Email Field; 1000$ bounty
✍️ Knocking on the Front Door (client side desync attack on Azure CDN)
✍️ Weaponizing DHCP DNS Spoofing — A Hands-On Guide
✍️ Accidental IDOR
✍️ Facebook Messenger Desktop App Arbitrary File Read
✍️ From Reflected XSS to Account Takeover — Showing XSS Impact
✍️ Pwn2Own Miami 2022: OPC UA .NET Standard Trusted Application Check Bypass
✍️ [web3] High Risk Vulnerability Disclosed to Ondo Finance
✍️ Information Disclosure that made me $2000 in under 5 minutes
✍️ Yahoo Bug Bounty: Exploiting OAuth Misconfiguration To Takeover Flickr Accounts
✍️ AWS S3 bucket misconfiguration - Paytm
✍️ Javascript Anti Debugging - Abusing SourceMappingURL
✍️ Microsoft Apache Solr RCE Velocity Template | Bug Bounty POC
✍️ Testing Cookies worth $500
✍️ RCE in Google Cloud Deployment Manager
✍️ WRITE UP – TELEGRAM BUG BOUNTY – WHATSAPP N/A [“Blind” XSS Stored iOS in messengers twins, who really care about your security?]
✍️ Reflected Cross Site Scripting on User Agent-Dependent Response
✍️ [CVE-2023-22855] Kardex MLOG - Insecure path join to RCE via SSTI
✍️ Vulnerability in Electron-based Application: Unintentionally Giving Malicious Code Room to Run
✍️ My Weirdest Bug Bounty — Getting PII from O365.
✍️ From Recon to Bypassing MFA Implementation in OWA by Using EWS Misconfiguration
✍️ Three Microsoft Store vulnerabilites
✍️ Mattermost Server v5.32 > v5.36 Reflected XSS in OAuth flow
✍️ Salt Labs exposes a new vulnerability in popular OAuth framework, used in hundreds of online services
✍️ Exploiting an Unbounded memcpy in Parallels Desktop: A Pwn2Own 2021 Guest-to-Host Virtualization Escape
✍️ [web3] Learning by Breaking: a LayerZero Case Study (Part 3) | Trust
✍️ BMW Vulnerabilities – Hijack Cars ConnectedDrive™ Service!
✍️ Reflected XSS in Yahoo Subdomain ( hk.movies.yahoo.com )
✍️ Leaking OpenID tokens with “ — the bug right infront of you
✍️ Facebook bug Bounty -Finding the hidden members of the private events.
✍️ My first bounty on Synack Red Team
✍️ Firefox for Android: LAN-Based Intent Triggering
✍️ Hacking — Always Check the Cross-domain Policy
✍️ Bypass CSP by Abusing XSS Filter in Edge
✍️ Basic HTTP Authentication Risk: Uncovering pyspider Vulnerabilities
✍️ Bypass Uppercase filters like a PRO (XSS Advanced Methods)
✍️ Pre-Auth RCE in Aspera Faspex: Case Guide for Auditing Ruby on Rails
✍️ Authentication Bypass | Easy P1 in 10 minutes
✍️ Chaining Multiple Vulnerabilities Leads to Remote Code Execution (RCE) on One of the Payment Service Companies.
✍️ Encoding Differentials: Why Charset Matters
✍️ mXSS in support.mozilla.org
✍️ Malicious Kubernetes Helm Charts can be used to steal sensitive information from Argo CD deployments
✍️ Shipt Subdomain TakeOver via HeroKu ( test.shipt.com )
✍️ Digging in to SCP Command Injection
✍️ Sleeping stored Google XSS Awakens a $5000 Bounty
✍️ How to bypass CloudFlare bot protection ?
✍️ Technical Advisory – Nullsoft Scriptable Installer System (NSIS) – Insecure Temporary Directory Usage
✍️ Stored XSS in app.gitbook.com
✍️ HTML Injection to XSS bypass in [REDACTED.com]
✍️ How I found multiple critical bugs in Red Bull
✍️ How I Hacked Billion Android Users Social And 3rd Party Account | A Story About 5000$ Bug
✍️ RocketChat - Monitor User Messages
✍️ Owning half of a government assets through AWS
✍️ [sidefx][Poc] user enumeration & no rate limeted in send message function
✍️ Full Company Building Takeover
✍️ Hacking the Medium partner program
✍️ Single XSS with Earn $600
✍️ Firebase: Insecure by Default (feat. that one time our classmates tried to sue us)
✍️ How I managed to trigger a Stored-XSS in an online store with the help of Cache Poisoning
✍️ Stranger Strings: An exploitable flaw in SQLite
✍️ XSS-Through-Fuzzing-Default-IIS
✍️ Azure Active Directory Flaw Allowed SAML Persistence
✍️ Filling in the Blanks: Exploiting Null Byte Buffer Overflow for a $40,000 Bounty
✍️ Github, The Goldmine for P1s and P2s - Sensitive Information Exposure via Github by a Company Employee
✍️ How I could access your internal servers, steal and modify your image repository
✍️ Part 2
✍️ How I found XSS on Admin Page without login!
✍️ T-Reqs: HTTP Request Smuggling with Differential Fuzzing
✍️ Apple Security Bounty: A personal experience
✍️ YAFPC — Unauthenticated Remote Code Execution
✍️ iCloud XXS’ed
✍️ Vue JS Reflected XSS
✍️ Abusing title reporting and tmux integration in iTerm2 for code execution
✍️ EXIF Geolocation Data Not Stripped From Uploaded Images
✍️ Bypassing Authentication Using Javascript Debugger.
✍️ 2FA Bypass via Forced Browsing
✍️ How I was able to Takeover Accounts on Foxit.com
✍️ Bug Bounty { How I found an SSRF ( Reconnaissance ) }
✍️ Content Types and XSS: Facebook Studio
✍️ Business user Employees could have applied block list to all ad accounts listed in the business manager.
✍️ Authentication bypass in NodeJS application — a bug bounty story
✍️ Bypassing CORS configurations to produce an Account Takeover for Fun and Profit
✍️ GitHub Desktop RCE (OSX)
✍️ Chaining Open Redirect with XSS to Account Takeover
✍️ Hunting Insecure Direct Object Reference Vulnerabilities for Fun and Profit (PART-1)
✍️ SQL Injection in private-site.com/login.php
✍️ Disclose Facebook Internal Server Information With A Strange Poll
✍️ Escalating From Reader To Contributor In Azure API Management
✍️ All about Single Sign-On (SSO) | by sl4x0
✍️ [Responsible Disclosure] How we could have deleted any Linkedin post
✍️ Facebook BugBounty : Short story on Page admin disclosure
✍️ Back To School - Exploiting A Remote Code Execution Vulnerability In Moodle
✍️ Oversightboard.com site-wide CSRF due to missing checking
✍️ Jasper Reports Library Code Injection
✍️ #BugBounty — ”I don’t need your current password to login into your account” - How could I completely takeover any user’s account in an online classified ads company.
✍️ Bypass Google Captcha+Parameter Pollution Leads to send email to any user on behalf of “Organization” with any desired content
✍️ CVE-2022-25165: Privilege Escalation to SYSTEM in AWS VPN Client
✍️ Riding The Inforail To Exploit Ivanti Avalanche
✍️ Stealing User’s PII info by visiting API endpoint directly
✍️ Subdomain Hijacking Of Any Qwilr’s Customer
✍️ Facebook OAuth Framework Vulnerability
✍️ [No Bounty] Business Logic Error leads to watching a Standup Comedy Show for free!
✍️ How I Found XSS By Searching In Shodan
✍️ vimeo IDOR ( buying pro membership & ondemand videos for 0.1$ )
✍️ Privileged Escalation in Facebook Messenger Rooms
✍️ Getting Paid With Just Picking Color — Bug Bounty
✍️ FFUF and my first bounty
✍️ From Hobby to Hacking
✍️ Google Exploit – Steal Account Login Email Addresses
✍️ Apache Dubbo Consumer Risks: The Road Not Taken
✍️ Git-Syncing into Trouble: Exploring Command Injection Flaws in Kubernetes
✍️ Becoming A Super Admin In Someone Elses Gsuite Organization And Taking It Over
✍️ Exploiting OAuth: Journey to Account Takeover
✍️ InfluxDB Access at redact.8x8.com
✍️ Hunting Android Application Bugs Using Android Studio.
✍️ Attacking Android Antivirus Applications
✍️ Facebook’s Burglary Shopping List
✍️ Code Vulnerabilities Put Proton Mails at Risk
✍️ Chained Bug: XML File Upload to XSS to CSRF to Full Account Take Over (ATO)
✍️ A small change, and things go in your hand : Story of a $250 bounty
✍️ CVE-2021-27075: Microsoft Azure Vulnerability Allows Privilege Escalation and Leak of Private Data
✍️ Never underestimate the power of open redirect, a story of a full account takeover
✍️ CVE-2022-35256 - HTTP Request Smuggling in NodeJS
✍️ Multiple Vulnerabilities in Fortra Globalscape EFT Administration Server [FIXED]
✍️ This is fine 🐶
✍️ Cracking my windshield and earning $10,000 on the Tesla Bug Bounty Program
✍️ Google Cloud Shell - Command Injection
✍️ [web3] Tokemak: Liquidity Operator Can Steal Funds | Trust
✍️ Exploiting insecure exception logging
✍️ Bypass HackerOne 2FA requirement and reporter blacklist
✍️ tRPC Security Research: Hunting for Vulnerabilities in Modern APIs
✍️ Remote code execution through unsafe unserialize in PHP
✍️ XXE in IBM’s MaaS360 Platform
✍️ Write-up: AWS Document Signing Security Control Bypass
✍️ Account Takeover Due to Cognito Misconfiguration Earns Me €xxxx
✍️ CSRF to Full Account Takeover
✍️ Luminate Internal Privilege Escalation — Admin to Owner
✍️ XSS via postMessage in chat.mozilla.org
✍️ Bug Bounty - Information Disclosure through error message + WAF Bypass led to Local File Inclusion
✍️ Zoneminder – Web App Testing – Oct 2022
✍️ Stored XSS on Indeed
✍️ [CVE-2023-32695] Socket.IO DoS Trought Javascript Property Manipulation on WebSockets
✍️ Jailbreak of Meta AI (Llama -3.1) revealing configuration details
✍️ Microsoft Intune, Version 1.55.48.0 Advisory
✍️ Attacking The Software Supply Chain With A Simple Rename
✍️ Reflected XSS in graph.facebook.com leads to account takeover in IE/Edge
✍️ WordPress < 5.8.3 - Object Injection Vulnerability
✍️ Video PoC
✍️ Bypassing the patch for my previous Instagram bug.
✍️ M1 Macs GateKeeper bypass aka CVE-2021-30658
✍️ How Github recon help me to find NINE FULL SSRF Vulnerability with AWS metadata access
✍️ [web3] Bitswift Unlimited Mint Bugfix Postmortem. This is a postmortem of a vulnerability… | by Immunefi | Dec, 2021 | Medium
✍️ Story of a really cool SSRF bug.
✍️ CVE-2019-18426 - WhatsApp Vulnerabilities Disclosure - Open Redirect + CSP Bypass + Persistent XSS + FS read permissions + potential for RCE
✍️ Hacking a .NET API in the real world
✍️ [web3] Critical bug in Oasys found by merkle_bonsai worth 200k
✍️ Reading Your Emails With A Read&Write Chrome Extension Same Origin Policy Bypass (~8 Million Users Affected)
✍️ SD-PWN Part 4 — VMware VeloCloud — The Last Takeover
✍️ SSRF External Service Interaction for Find Real IP CloudFlare and Leads to SQL Injection
✍️ Subdomain Takeover in Azure: making a PoC
✍️ Samsung Galaxy Apps MiTM vulnerabilities
✍️ REST framework Admin Panel bypass and how I recon for this vulnerability
✍️ How i Found Information Disclosure on Scribd.com
✍️ ELECTRIC CHROME - CVE-2020-6418 on Tesla Model 3
✍️ AWS WAF Bypass: invalid JSON object and unicode escape sequences
✍️ We Hacked Ourselves With DNS Rebinding
✍️ Microsoft Store free purschase vulnerabilites
✍️ From Github Recon To Account Takeover
✍️ I Hope This Sticks: Analyzing ClipboardEvent Listeners for Stored XSS
✍️ Full Account Takeover via Referer Header (OAuth token Steal, Open Redirect Vulnerability Chaining)
✍️ How I Might Have Hacked Any Microsoft Account
✍️ Variant Cloud Analysis
✍️ Account Takeover via Access Token Leakage | by M’BAREK Imad
✍️ SSRF and Account Takeover via XSS in ERPNext (0-day)
✍️ Unrestricted CV File Upload
✍️ CVE-2022-26730 | ColorSync | Hoyt LLC
✍️ 1500$: CR/LF Injection
✍️ #BugBounty — How Naaptol (India’s popular home shopping company) Kept their Millions of User Data at Risk!
✍️ Intro to Open-source Bug Bounty

Frequently Asked Questions

The following are frequently asked questions about common vulnerabilities and security misconfigurations found during bug bounty hunting. Understanding these concepts is crucial for anyone starting their bug hunting journey.

What is an XSS vulnerability? Cross-Site Scripting (XSS) attacks are a type of injection attack in which malicious scripts are inserted into otherwise trustworthy and innocuous websites. XSS attacks occur when an attacker uses a web application to send malicious code to a particular end user, usually in the form of a browser side script. The flaws that enable these attacks to succeed are common and can be found wherever a web application uses input from a user within the output it generates without validating or encoding it.

There are mainly 3 types of XSS:

What is an IDOR vulnerability? When a web application or API exposes a reference to an internal implementation object, it is referred to as Insecure Direct Object Reference (IDOR). This method exposes the element's true identifier and the data format it uses. This is a common access control flaw.

An example would be an API that gives you access to data belonging to other users, through an endpoint - /api/users/:id where an attacker can fetch data of any user by manipulating the id parameter.
What is an SSRF vulnerability? In a Server-Side Request Forgery (SSRF) attack, the attacker can read or update internal resources by abusing server features. The attacker may supply or change a URL to which the server's code can read or send data, and by carefully choosing the URLs, the attacker might be able to read server configuration such as AWS metadata, connect to an internal service, or access sensitive files.
What is a SQLi vulnerability? A SQL injection attack involves inserting or "injecting" a SQL query into the application through the client's input data. An effective SQL injection exploit can read sensitive data from the database, alter database data (Insert/Update/Delete), and even perform database administration operations.
What is an RCE vulnerability? If user input is inserted into a File or a String and then executed (evaluated) by the backend programming language's parser, a remote code execution (RCE) vulnerability can be exploited. A Remote Code Evaluation will result in the entire web application and web server being compromised as it allows an attacker to execute arbitrary commands on the server.
How can I reach you? If you have any feedback or, concerns about this site, I can be reached on Twitter.