>

🚀 We've added new community writeups and a Web3 section! Click here to see what's new.

🐛 Bug Bounty Hunting Search Engine

Made with ❤️ by @payloadartist
NEW
Example search: http://bugbountyhunting.com/?q=keyword
Showing 1337 random writeups. Use the search bar to find more.
✍️ Source Code at Risk: Critical Code Vulnerability in CI/CD Platform TeamCity
✍️ [web3] Medium bug in Ocean found by Shanmuga Bharathi. N worth 5k
✍️ HTTP Request Smuggling on business.apple.com and Others.
✍️ XSS, RCE & HTML File Upload in same endpoint
✍️ A business Logic issue worth $1500
✍️ Super Admin panel without Credentials 😎
✍️ Ransacking your password reset tokens
✍️ Bypassing WAF to Weaponize a Stored XSS
✍️ Zooming in on Zero-click Exploits
✍️ CVE-2022-35405 Manage engines RCE (Password Manager Pro, PAM360 and Access Manager Plus)
✍️ Story of my two (but actually three) RCEs in SharePoint in 2018
✍️ Legally hacking a Government Satellite?
✍️ BLIND SSRF in *.stripe.com due to Sentry Misconfiguration
✍️ From . in regex to SSRF — part 3
✍️ Demo: Brute-forcing a macOS user’s real name from a browser using mDNS
✍️ Government Emails at Risk: Critical Cross-Site Scripting Vulnerability in Roundcube Webmail
✍️ Exploiting Client-Side Path Traversal to Perform Cross-Site Request Forgery - Introducing CSPT2CSRF
✍️ Anyone can Access Deleted and Private Repository Data on GitHub
✍️ Replying on LiveStream leading to Page Admin Disclosure: Facebook Bug Bounty
✍️ Chained Bug: XML File Upload to XSS to CSRF to Full Account Take Over (ATO)
✍️ Full Account Takeover (Android Application)
✍️ Multiple Times I Hacked Duke University With RXSS Vulnerability!!!
✍️ Kamailio’s exec module considered harmful
✍️ Server Side Request Forgery with huge impact in production application
✍️ Zeal Wallet Browser Extension and Backend Security Audit Report (Q3 2023)
✍️ From SSRF to Local File Disclosure
✍️ HSTS Bypass Vulnerability in IE Preview
✍️ Facebook Creator Studio Misconfiguration $$$$
✍️ All *.intercom.help subdomains vulnerable to Subdomain Takeover from intercom Service
✍️ AliExpress XSS vulnerability - take over any seller account
✍️ Research: Auditing WordPress Plugins
✍️ A story of leaking uninitialized memory from Fastly
✍️ Persistent cross-site scripting vulnerabilities in Liferay Portal
✍️ Cross-Site Websocket Hijacking bug in Facebook that leads to account takeover
✍️ How I Found Multiple Bugs On FaceBook In 1 Month And a Part For My Methodology & Tools
✍️ Cryptographic Side-Channels (Timing Leaks) in JSBN
✍️ 1500$: CR/LF Injection
✍️ Stealing local storage data through XSS
✍️ Technical Advisory – Multiple Vulnerabilities in PandoraFMS Enterprise
✍️ The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)
✍️ Google OAuth is broken (sort of)
✍️ Pre-Account Takeover by Reversing a Weak Email Verification Token Algorithm
✍️ writeups/bug.md at main · asurti6783/writeups · GitHub
✍️ Getting access to Zendesk’s Google Cloud and Artifactory from GitHub dotfile repos
✍️ Deep Dive into Open Source Bug Bounty
✍️ Stealing administrative JWT's through post auth SSRF (CVE-2021-22056)
✍️ Write Up – Apple N/A: PII Information, Full Contact List, Main Phone No. And Main Icloud Email Extracted; Bug Patched: Arbitrary Local File Read Via Zip File And Symlinks On Ios Files App.
✍️ From Recon via Censys and DNSdumpster, to Getting P1 by Login Using Weak Password – “password”
✍️ #BugBounty — API keys leakage, Source code disclosure in India’s largest e-commerce health care company.
✍️ Reading Uber’s Internal Emails [Uber Bug Bounty report worth $10,000]
✍️ mysqlnd/pdo password buffer overflow leading to RCE (CVE 2022-31626)
✍️ Account Takeover Via Reset Password Worth 2000$
✍️ Google APIS ClickJacking ( $1337)
✍️ Armaan Patha
✍️ SVG files and Java code execution
✍️ My Account Takeover Writeup: $5000
✍️ How two dead accounts allowed remote crash of any instagram android user
✍️ Zero to Account Takeover: How I ‘Impersonated’ Someone Else Using Auth0
✍️ Bypassing LFI (Local File Inclusion)
✍️ A Easy Vertical Privilege Escalation via Session Storage
✍️ Send messages through notification to facebook & workplace users without getting blocked
✍️ A journey from XML External Entity (XXE) to NTLM hashes!
✍️ Chaining Multiple Requests to Achieve Rate Limiting Vulnerabilities
✍️ Bugging Out: My Experience of Earning $300 for Reporting an Unexpected Bug
✍️ Facebook Messenger for android indirect thread deletion vulnerability.
✍️ Multiple bugs in one program leads to 1500€
✍️ RCE Vulnerabilite in Yahoo Subdomain! ( Yahoo! RCE via Spring Engine SSTI ) By tghawkins
✍️ Abusing URI Parsers for fun and profit
✍️ Encrypted Doesn't Mean Authenticated: ShareFile RCE (CVE-2023-24489)
✍️ AWS Chain Attack- Thousands of Vulnerable EKS Clusters
✍️ Subdomain Takeover via HubSpot
✍️ How I Get 5x Swag From Sony
✍️ How I found XSS vulnerability in Amazon in 5 minutes using shodan
✍️ Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platform
✍️ Internal path disclosure in Instagram server
✍️ [ GCP 2022 ] Few bugs in the google cloud shell
✍️ Stealing user passwords through a VPN’s SSO
✍️ Unauthenticated Access To MongoDB Database of Oracle Corporation
✍️ Open-redirect Vulnerability on Facebook
✍️ Self XSS To Evil XSS
✍️ Disclose contact_email of any Facebook application
✍️ From Android Static Analysis to RCE on Prod
✍️ SVG SSRFs and saga of bypasses
✍️ A successful prototype pollution chained to a DOM XSS
✍️ How Twitch Helper Can Be Used for Privilege Escalation
✍️ CVE-2022-26730 | ColorSync | Hoyt LLC
✍️ World of SELECT-only PostgreSQL Injections: (Ab)using the filesystem
✍️ CVE-2024-27292: docAssembling exploits for RCE
✍️ IDOR leads to leaked the likes count even though is hidden by victim | YouTube ($XXXX)
✍️ Account takeover CSRF Misconfiguration
✍️ Handlebars template injection and RCE in a Shopify app
✍️ 700$ Denial of Service(DoS) vulnerability in script-loader.php (CVE-2018-6389)
✍️ Tale of Account Takeovers (Part-1)
✍️ Uncovering a ChromeOS remote memory corruption vulnerability
✍️ My Best Small Report Bounty Report in Private Program ( Django REST framework Admin Login ByPass )
✍️ The Curious Case of Copy & Paste – on risks of pasting arbitrary content in browsers
✍️ How i Got 3 SQL injection in just 10 minutes.
✍️ [web3] Perpetual Protocol – Bad Debt Attack For Fun and Profit
✍️ Tale of 2 TOOTB Bugs: Google and WhatsApp
✍️ Stored XSS at Trello.com
✍️ Data Exfiltration through Blind XXE on PDF Generator
✍️ How I Hacked 100K+ Godaddy Users And Help To Secure For Free
✍️ Abusing Slack’s file-sharing functionality to de-anonymise fellow workspace members
✍️ SSD Advisory – Roundcube MarkAsJunk RCE
✍️ The Case of the Missing Cache Keys
✍️ Nokia email app pwnage
✍️ The effectiveness of employing BChecks to uncover significant secrets
✍️ Sitecore Experience Platform Pre-Auth RCE - CVE-2021-42237
✍️ How i was able to get Appreciation from the organization of a website just by changing a sign..!!!
✍️ $36k Google App Engine RCE
✍️ Importance of burp history analysis to bypass 403
✍️ From Reflected XSS to Account Takeover — Showing XSS Impact
✍️ Spokeo Bug bounty Experience
✍️ How I made $1500 dollars using base64 decoder :)
✍️ Chaining Self Blind XSS with Broken Access Control To Make it Non Self Blind XSS
✍️ How I bypassed 403 forbidden domain using a simple trick
✍️ Abusing URL Shortners for fun and profit
✍️ XSS on Flickr
✍️ Navigating the Sea, Exploiting DigitalOcean APIs
✍️ WhatsApp — DoS Vulnerability In iOS & Android
✍️ Path Traversal in MobileSafari
✍️ I Own Your Customers !!!
✍️ Session Expiration Bypass in Facebook Creator App
✍️ Unremovable Tags In Facebook Page Reviews
✍️ From listKeys to Glory: How We Achieved a Subscription Privilege Escalation and RCE by Abusing Azure Storage Account Keys
✍️ EJS, Server side template injection RCE (CVE-2022-29078) - writeup
✍️ How i found a 1500$ worth Deserialization vulnerability
✍️ RoguePuppet – A Critical Puppet Forge Supply Chain Vulnerability
✍️ A tale of critical account take over
✍️ IDOR (Insecure Direct Object Reference) leads to listing all valid Users and edit their Profiles
✍️ HackerOne report
✍️ Oracle Cross Site Scripting Vulnerability -Adesh Kolte
✍️ Uber Hacking: How we found out who you are, where you are and where you went
✍️ A Confused Deputy Vulnerability in AWS AppSync
✍️ Bypass Uppercase filters like a PRO (XSS Advanced Methods)
✍️ Unauthenticated RCE in Goanywhere
✍️ Paytm-Broken Link Hijacking
✍️ Improper Privilege Management in Grails Spring Security Core <= 5.1.0 (CVE-2022-41923)
✍️ Two weeks of securing Samsung devices: Part 1
✍️ Exploiting a double-edged SSRF for server and client-side impact
✍️ PHP Filters Chain: What Is It And How To Use It
✍️ SpoolFool: Windows Print Spooler Privilege Escalation (CVE-2022-21999)
✍️ CVE-2023-1906 - Heap-based Buffer Overflow in ImageMagick
✍️ “GIFShell” — Covert Attack Chain and C2 Utilizing Microsoft Teams GIFs
✍️ No Database No Table, how do you do MSSQL Injection?
✍️ OnePlus Open/Unvalidated Redirects & Forwards
✍️ Leaking WordPress CSRF Tokens for Fun, $1337 bounty, and CVE-2017-5489
✍️ FileZilla ‘fzsftp’ Untrusted Search Path
✍️ Bug Bounty: como encontrei o bug Unrestricted File Upload
✍️ Indirect UXSS issue on a private Android target app
✍️ Allow arbitrary URLs, expect arbitrary code execution
✍️ IDOR leads to account takeover
✍️ First Valid BUG Finding At Microsoft And I Got the Acknowledgments Page Microsoft
✍️ Popping Tags: Exploiting Template Injections in PRTG Network Monitor
✍️ How I Could Steal Money from Instagram, Google and Microsoft
✍️ Got Bounty with Account takeover (ATO ) Unicode-Case Mapping Collision !
✍️ How I got a lousyT-Shirt from the Dutch Government.
✍️ Remote code execution in BIRT Viewer ≤ 4.12.0 (CVE-2023-0100)
✍️ The Time I Hacked Google’s Manual Actions Database
✍️ Discord Rich Presence LeonardSSH.vscord
✍️ Banning users Race condition
✍️ Hashing the Favicon.ico
✍️ CVE-2022-26712: The POC for SIP-Bypass Is Even Tweetable
✍️ Bug Bounty { How I found an SSRF ( Reconnaissance ) }
✍️ Become member of close & public group
✍️ PoC video
✍️ Blind XSS in Google Analytics Admin Panel — $3133.70
✍️ Multiple Vulnerabilities in Cisco Expressway
✍️ Using Burp Suite match and replace settings to escalate your user privileges and find hidden features
✍️ Capturing Exposed AWS Keys During Dynamic Web Application Tests
✍️ Password Bypass and Something Else…
✍️ Fetch Diversion
✍️ CVE-2021-27075: Microsoft Azure Vulnerability Allows Privilege Escalation and Leak of Private Data
✍️ How I find open redirect in Facebook
✍️ Easy SQLi in Amazon subsidiary using Sqlmap
✍️ Remote code execution in Homebrew by compromising the official Cask repository
✍️ From Self-Hosted GitHub Runner to Self-Hosted Backdoor
✍️ Hacking Smartwatches for Spear Phishing
✍️ How I made 300 GitHub repos point to my blog using Azure subdomains takeover
✍️ The Frustrating XSS
✍️ Oracle Cross Site Scripting Vulnerability -Adesh Kolte
✍️ $900 Blind XSS
✍️ GitHub - RCE via git option injection (almost) - $20,000 Bounty
✍️ Subdomain Takeover Through Expired Cloudfront Distribution
✍️ Sagar VD
✍️ Bypassing a noexec by elf roping
✍️ Reversing 'France Identité': the new French digital ID.
✍️ Hacking Magento eCommerce For Fun And 17.000 USD
✍️ OnePlus Open/Unvalidated Redirects & Forwards
✍️ [BugBounty] XSS with Markdown — Exploit & Fix on OpenSource
✍️ Vertical escalation of privileges Leading to Sensitive Data Exposure
✍️ My first bounty on Synack Red Team
✍️ OTP Bypass - Developer’s Check
✍️ Super FabriXss: From XSS to an RCE in Azure Service Fabric Explorer by Abusing an Event Tab Cluster Toggle (CVE-2023-23383)
✍️ [web3] Informational bug in GYSR found by MiloTruck
✍️ Finding XSS on .apple.com and building a proof of concept to leak your PII information
✍️ Hijacking Over 100k GoDaddy Websites
✍️ WPML Multilingual CMS Authenticated Contributor+ Remote Code Execution (RCE) via Twig Server-Side Template Injection (SSTI)
✍️ Broken Link Hijacking - Mr. User-Agent
✍️ Adventures Into The MeowCorp Bug Bounty Program
✍️ Not valid bug that leads to us a multiple Valid Report in Facebook
✍️ The Deputy Is Confused About AWS Security Hub
✍️ Internet Explorer has a URL problem
✍️ Wormable remote code execution in Alien Swarm
✍️ A short story about an XSS in chat.mozilla.org (CVE-2021-21320)
✍️ Facebook WhiteHat: Able to access group plan even after leaving the group
✍️ From Intigriti challenge to a Vue.js script gadget
✍️ [Writeup][Bug Bounty][Tokopedia] Manipulate Other User’s Cart and Wishlist on Tokopedia [EN]
✍️ CVE-2023-38205: Adobe ColdFusion Access Control Bypass [FIXED]
✍️ From staging to 0 click account takeover
✍️ Story of YouTube’s Unfixable Ads Bypass
✍️ XSS in Facebook CDN due to improper filtering of uploaded files extensions
✍️ [web3] Notional: Double Counting Free Collateral Bugfix Review. This is a postmortem of a vulnerability… | by Immunefi | Apr, 2022 | Medium
✍️ How we Hijacked 26+ Subdomains
✍️ How I got a 4 digits(₹) bounty from an Indian company
✍️ Artsy
✍️ Mobile OAuth Attacks - iOS URL Scheme Hijacking Revamped
✍️ How I was able to see any private album passwrod in Picturepush — IDOR
✍️ What the Vuln: Zimbra
✍️ CSV Injection -> Meterpreter on Pornhub
✍️ Luminate Internal Privilege Escalation — Admin to Owner
✍️ Hunting for Bitwarden master passwords stored in memory
✍️ XSS vulnerability in Google image search
✍️ How often do we overlook vulnerabilities?
✍️ From PostAuth RCE to PreAuth RCE on Liferay Portal
✍️ $10,000 for automatic email confirmation bug in Microsoft's Edge browser
✍️ Enter "Sandbreak" - Vulnerability In vm2 Sandbox Module Enables Remote Code Execution (CVE-2022-36067)
✍️ My First Critical Bug In HackerOne Platform
✍️ Weird and very easy authentication bypass found with Google dorking
✍️ Facebook movies recommendation vulnerability – A bug capable of erasing all your important notifications!
✍️ XSS via postMessage in chat.mozilla.org
✍️ My first bug on Google
✍️ Please email me your password
✍️ Cloud firewall management API SNAFU put 500k SonicWall customers at risk
✍️ Hijacking GitHub Repositories by Deleting and Restoring Them
✍️ CVE-2021-27076: A Replay-style Deserialization Attack Against Sharepoint
✍️ Site Isolation bypass via Chrome extension
✍️ Unencrypted HTTP Links to Google Scholar in Search
✍️ NoSQL Injection in Plain Sight
✍️ Site wide CSRF on a popular program
✍️ Please email me your password
✍️ CVE-2024-38428 Wget Vulnerability: All you need to know
✍️ Jumping into SOCKS
✍️ Here’s How I Could Read Anyone’s Apple ID Metrics Remotely.
✍️ [web3] Med: Morpho Finance Logic - Contract Can Be Destroyed via Controlled `delegatecall` | Trust
✍️ SSRF vulnerability in AppSheet - Google VRP
✍️ GraphQL IDOR in Facebook streamer dashboard.
✍️ Melting the DNS Iceberg: Taking over your infrastructure Kaminsky style
✍️ Discovering 7 Open Redirect Bypasses and 3 XSS Bypasses Within a Single Program Using the Same Parameters
✍️ The GitHub Actions Worm: Compromising GitHub Repositories Through the Actions Dependency Tree
✍️ Bypassed! and uploaded a sweet reverse shell
✍️ Hack ZTE router's admin panel
✍️ Alternative link
✍️ Firefox for Android: LAN Based Intent Triggering
✍️ How I Hacked Instagram Again
✍️ How to break SAML if I have paws?
✍️ Using App Ads Helper as an Analytic User
✍️ Cross-site scripting: The power of the hidden parameters.
✍️ DOM-Based XSS | Bug Bounty Writeup
✍️ SSRF via FFmpeg HLS processing
✍️ Download Facebook internal mobile builds
✍️ One LFI bypass to rule them all (using base64)
✍️ OTP Verification Bypass
✍️ How Did I Leak 5.2k Customer Data From a Large Company? (via Broken Access Control)
✍️ 2FA Bypass via Logical Rate Limiting Bypass
✍️ F**k you Thomas” - ToyTalk bug bounty writeup
✍️ Internal directories enumeration in www
✍️ Account Takeover via Response Manipulation worth 1800$..
✍️ Hacking ISP CPE equipment: FiberHome
✍️ Fishbowl Disclosure: CVE-2022-29805
✍️ SSRF leads to access AWS metadata.
✍️ A simple Account takeover misusing JWT late expiration
✍️ Reflected XSS Primagames.com
✍️ Business logic vulnerabilities — Low-level logic flaw
✍️ Unrestricted file upload in Rocket TRUfusion Enterprise <= 7.9.6.0
✍️ Multi Domain DOM Cross Site Scripting
✍️ Multiple HTTP Redirects to Bypass SSRF Protections
✍️ Coinbase AngularJS DOM XSS via Kiteworks
✍️ SQL Injection & Remote Code Execution - Double P1
✍️ How a simple Directory Listing leads to PII Data Leakage, Remote Code Execution and many more vulnerabilities on a HR management subdomain
✍️ How I By-pass the login page and 2FA authentication…..
✍️ How I was able to change victim’s password using IDN Homograph Attack
✍️ The Castle’s Latrine
✍️ Useless path traversals in Zyxel admin interface (CVE-2022-2030)
✍️ How I found XSS on Amazon?
✍️ How I earned \(\) by finding confidential customer data including plain-text passwords!
✍️ Subdomain Takeover in Azure: making a PoC
✍️ R-XSS -> CSRF bypass to account takeover/
✍️ How I Built An XSS Worm On Atmail
✍️ How I was able to takeover Facebook account
✍️ Disabling ClamAV as an Unprivileged User
✍️ Empowering weak primitives: file truncation to code execution with Git
✍️ 120 Days of High Frequency Hunting
✍️ Exploiting CORS Misconfigurations
✍️ How I Bypassed 2FA while Resetting Password
✍️ Business ID leak via Creative Hub redirect
✍️ SysmonEoP
✍️ Multiple vulnerabilities on Chamilo 1.11.18
✍️ Full structure takeover to many brands of company
✍️ Bypass Apple Corp SSO on Apple Admin Panel
✍️ One Way to Find Hidden IDOR Vulnerability
✍️ Multiple Vulnerabilities in Proxmox VE & Proxmox Mail Gateway
✍️ Remote Code Execution in Melis Platform
✍️ FlowFixation: AWS Apache Airflow Service Takeover Vulnerability and Why Neglecting Guardrails Puts Major CSPs at Risk
✍️ mast1c0re: Hacking the PS4 / PS5 through the PS2 Emulator - Part 1 - Escape
✍️ Hacking your own antivirus for fun and profit (Safe browsing gone wrong)
✍️ The Unexpected “0” Master ID for Account Data Manipulation
✍️ Hello: I’m your Domain Admin and I want to authenticate against you
✍️ Unauthenticated Command Injection Vulnerability in VMware NSX SD-WAN by VeloCloud
✍️ Fun sql injection — mod_security bypass
✍️ DOS attack possible on Reset 2FA feature of #Hackerone
✍️ Access developer tasks list of any Facebook Application (GraphQL IDOR)
✍️ Shopping App Deeplink Arbitrary URLs
✍️ XSLeaking with my best bud SOP
✍️ Recon to Sensitive Information Disclosure in Minutes
✍️ Found SSRF and LFI in Just 10 minutes of using burp!
✍️ Bug bounty left over (and rant) Part III (Google and Twitter)
✍️ You’ve Crossed the Line — Disturbing a Host’s Rest
✍️ Chaining our way to Pre-Auth RCE in Metabase (CVE-2023-38646)
✍️ POODLE SSLv3 bug on multiple twitter smtp servers
✍️ Multiple Intel Vulnerabilities-Adesh Kolte
✍️ RCE using Path Traversal
✍️ Exploiting Arbitrary Object Instantiations in PHP without Custom Classes
✍️ NoSQL Injections in Rocket.Chat 3.12.1: How A Small Leak Grounds A Rocket
✍️ How I hacked 23.900.000 tumblr domains at once :)
✍️ Brave Browser Script Blocker Bypass Vulnerability
✍️ RCE in Hubspot with EL injection in HubL
✍️ Attacks On GCM With Repeated Nonces
✍️ Hacked Instagram Handle Of Samsung….
✍️ 2FA Bypass via Forced Browsing
✍️ Interesting find on the Invite link
✍️ Hacking a Telecommunication company(MTN)
✍️ The Story of My First Reflected XSS
✍️ Fun With CORS
✍️ How I Automatically Discovered SSRF in Hackerone Program
✍️ Microsoft SharePoint’s ‘Follow’ Feature XSS (CVE-2017–8514) -Adesh Kolte
✍️ GoCD Multiple Vulnerabilities
✍️ How i Hacked BASF Company !!
✍️ Account Takeover Due to Misconfigured Login with Facebook/Google
✍️ [IDOR] Delete saved credit cards from any Business Manager Account — Facebook Bug Bounty
✍️ Zero-Day: Hijacking iCloud Credentials with Apple Airtags (Stored XSS)
✍️ Over 1 Million websites are at risk of sensitive information leakage - XSS is dead. Long live XSS
✍️ Part 2: Dive into Zoom Applications
✍️ How I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit
✍️ No RCE? Then SSH to the box!
✍️ Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws
✍️ Breaking GitHub Private Pages for $35k
✍️ Disclose Page Admins via Gaming Dashboard Bans
✍️ Exposing 185M+ Indians’ Personal Information and much more
✍️ [web3] Critical bug in Polygon PoS found by Barracuda3172
✍️ Hacking Facebook Invoice: How I could’ve bought anything for Free from Facebook Business Pages
✍️ CVE-2021-4119: [Bookstack] Email harvesting via SQL "LIKE" clause exploitation
✍️ LAN-Based Blind SSRF Attack Primitive for Windows Systems (switcheroo)
✍️ Zimbra Email - Stealing Clear-Text Credentials via Memcache injection
✍️ Hunting Insecure Direct Object Reference Vulnerabilities for Fun and Profit (PART-1)
✍️ Credential Disclosure in LastPass
✍️ Exploiting Open Redirect - Whitelist Bypass Using Salesforce Environment
✍️ Detecting and exploiting mass-assignments in order to manipulate user columns and read private messages
✍️ Walid Hossain (@NoobWalid)
✍️ Java Deserialization Tricks
✍️ Upgrade from LFI to RCE via PHP Sessions
✍️ Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO
✍️ Account Takeover via XSS in e-signature feature worth 2500$
✍️ 3 ways to get Remote Code Execution in Kafka UI
✍️ SiriSpy - iOS bug allowed apps to eavesdrop on your conversations with Siri
✍️ Bug Bounty Failsx101[4]
✍️ Chaining Multiple Vulnerabilities Leads to Remote Code Execution (RCE) on One of the Payment Service Companies.
✍️ Reflected XSS on Microsoft
✍️ Leak of internal categorySets names and employees test accounts.
✍️ One Param => $10k
✍️ Page Admin Disclosure: Facebook Bug Bounty 2020
✍️ CVE-2020-13379 Unauthenticated Full-Read SSRF in Grafana
✍️ How I was able to get subscription of $120/year For Free
✍️ Javascript Anti Debugging - Abusing SourceMappingURL
✍️ CRLF injection allow => cookie injection in root domain & xss
✍️ Mr. Robot: Self Xss from Informative to high 1200$ ,csrf, open redirect,self xss to stored
✍️ How I got $13337 bounty From Google
✍️ Hacking My Helium Crypto Miner
✍️ Never underestimate the power of open redirect, a story of a full account takeover
✍️ Biological Inspiration
✍️ From Django Debug Mode to PII Data Leak of more than 500+ Employees due Broken Access Control and IDOR
✍️ Command Injection in the GitHub Pages Build Pipeline
✍️ $100 Bounty in 300 seconds isn’t bad !!!
✍️ Automating SQL Injection On Encrypted Request
✍️ Stored XSS in the guide’s GameplayVersion (www.dota2.com)
✍️ [Account Takeover] Don’t Send a Message to anyone Before Reading This [External Audit]
✍️ Full Account Takeover via Open Redirection
✍️ A Misconfiguration in techprep.fb.com REST API allowed me to modify any user profile.
✍️ Unauthorized access to all the user’s account.
✍️ A Bug That Was 23 Years Old Or Not
✍️ Analysing Crash Messages To Achieve Blind Root Command Injection
✍️ Hacking a .NET API in the real world
✍️ The Monsters in Your Build Cache – GitHub Actions Cache Poisoning
✍️ Security Implications of URL Parsing Differentials
✍️ Hacking into Toyota’s global supplier management network
✍️ Subdomain Takeover via Wufoo Service in a Private Program
✍️ GraphQL IDOR leads to information disclosure
✍️ [web3] Synthetix Logic Error Bugfix Review. This is a postmortem of a vulnerability… | by Immunefi | Jun, 2022 | Medium
✍️ Unsubscribe any user’s e-mail notifications via IDOR
✍️ $10k host header
✍️ How I hacked IBM and got full access on many services?
✍️ PwnAssistant - Controlling /home's Via A Home Assistant RCE
✍️ How I was Able To Bypass Email Verification
✍️ Identity Confusion in WebView-based Mobile App-in-app Ecosystems
✍️ Hacking Oracle in 5 Minutes
✍️ How i was able to bypass Cloudflare for XSS!
✍️ Technical Analysis of Windows CLFS Zero-Day Vulnerability CVE-2022-37969 - Part 1: Root Cause Analysis
✍️ Azure Ad Kerberos Tickets: Pivoting To The Cloud
✍️ QRCDR ZeroDay Path Traversal Vulnerability
✍️ The Butterfly Effect: Turning Overlooked - Misconfigurations into Zero Click Account Takeover
✍️ WordPress GiveWP POP to RCE (CVE-2024-5932)
✍️ XSS on Sony subdomain
✍️ One Misconfig (JIRA) to Leak Them All- Including NASA and Hundreds of Fortune 500 Companies!
✍️ An Effective 5 min recon leads to a Hall of Fame
✍️ JNDI Injection Remote Code Execution via Path Manipulation in MemoryUserDatabaseFactory
✍️ Never Give Up, The Story Behind a Dupe-To-Triaged
✍️ Cross-Origin Resource Sharing (CORS) Misconfiguration leads to User’s PII leaks.
✍️ #BugBounty — How I was able to delete anyone’s account in an Online Car Rental Company
✍️ Official Telegram Web Client ClickJacking Vulnerability – When crypto is strong and client is weak
✍️ XSS-Through-Fuzzing-Default-IIS
✍️ Malicious redirect on mailroom.prezi.com
✍️ Remote Command Execution in Visual Studio Code Remote Development Extension
✍️ The Million Dollar IDOR
✍️ Alias file to rule them all — One click code execution with alias file in macOS
✍️ Research: The mass CSRFing of .google.com/ products.
✍️ Hacking Terraform State for Privilege Escalation
✍️ Remote Command Execution in binwalk
✍️ [web3] Critical bug in Silo found by kankodu worth 100k
✍️ Salesforce bug hunting to Critical bug
✍️ How I could have stolen your photos from Google
✍️ Breaking TikTok: Our Journey to Finding an Account Takeover Vulnerability
✍️ Reflected (XSS)on [alibabacloud.com]
✍️ LFI in Nokia maps
✍️ Alternative link
✍️ RCE In AddThis
✍️ Path traversal while uploading results in RCE
✍️ How I earned a $7000 bug bounty from Grab (RCE Unique Bugs)
✍️ Account Take Over Due to AWS Cognito Misconfiguration | by Deshine
✍️ Analysis and Discovery of CVE-2020-13693
✍️ KindleDrip — From Your Kindle’s Email Address to Using Your Credit Card
✍️ How I was able to bypass OTP code requirement in Razer [The story of a critical bug]
✍️ Advisory: Cisco RV34X Series – Authentication Bypass and Remote Command Execution
✍️ How I Leak Other’s Access Token by Exploiting Evil Deeplink Flaw
✍️ Asus’S Admin Panel Auth Bypass
✍️ Bug Hunting: Xss On Cookie Popup Warning
✍️ Apple CoreText - An Unexpected Journey to Learn about Failure
✍️ Exploiting a File Upload Vulnerability — A Directory Traversal Attack
✍️ Local Privilege Escalation Discovered in VMware Fusion
✍️ When not to rely on Automated Tools
✍️ [web3] Critical bug in Moonbeam found by pwning.eth worth 1M+50k
✍️ Persistent XSS (Unvalidated oEmbed) at Medium.com
✍️ CVE-2022-29844: A Classic Buffer Overflow On The Western Digital My Cloud Pro Series PR4100
✍️ Determine users with detailed role model on behalf of any Facebook Application
✍️ Exploiting: Buffer overflow in Xiongmai DVRs
✍️ Multiple vulnerabilities in Oracle EBS
✍️ How Recon helped me to to find a Facebook domain takeover
✍️ Bypassing Captcha !
✍️ Hacking Razer Pay Ewallet App
✍️ [BAC/IDOR] How my father credit card help me to find this access control issue
✍️ Swf XSS (Dom Based Xss)
✍️ Tail of IDOR
✍️ Chain the vulnerabilities and take your report impact on the moon (CSRF to HTML INJECTION which results OPEN REDIRECT and could steal USER CREDENTIALS)
✍️ The Android kernel mitigations obstacle race
✍️ Backslash Powered Scanning: hunting unknown vulnerability classes
✍️ Metadata service MITM allows root privilege escalation (EKS / GKE)
✍️ PostMessage Xss vulnerability on private program
✍️ CSRF + Open Redirect To Account Takeover
✍️ OpenOlat - XML external entity (XXE) injection (CVE-2024-28198)
✍️ Exploiting Static Site Generators: When Static Is Not Actually Static
✍️ Business Logic Ratings Bug
✍️ Behind the Query: Unearthing NTLM Hashes with SQL Injection
✍️ Remote Code Execution on Western Digital PR4100 NAS (CVE-2022-23121)
✍️ Pulse Secure version number disclosure in error messages
✍️ Skype for Business Audit Part 1 - SKYPErsistence
✍️ Alternative link
✍️ Write up – $1,000 usd in 5 minutes, xss stored in outlook.com (ios browsers)
✍️ Popping the Pornhub Cherry
✍️ Responsible disclosure: improper access control in Gitlab private project.
✍️ Cross-Site Scripting in CodeIgniter version 3.1.13
✍️ Framing, Part 1: Click-Jacking Etsy
✍️ Zoneminder – Web App Testing – Oct 2022
✍️ Full Account takeover (ATO) — a tale of two bugs 🐛
✍️ Technical Advisory – Multiple vulnerabilities in Nuki smart locks (CVE-2022-32509, CVE-2022-32504, CVE-2022-32502, CVE-2022-32507, CVE-2022-32503, CVE-2022-32510, CVE-2022-32506, CVE-2022-32508, CVE-2022-32505)
✍️ Hook, Line, and Phishlet: Conquering AD FS with Evilginx
✍️ Hey WAF! Better Luck Next Time! 👽
✍️ Ivanti EPM Remote Code Execution
✍️ How I could download the source code of an Indian e-commerce website!!
✍️ Analysis of Adobe Acrobat Reader Javascript Doc.print() Use-After-Free Vulnerability (CVE-2022-34233)
✍️ CSRF account takeover in a company worth 1B$
✍️ Hyperlink Injection - Easy Money (sometimes)
✍️ Listen to the whispers: web timing attacks that actually work
✍️ Chaining Cache Poisoning To Stored XSS
✍️ Critical Vulnerability through OSINT only
✍️ Hunting for Amazon Cognito Security misconfigurations
✍️ Facebook Page Admin Disclosure
✍️ Interesting case of SQLi
✍️ ‘Websocket Hijacking’ to steal Session_ID of victim users
✍️ Bypassing Authentication Using Javascript Debugger.
✍️ Bypassing Cloudflare WAF: XSS via SQL Injection
✍️ Admin disclosure of Facebook verified pages/ Disclose Facebook employee assigned to help a verified page.
✍️ CVE-2022-24696 – Glance By Mirametrix Privilege Escalation
✍️ XSS Filter Evasion
✍️ Parameter Pollution issue in API resulting $XXX
✍️ What is BOLA? 3-digit bounty from Topcoder ($$$)
✍️ How I hacked Google’s bug tracking system itself for $15,600 in bounties
✍️ Pwning a Server using Markdown
✍️ Get Page Inbox notifications for any Facebook page
✍️ Turning bad SSRF to good SSRF: Websphere Portal
✍️ $3000 Bug Bounty Award from Mozilla for a successful targeted Credential Hunt
✍️ iOS Privacy: Instagram and Facebook can track anything you do on any website in their in-app browser
✍️ RCE Vulnerabilite in Yahoo Subdomain! ( Yahoo! RCE via Spring Engine SSTI ) By tghawkins
✍️ [web3] Aurora Infinite Spend Bugfix Review ($6m Payout). This is a postmortem of a vulnerability… | by Immunefi | Apr, 2022 | Medium
✍️ Page Admin Disclosure | Facebook Bug Bounty 2019
✍️ “Important, Spoofing” - zero-click, wormable, cross-platform remote code execution in Microsoft Teams
✍️ TOPdesk vulnerable to XML Signature Wrapping Attacks
✍️ Subdomain Takeover: Starbucks points to Azure
✍️ Dangling DNS: AWS EC2
✍️ IDOR, unpin posts for fun.
✍️ Shell in the Ghost: Ghostscript CVE-2023-28879 writeup
✍️ Cracking the lens: targeting HTTP's hidden attack-surface
✍️ How I Bypassed Netflix Profile Lock?
✍️ The power of Client-Side Path Traversal: How I found and escalated 2 bugs through “../”
✍️ Facebook android webview vulnerability : Execute arbitrary javascript (xss) and load arbitrary website
✍️ How I was able to get private ticket response panel and FortiGate web panel via blind XSS
✍️ How I hacked into a government e-learning website
✍️ Waze arbitrary file upload
✍️ How i found massive information disclosure of 1500 famous people
✍️ Where is my Train : Tracking to Hacking !
✍️ Another vision for SSRF
✍️ Shipping your Private Key - CVE-2023-43870, Paxton do a Lenovo
✍️ [CVE-2020-2733] JD Edwards EnterpriseOne Tools admin password not adequately protected
✍️ How I hacked redbus [An online bus-ticketing application]
✍️ Size matters! When capital letters introduce vulnerabilities
✍️ Unleashing the Cloud: A Journey into Hacking College Servers and Uncovering Security Vulnerabilities
✍️ TL;DR
✍️ Account Takeover - Smoking with ‘null’
✍️ HTML to PDF converter bug leads to RCE in Facebook server
✍️ Every XSS is different
✍️ Hacking on a plane: Leaking data of millions and taking over any account
✍️ Amazon AWS Bastion - Logger Bypass
✍️ Google.com – Mobile Feedback URL Redirect Regex/Validation Flaw
✍️ Free blockchain storage – Tale of a bug in Substrate’s FRAME runtime
✍️ [No Bounty] DoS Vulnerability in Smart Contracts | by Hacking articles
✍️ Parallels Desktop Toolgate Vulnerability
✍️ InfluxDB NoSQL Injection
✍️ Step-by-step: exploiting SQL injection(s) in Oculus’ website.
✍️ How I was able to do Mass Account Takeover[Bug Bounty]
✍️ How I was able to read any users confidential reports on a public level domain
✍️ CVE-2022-4908: SOP bypass in Chrome using Navigation API
✍️ How I made it to Google HOF?
✍️ POST to XSS: Leveraging Pseudo Protocols to Gain JavaScript Evaluation in SSO Flows
✍️ HTTP Desync Attack (Request Smuggling) - Mass Account Takeover at a Cryptocurrency based asset and 121 other websites
✍️ Personal Access Token Disclosure in Asana Desktop Application
✍️ Auth Bypass in https://nearbydevices-pa.googleapis.com
✍️ 1-Click Account Takeover in Virgool.io — a Nice Case Study
✍️ Journey through Google referer leakage bugs.
✍️ Mining Node.js Vulnerabilities via Object Dependence Graph and Query
✍️ ChaosDB: Critical Vulnerability in Microsoft Azure Cosmos DB
✍️ [web3] Critical bug in Interlay found by pwning.eth worth 200k
✍️ Discord Desktop - Remote Code Execution
✍️ 3CX Phone System Local Privilege Escalation Vulnerability
✍️ Cookie Bugs - Smuggling & Injection
✍️ Alternative link
✍️ Supply Chain Attacks: A New Era
✍️ XSS Stored On Messages In [ Outlook Web — Outlook Android App ]
✍️ Self XSS To Stored Through IDOR/
✍️ Uncovering a Bug I Found in Outlook: How Could an Account Has Been Compromised?
✍️ It's not a Feature, It's a Vulnerability
✍️ WordPress Design Flaw Leads to WooCommerce RCE
✍️ XSS via Exif Data - The P2 Elevator
✍️ How I was able to see likes and dislikes count even though is hidden by victim | YouTube #4
✍️ CVE-2022-0337 System environment variables leak on Google Chrome, Microsoft Edge and Opera
✍️ From Wayback Machine To Account Takeover
✍️ Re-dressing Instagram – Leaking Application Tokens via Instagram ClickJacking Vulnerability!
✍️ Source code leakage due to exposed sourcemap
✍️ (Response) Splitting Up Reverse Proxies To Reach Internal Only Paths
✍️ How recon helped me to find an interesting bug…
✍️ ‘FriendlyName’ Buffer Overflow Vulnerability in Wemo Smart Plug V2
✍️ An Interesting Account Takeover Vulnerability
✍️ $5,005 worth vulnerability Duplicated, How I loose $5,005 in a day? Denial of Service - Billion LAUGH Attack (XXE)
✍️ Vulnerability Spotlight: Multiple remote code execution vulnerabilities in Microsoft Azure Sphere
✍️ Story OF MY 3RD Bounty From Facebook
✍️ Dodging OAuth origin restrictions for Firebase spelunking
✍️ TRAP; RESET; POISON; - Taking over a country Kaminsky style
✍️ 2FA Bypass via Logical Rate Limiting Bypass
✍️ NCIIPC VDP Bug : Open Redirection Vulnerability In Govt. Site !!
✍️ CentreStack Disclosure
✍️ XSS to Account Takeover
✍️ P1 Vulnerability in 60 seconds
✍️ Authorization bypass — Gmail
✍️ From Security Misconfiguration to Gaining Access of SMTP server
✍️ Adding a malicious notebook to be treated like a trusted notebook in Google Colab — 1337$
✍️ Unrestricted CV File Upload
✍️ Story of a Pre-Account Takeover
✍️ Hacking the Nintendo DSi Browser
✍️ Exploiting JWT - Lack of Signature Verification
✍️ DOM-XSS Bug Affecting Tinder, Shopify, Yelp, and More
✍️ Just another XSS | by lnxcs
✍️ Logical Flaw Resulting Path Hijacking
✍️ Symlinks as mount portals: Abusing container mount points on MikroTik's RouterOS to gain code execution
✍️ Redash SAML Authentication Bypass
✍️ Admin Panel Bypass without the credentials
✍️ Sysdreams
✍️ How I lost my followers on Medium
✍️ iOS App Pentesting and Security with Real-World Case Studies Part 2
✍️ Bypassing Mimecast URL and File Inspection
✍️ A ‘Novel’ Way to Bypass Executable Signature Checks with Electron
✍️ How I made my first $$$ from finding a bug in Facebook
✍️ From Recon to Optimizing RCE Results – Simple Story with One of the Biggest ICT Company in the World
✍️ Multiple vulnerabilities in Dell Unisphere for PowerMax vApp, VASA Provider vApp and Solutions Enabler vApp CVE-2022-45103 / CVE-2022-45104
✍️ Bug Bounty : Account Takeover Vulnerability POC
✍️ Exploiting an HTML injection with dangling markup
✍️ Open-redirect to Account Takeover.
✍️ How I Exposed Instagram's Private Posts by Blocking Users
✍️ PII Leakage via IDOR + Weak PasswordReset = Full Account Takeover
✍️ The 2.5 BTC Stored XSS
✍️ Accessing deleted comment for $$: A Bug Bounty Writeup
✍️ From payload to 300$ bounty: A story of CRLF injection and responsible disclosure on HackerOne
✍️ Reflected XSS + Possible Server Side Template Injection in HubSpot CMS ( All Websites Uses HubSpot was affected )
✍️ SQL injection in harvard subdomain
✍️ Better Make Sure Your Password Manager Is Secure
✍️ SecurePwn Part 1: Bypassing SecurePoint UTM’s Authentication (CVE-2023-22620)
✍️ Chaining Self XSS with UI Redressing is Leading to Session Hijacking (PWN users like a boss)
✍️ $4,998 Bounty Awarded and 100,000 WordPress Sites Protected Against Unauthenticated Remote Code Execution Vulnerability Patched in GiveWP WordPress Plugin
✍️ My First Bug is RCE via SQL injection!
✍️ ArtiPACKED: Hacking Giants Through a Race Condition in GitHub Actions Artifacts
✍️ Attacking The Software Supply Chain With A Simple Rename
✍️ Blast from the past: Cross Site Scripting on the AWS Console
✍️ How to Bypass Golang SSL Verification
✍️ Compromising HP SAN appliances
✍️ Escalating SSRF to Accessing all user PII information by aws metadata
✍️ Pwn2Own Vancouver 2021 :: Microsoft Exchange Server Remote Code Execution
✍️ How I Could Get The Instagram Username of Anyone on Tinder
✍️ OLX Bug Bounty: Reflected XSS
✍️ RCE In GitLab's CLI Tool
✍️ How to Secure AWS ServerLess Lambda from ReDoS(Regular Expression Denial-of-Service) & Resultant Financial Impact
✍️ CVE-2022-41622 and CVE-2022-41800 (FIXED): F5 BIG-IP and iControl REST Vulnerabilities and Exposures
✍️ Two XSS Vulnerabilities in Azure with Embedded postMessage IFrames
✍️ Stored-XSS-on-groups-google-com
✍️ webOS Revisited - Even More Mistaken Identities
✍️ Spoofing SaaS Vanity URLs for Social Engineering Attacks
✍️ How I Registered Multiple Accounts in PrivateInternetAccess VPN Service for FREE
✍️ Bee-yond Capacity: Unauthenticated RCE in Extreme Networks/Aerohive Wireless APs - CVE-2023-35803
✍️ How Did Tons of People Like Me on Tinder?
✍️ Exploiting Struts RCE on 2.5.26
✍️ A Case Study of API Vulnerabilities - Part 2, and Empty Heads
✍️ Reflected XSS + Possible Server Side Template Injection in HubSpot CMS ( All Websites Uses HubSpot was affected )
✍️ Bypassing Crossdomain Policy and Hit Hundreds of Top Alexa Sites
✍️ LibreOffice Arbitrary File Write (CVE-2023-1883)
✍️ CVE-2019-17004—Semi Universal XSS affecting Firefox for iOS
✍️ Stop scratching the surface, and hack the dependencies
✍️ AntiHack IDOR on Create Submission
✍️ thisclosed_#1 - Full Account Takeover of ANY user via Insecure Direct Object Reference (IDOR) on reset password functionality
✍️ #BugBounty How I Hack Billion $ Company
✍️ Disabling js for the win
✍️ CVE-2021-22929 – Brave Browser 1.27 and below permanently logs the server connection time for all v2 tor domains to ~/.config/BraveSoftware /Brave-Browser/tor/data/tor.log
✍️ Unexpected Zero in MySQL Injection
✍️ Amazon packaging feedback cross-site scripting vulnerability
✍️ Privilege Escalation: From being a normal user to admin
✍️ Ability to bruteforce Instagram account’s password due to lack of rate limitation protection
✍️ Your NAS is not your NAS !
✍️ How I Discovered Authentication Bypass That Blocks Users from Accessing the Website ?
✍️ Reflected Swf XSS at ( https://plugins.svn.wordpress.org )
✍️ SQL Injection Bug Bounty POC!
✍️ #bugbounty How I Takeover Microsoft Store.
✍️ CVE-2022-20942: It's not old functionality, it's vintage
✍️ Unveiling Vulnerabilities: Loose Permissions in Salesforce Lightning Pose Data Security Threats
✍️ Two RCEs are better than one: write-up of an interesting lateral movement
✍️ How I Found My First Bug in Android App
✍️ ZOL Zimbabwe Authentication Bypass to XSS & SQLi Vulnerability – Bug Bounty POC
✍️ Bypass IIS Authorisation with this One Weird Trick - Three RCEs and Two Auth Bypasses in Sitecore 9.3
✍️ Cracking Encrypted Credit Card Numbers Exposed By API
✍️ Dropping a shell in Google’s Cloud SQL (the speckle-umbrella story)
✍️ What I Found on Sony Vulnerability Disclosure Program
✍️ Malicious redirect on mailroom.prezi.com
✍️ Custom role details are exposed in Google groups.
✍️ Pwn2Own Miami 2022: Unified Automation C++ Demo Server DoS
✍️ Blind Time-based SQL injection vulnerability in an Indian government website
✍️ Facebook leak referrer data
✍️ Anonymised Penetration Test Report
✍️ [web3] Taking Home a $20k Bounty With Oasis' Platform Shutdown Vulnerability | Trust
✍️ Identify Tor user across browser restarts
✍️ How i got 100$ from one private website
✍️ Uncovering weaknesses in Apple macOS and VMWare vCenter: 12 vulnerabilities in RPC implementation
✍️ RCE in Progress WS_FTP Ad Hoc via IIS HTTP Modules (CVE-2023-40044)
✍️ The Outlook Winner is Dash
✍️ Google Security Misconfiguration Leads to Account Takeover !
✍️ Exfiltrating Data from Sandboxed Documents
✍️ From open redirect to RCE in one week
✍️ A Tale of Two Formats: Exploiting Insecure XML and ZIP File Parsers to Create a Web Shell
✍️ Business Logic Errors - Must Vote
✍️ Alternative link
✍️ Bypassing Instagram’s stories restriction
✍️ BrokenPrint: A Netgear stack overflow
✍️ Multiple Host Header Attacks after bypassing protection with… a Header Attack
✍️ Escalating reflected XSS with HTTP Smuggling
✍️ Authorization bypass in Google’s ticketing system (Google-GUTS)
✍️ How I managed to get an @Google.com email address, bypassing their previous patch!
✍️ Arbitary File Upload Vulnerability in Google Nest (Write Up)
✍️ Simple Bugs 0x01: Password Changing to Account Takeover!
✍️ Race Condition vulnerability in Azure Video Indexer allowed trial account users use Advance / Premium feature
✍️ XSS on Facebook’s acquisition Oculus CDN
✍️ VMware Workspace One Access
✍️ Duplicate CSRF… Leads to
✍️ Story of Google Hall of Fame and Private program bounty worth $$$$
✍️ My Disclosed Report about Basic auth Api details at Reverb.com
✍️ CVE-2020–1088 — Yet another arbitrary delete EoP
✍️ Hacking Slack using postMessage and WebSocket-reconnect to steal your precious token
✍️ CVE-2020-9759 - Getting root on webOS
✍️ Hitting the jackpot with RCE!
✍️ Add draft subtitles to any Facebook video and Full Path Disclosure
✍️ How I found my first RCE!
✍️ Create hidden comment by blocking an Admin: Facebook Bug Bounty 2020
✍️ Escalating XSS in PhantomJS Image Rendering to SSRF/Local-File Read
✍️ Client, not client!
✍️ From TOMCAT to NT AUTHORITY\SYSTEM
✍️ How i Found Unauthorized Bypass RCE
✍️ Moodle: Blind SQL Injection (CVE-2021-36393) and Broken Access Control (CVE-2021-36397)
✍️ How I found a simple bug in Facebook without any Test
✍️ Manual broken link monitoring
✍️ White Hats - Nepal
✍️ Dropbox Escalation of Privileges to SYSTEM on Windows
✍️ A Story About How I Found XSS in ASUS
✍️ $10000 Facebook SSRF (Bug Bounty)
✍️ Exploiting Application Logic to Referral Code Disclosure
✍️ LDAP Admin Account Bypassed :)
✍️ Reversing and Tooling a Signed Request Hash in Obfuscated JavaScript
✍️ Leveraging LFI to RCE in a website with +20000 users
✍️ Determine a Facebook user from an email address
✍️ WhatsApp Clickjacking Vulnerability – Yet another web client failure!
✍️ VPN bypass vulnerability in Apple iOS
✍️ SSD Advisory – Galaxy Store Applications Installation/Launching without User Interaction
✍️ How I find Open-Redirect Vulnerability in redacted.com (One of the top online payment processing service website)
✍️ Bypass Premium Account Payment (GetPocket)
✍️ Create post on any Facebook page
✍️ Story of a 2.5k Bounty — SSRF on Zimbra Led to Dump All Credentials in Clear Text
✍️ The ART of Chaining Vulnerabilities
✍️ Stored XSS in Yahoo!
✍️ Double URL-encoded XSS
✍️ AWS takeover through SSRF in JavaScript
✍️ Hyperlink Injection On IRC Cloud
✍️ An account takeover vulnerability due to response manipulation.
✍️ Insufficient GraphQL API vulnerability due to lack of validation of Authorization Bearer token
✍️ Making the Facebook app more secure - $8500 bounty
✍️ Discovering and Exploiting a XML External Entity (XXE) Vulnerability in a Public Bug Bounty Program
✍️ Road to (unauthenticated) recovery: downloading GitHub SSO bypass codes
✍️ New Attack Paths? AS Requested Service Tickets
✍️ How I found multiple critical bugs in Red Bull
✍️ ServiceNow Insecure Access Control To Full Admin Takeover
✍️ Local file read via XSS using PDF generate functionality
✍️ Blockchain Network is Secured! But not the apps and their Integrations
✍️ Video
✍️ Ok Google, Give Me All Your Internal DNS Information!
✍️ Snap Trap: The Hidden Dangers Within Ubuntu’s Package Suggestion System
✍️ Pentah0wnage: Pre-Auth RCE in Pentaho Business Analytics Server
✍️ Finding vulnerabilities in Swiss Post's e-voting system: part 3
✍️ How I leveraged XSS to make Privilege Escalation to be Super Admin!
✍️ Testing Cookies worth $500
✍️ I Got United Nation’s Hall Of Fame With This Simple Technique!
✍️ MSSQL linked servers: abusing ADSI for password retrieval
✍️ Exploiting stale ADIDNS entries
✍️ All Your (d)Base Are Belong To Us, Part 2: Code Execution in Microsoft Office (CVE-2021-38646)
✍️ Drop the mic?! no! Drop the connection ;)
✍️ Finding Zero-Day Vulnerabilities in the Supply Chain
✍️ SONY Hunting I: Discovering Hidden Parameters (5x SWAG)
✍️ Gambio 4.9.2.0 - Insecure Deserialization
✍️ Account Takeover via iFrame Injection
✍️ Authentication bypass in NodeJS application — a bug bounty story
✍️ Two vulnerabilities makes an Exploit!! (XSS and CSRF in Bing)
✍️ MEGA’s Unlimited Cloud Storage Vulnerability
✍️ Account Takeover worth of $5
✍️ How to turn security research into profit: a CL.0 case study
✍️ Toner Deaf – Printing your next persistence (Hexacon 2022)
✍️ Write Up – XSS Stored In api.media.atlassian.com Via Doc File (iOS)
✍️ Reflected File Download ( RFD ) in www.Google.com
✍️ From Finding AWS S3 Bucket to Sensitive Data Exposure
✍️ Facebook XSS via Cross-Origin Resource Sharing
✍️ Android : SOP Bypass to steal system files.
✍️ DoS Across Facebook Endpoints
✍️ How I Mass hunt for Admin Panel Access…🤩
✍️ Mail Server Misconfiguration leads to sending a fax from anyone’s account on HelloFax (Dropbox BBP) for a bounty of $4,913
✍️ Opera Browser Cross Site Scripting (XSS)
✍️ [web3] A Very Helpful Sign - zzykxx's blog
✍️ Subscribe to the list of requesters to join a Facebook live video using MQTT
✍️ Exploits Explained: Java JMX’s Exploitation Problems and Resolutions
✍️ IDOR revealing Images cdn links | by Susan wagle
✍️ Add description to Instagram Posts on behalf of other users - 6500$
✍️ Using a GitHub app to escalate to an organization owner for a $10,000 bounty
✍️ $1,250 worth of Host Header Injection
✍️ How I could have Hacked IIT Guwahati’s website
✍️ Azure security — Internal recon leveraging lack of access control
✍️ A Simple bypass of Registration Activation that Lead to many Bug -
✍️ GitHub Pages - Multiple RCEs via insecure Kramdown configuration - $25,000 Bounty
✍️ Responsible denial of service with web cache poisoning
✍️ Reflected XSS on Microsoft.com via Angular Js template injection
✍️ Interesting Stored XSS via meta data
✍️ iOS Outlook Stored XSS Write-Up($3000)
✍️ Pwning a Cisco RV340 with a 4 bug chain exploit
✍️ Get Blind XSS within 5 Minutes — $100
✍️ HTTP Request Smuggling + IDOR
✍️ Information Disclosure that made me $2000 in under 5 minutes
✍️ Password Not Provided - Compromising Any Flurry User’s Account [Yahoo Bug Bounty]
✍️ Exploiting JWT - Lack of Signature Verification
✍️ Pwn2Own 2021: Parallels Desktop Guest To Host Escape
✍️ 403 bypass on a fortune 100 financial institution (P3)
✍️ Chaobin Zhang
✍️ How I Hacked A Company (My First Red Team Engagement 🚩)Permalink
✍️ Each and every request make sense…
✍️ SAMLjacking a poisoned tenant
✍️ Confirm if an invitation is sent to a specific email in Partners Portal / Possibility to resend the invitation
✍️ Lintern@ute Account Takeover via Cross site request forgery
✍️ How Misconfigured and Vulnerable Devices Could Expose Your Company to Physical and Cyber Threats
✍️ SSRF and Account Takeover via XSS in ERPNext (0-day)
✍️ (CRITICAL) Blind Storage XSS — My first Bug Bounty 💰
✍️ We were vulnerable - how a security company could have vulns
✍️ Authenticated CORS with Access-Control-Allow-Origin: *
✍️ Accessing 2 million Verizon Pay Monthly contracts
✍️ IDOR leads to leak Private Details
✍️ How I was able Find mass leaked AWS s3 bucket from js File
✍️ CHECKMATE
✍️ Stealing private messages using XSS on subdomain
✍️ #BugBounty — AWS S3 added to my “Bucket” list!
✍️ Privilege Escalation in Microsoft Teams
✍️ How dangerous is Request Splitting, a vulnerability in Golang or how we found the RCE in Portainer and hacked Uber
✍️ Getting PHP Code Execution and leverage access to panels,databases,server
✍️ [web3] Belt Finance Logic Error Bug Fix Postmortem. This is a postmortem of a vulnerability… | by Immunefi | Sep, 2021 | Medium
✍️ Account Takeover Using Cross-Site WebSocket Hijacking (CSWH)
✍️ Gotta cache 'em all: bending the rules of web cache exploitation
✍️ Protonmail XSS — Stored
✍️ My first and last crit of 2020 on Hackerone
✍️ Unauthenticated Remote Command Execution in Multiple WAGO Products
✍️ How I was able to modify and delete any user’s data file (filestack API)
✍️ Bypassing API Restrictions for Fun and Profit
✍️ One-click DOS via Response Manipulation
✍️ Insecure Authentication Tokens leading to Account Takeover
✍️ Broken links hijacking and CDN takeover
✍️ How I made $10K in bug bounties from GitHub secret leaks
✍️ [Google VRP] Privilege escalation on https://dialogflow.cloud.google.com
✍️ How I was able to find multiple vulnerabilities of a Symfony Web Framework web application
✍️ Analysis Of CVE-2021-1810 Gatekeeper Bypass
✍️ Account Takeover Vulnerability :)
✍️ How we have pwned Root-Me in 2022
✍️ Disclose any main and 3rd party contributors email address and movie local path thru XML file in Plex TV - plex.tv (Write Up)
✍️ Discoure themes OS Command Injection
✍️ Rewriting a photo not owned by the session user in Moments App (Revisited)
✍️ Cross-site-scripting on one of the largest Dutch franchisors
✍️ how I found a tricky XSS
✍️ SQL injections in Nokia sites.
✍️ Path Traversal Paradise
✍️ I Built a TV That Plays All of Your Private YouTube Videos
✍️ CVE-2022-22977: VMware Guest Authentication Service LPE (FIXED)
✍️ Hacking Microsoft and Wix with Keyboard Shortcuts
✍️ Security Flaws within ChatGPT Ecosystem Allowed Access to Accounts On Third-Party Websites and Sensitive Data
✍️ Continuing the Citrix Saga: CVE-2023-5914 & CVE-2023-6184
✍️ My debut with a Critical Bug: How I found my first bug (API misconfiguration)
✍️ Advisory: Cisco Small Business RV Series Routers Web Filter Database Update Command Injection Vulnerability
✍️ Github, The Goldmine for P1s and P2s - Sensitive Information Exposure via Github by a Company Employee
✍️ Double URL-encoded XSS
✍️ Local File XSS Vulnerability in Wordpress.com (Write Up)
✍️ Why you shouldn't use a commercial VPN: Amateur hour with Windscribe
✍️ How we tried to book a train ticket and ended up with a databreach with 245,000 records
✍️ Code Vulnerabilities Put Skiff Emails at Risk
✍️ Zero-Click Calendar invite — Critical zero-click vulnerability chain in macOS
✍️ Anatomy of an IoT Exploit, from Hands-On to RCE
✍️ Bypassing ACLs – IDOR exploitation via HPP
✍️ How I was able to get 1000$ bounty from a ds-store file?
✍️ Getting any Facebook user’s friend list and partial payment card details
✍️ Responsible Disclosure: Breaking out of a Sandboxed Editor to perform RCE
✍️ Command Injection Through BLH
✍️ SQL Injection, Reflected XSS and Information Disclosure in one subdomain in just 10 minutes
✍️ Security Vulnerabilities in Apex Code Could Leak Salesforce Data
✍️ Stored XSS in the administrator’s panel due to misuse of MarkupSafe
✍️ Hacking YouTube for #fun and #profit
✍️ Unauth meetings access
✍️ Privilege Escalation by Changing HTTP Response (Admin Access)
✍️ How_i_was_able_to_pawned_website_via_escilating_webcache deception to rce
✍️ Triple Threat: Breaking Teltonika Routers Three Ways
✍️ Weird Email Verification Bypass
✍️ Missing access control at play store
✍️ Samsung Galaxy Apps MiTM vulnerabilities
✍️ Business Logic Errors - A New Look
✍️ Unserializable, But Unreachable: Remote Code Execution On vBulletin
✍️ My Experience of Hacking Dutch Government
✍️ Insecure Toyota CRM exposed Mexican customer information
✍️ How i made the multiple hall of fame in Nokia within 2 minutes
✍️ Backend Parameter Injection --> RCE
✍️ Micro Services, Major Headaches: Detecting Vulnerabilities in Erxes' Microservices
✍️ Proof Of Concept Nokia Cross Site Scripting
✍️ Universal Code Execution by Chaining Messages in Browser Extensions
✍️ Exposed Jenkins to RCE on 8 Adobe Experience Managers
✍️ So I Became A Node: Exploiting Bootstrap Tokens In Azure Kubernetes Service
✍️ Weakness of Integration
✍️ Vulnerability – Account takeover using OAuth Misconfiguration
✍️ h1{Error based XXE - bug bounty writeup}
✍️ Gitpod remote code execution 0-day vulnerability via WebSockets
✍️ How an Open Redirection Leads to an Account Takeover?
✍️ Write-up - Love story, from closed as informative to $3,500 USD, XSS stored in Yahoo! iOS MaiL app
✍️ EN | Account Takeover and Sensitive Data Leakage via CORS Misconfiguration
✍️ How I was able to make users loss of money on Google Pay
✍️ Spook.js: Attacking Google Chrome's Strict Site Isolation via Speculative Execution and Type Confusion
✍️ MS Enterprise app management service RCE. CVE-2022-35841
✍️ Bypass HackerOne 2FA requirement and reporter blacklist
✍️ Self XSS leads to blind XSS and reflected XSS.
✍️ Discovering a Hidden Security Loophole: Rent luxury Cars for a Single Dollar
✍️ How a Simple IDOR Led Me to Delete Any Account
✍️ InstaBrute: Two Ways to Brute-force Instagram Account Credentials
✍️ How I Was Able To See The Bounty Balance Of Any Bug Bounty Program In HackerOne
✍️ Rate Limit Bypassing Allowing Identity Spoofing
✍️ How Source code reading helped me find an IDOR
✍️ Pwn2Own Miami 2022: ICONICS GENESIS64 Arbitrary Code Execution
✍️ Bug Bounty Collaboration and Manual Exploitation of an Interesting Boolean SQL Injection
✍️ AWS CodeBuild + S3 == Privilege Escalation
✍️ Reflected XSS on Stack Overflow
✍️ Facebook Messenger server random memory exposure through corrupted GIF image
✍️ From file upload to email:pass
✍️ CVE-2022-3236: Sophos Firewall User Portal and Web Admin Code Injection
✍️ A web cache deception chained to a CSRF, the recipe
✍️ Scan QR Code and Got Hacked (CVE-2021–43530 : UXSS on Firefox Android Version)
✍️ Disclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty program
✍️ How I found Reflective XSS in Yahoo Subdomain
✍️ CVE-2021-44790: Code Execution On Apache Via An Integer Underflow
✍️ Reflected XSS In AT&T
✍️ The Art of Intrusion: File Upload Bypass & WAF XSS Evasion in AWS S3 Demystified
✍️ doorLock: Apple HomeKit Denial of Service
✍️ PII-nacles of Discovery: Deep Recon, Fourth-Level Subdomains, and Abusing Exposed .git Repositories
✍️ Privilege Escalation Leads to making authenticated actions (payment processing, creating invoices.. etc)
✍️ Okta For Red Teamers
✍️ Unleashing the Power of Recon: How I Earned $2500 in 5 Minutes
✍️ How I made to Paypal Bug Bounty $750
✍️ Reflected Cross site scripting on reddit website (bounty awards $5000)
✍️ Extracting Clear-Text Credentials Directly From Chromium’s Memory
✍️ BugBounty: How I Cracked 2FA (Two-Factor Authentication) with Simple Factor Brute-force !!! 😎
✍️ Simple logical Bug turned into a bounty
✍️ Advisory: Cisco RV340 Dual WAN Gigabit VPN Router (RCE over LAN)
✍️ How I Bypassed Incapsula WAF By Imperva
✍️ Unintended Behaviour of domain got me P4
✍️ Oops I UDL'd it Again
✍️ CVE-2022–43781
✍️ The Powerful HTTP Request Smuggling 💪
✍️ Change any link at https://fbwat.ch/
✍️ Tale of Easy P1 Bugs in Wild
✍️ Remote code execution in cdnjs of Cloudflare
✍️ Advisory | GLPI Service Management Software Multiple Vulnerabilities and Remote Code Execution
✍️ The easiest way I used to bypass an admin panel
✍️ Stored XSS Vulnerability in Jotform and H1C Private Site
✍️ This is how I was able to see Private, Archived Posts/Stories of users on Instagram without following them
✍️ How I managed to hack User accounts of a billion-dollar sport platform
✍️ Exploiting File Upload Functionality in Unique Way.
✍️ Unauthorized access to Django Admin Dashboard by endpoint leaked on GitHub
✍️ From Wayback Machine To Account Takeover
✍️ ZeroQlik: Achieving Unauthenticated Remote Code Execution via HTTP Request Tunneling and Path Traversal
✍️ How I earned $1,500 in just 15 mins due to Amazon S3 bucket misconfiguration?
✍️ Authentication bypass using root array
✍️ XSS->Fix->Bypass: 10000$ bounty in Google Maps
✍️ AntiHack.me Multiple Vulnerabilities
✍️ Web Cache Poisoning - Capability to disable/deface the app.██████████.com (A tale of poisoning through the layers of caching)
✍️ Linux IPv6 "Route of Death" 0day
✍️ Oauth Misconfiguration Leads to 0-Click ATO
✍️ Broken session management leads to bypass 2FA and Permanent access to Facebook user’s
✍️ The journey from Google Honorable Mention to Hall of Fame.
✍️ Cookie worth a fortune
✍️ Unauthenticated RCE in Adobe Coldfusion – CVE-2023-26360
✍️ A Straight 5-hour Escalation! Exploiting Boolean-Based SQL Injection.👽
✍️ The power of adaptability through experience.
✍️ Account takeover via postMessage
✍️ UnOAuthorized: Privilege Elevation Through Microsoft Applications
✍️ My First NoSQL Injection Bug | by Burhanu Rasheed
✍️ AWS WAF Bypass: invalid JSON object and unicode escape sequences
✍️ Stored XSS in Yahoo mail IOS app($3500)
✍️ Subdomain Takeover via Campaignmonitor
✍️ Discovering a CRLF Injection Vulnerability: My Journey into the MSRC Blog Website
✍️ WordPress Design Flaw Leads to WooCommerce RCE
✍️ How i hacked worldwide ZOOM users
✍️ Genie Aladdin Connect Retrofit Garage Door Opener: Multiple Vulnerabilities
✍️ How i hijacked 12 Subdomains in one Program
✍️ Gaining Unlimited access to graph AuditLogs endpoint using complex filters with non-privileged user account
✍️ How i found 29 stored XSS in modern framework
✍️ Finding my First Critical Web Cache Poisoning
✍️ How did I bypass a Custom Brute Force protection and why that solution is not a good idea?
✍️ From Discovery to Disclosure: ReCrystallize Server Vulnerabilities
✍️ Securing our home labs: Frigate code review
✍️ CVE-2021-0090: Intel Driver & Support Assistant (DSA) Elevation Of Privilege (EOP)
✍️ Analysis of CVE-2024-43044 — From file read to RCE in Jenkins through agents
✍️ Uploading files to api.techprep.fb.com
✍️ Just Gopher It: Escalating a Blind SSRF to RCE for $15k
✍️ My experience of Hacking The Dutch Government
✍️ Facebook $750 Reward for a Simple Bug
✍️ Anatomy of a Reflected XSS: My Discovery on a Microsoft’s Subdomain
✍️ Bug Writeup: FBCTF IDOR
✍️ A Race to the Bottom - Database Transactions Undermining Your AppSec
✍️ [Writeup][Bug Bounty][Instagram] Instagram Still Send New DMs and Video Calls to Device After Logout [ID][EN]
✍️ One Click to Compromise – Fun With ClickOnce Deployment Manifests
✍️ Bypassing 2-Factor Authentication for Facebook Business Manager (Bounty: 1000 USD)
✍️ Exploiting Authentication in AWS IAM Authenticator for Kubernetes
✍️ Taking over Azure DevOps Accounts with 1 Click
✍️ Finding XSS in a million websites (cPanel CVE-2023-29489)
✍️ [web3] Sense Finance Access Control Issue Bugfix Review. This is a postmortem of a vulnerability… | by Immunefi | Aug, 2022 | Medium
✍️ GraphQL introspection leads to sensitive data disclosure
✍️ Broken Authentication — Bug Bounty
✍️ Account Takeover in KAYAK
✍️ Facebook CSRF protection bypass which leads to Account Takeover
✍️ Form Tools Remote Code Execution: We Need To Talk About PHP
✍️ Yes I can see your OTP
✍️ Discord DoS with a single message
✍️ Hacking Google Drive Integrations
✍️ Another XSS in Google Colaboratory
✍️ CSRF PoC mistake that broke crucial functions for the end user/victim
✍️ How I could have hijacked a victim’s YouTube notifications! (Google VRP Writeup)
✍️ [ Writeup — Bugbounty Facebook ] Disclosure the verified phone number in Checkpoint.
✍️ Brand-new prototype pollution gadget in MongoDB leading to RCE
✍️ Fastest Fix on Open Bug Bounty Platform
✍️ Self-XSS to Stored XSS
✍️ Bypassing 403 Protection To Get Pagespeed Admin Access
✍️ Full Disclosure - DOM-based XSS And Failures In Bug Bounty Hunting
✍️ [web3] Exploiting Signature Verification Vulnerabilities in Smart Contracts | by Heuss | Jan, 2024 | Medium
✍️ Who Contains the Containers?
✍️ XXE with Auto-Update in install4j
✍️ How Misconfigured API leaked user private information?
✍️ DMCA.COM Hack, Full Disclosure (With Proof-of-Concept)
✍️ DOS attack in Yahoo, How i was able to deny new users from service?
✍️ Recon and YouTube
✍️ Workplace by Facebook | Unauthorized access to companies environment — $27,5k
✍️ Worldwide Server-side Cache Poisoning on All Akamai Edge Nodes ($50K+ Bounty Earned)
✍️ Self-XSS + CSRF to Stored XSS
✍️ Bypassing the macOS Gatekeeper
✍️ Reflected Swf XSS at ( https://plugins.svn.wordpress.org )
✍️ Viewing Instagram live streams anonymously without notifying the host
✍️ Exploiting Web3’s Hidden Attack Surface: Universal XSS on Netlify’s Next.js Library
✍️ Google Bug: Posting on groups as any user’s behalf
✍️ How We Escaped Docker in Azure Functions
✍️ Advisory: security issues in AWS KMS and AWS Encryption SDKs
✍️ New Wine in Old Bottle - Microsoft Sharepoint Post-Auth Deserialization RCE (CVE-2022-29108)
✍️ From Response To Request, Adding Your Own Variables Inside Of GraphQL Queries For Account Take Over
✍️ Dangling DNS: Amazon EC2 IPs (Current State)
✍️ Spring Boot RCE
✍️ An XSS Story
✍️ Ubisoft | Blind XSS to customer support panel takeover
✍️ Groovy Template Engine Exploitation – Notes from a real case scenario
✍️ Leveraging ssh-keygen for Arbitrary Execution (and Privilege Escalation)
✍️ How I bypassed website using Akamai waf
✍️ HTTP Parameter Pollution - It’s Contaminated
✍️ "A tale of making internet pollution free" - Exploiting Client-Side Prototype Pollution in the wild
✍️ How i was able to dump SqlDB | Simple bug
✍️ Kirby < 3.9.6 XML External Entity (XXE) vulnerability — CVE-2023-38490
✍️ Subdomain takeover [Awarded $200]
✍️ How I Got $10,000 From GitHub For Bypassing Filtration of HTML tags
✍️ A New Attack Surface on MS Exchange Part 4 - ProxyRelay!
✍️ Account Takeover Through Password Reset Poisoning
✍️ Client Side Desync Attack (CL.0 Request Smuggling) — Bounty of $150
✍️ Airbnb – Chaining Third-Party Open Redirect into Server-Side Request Forgery (SSRF) via LivePerson Chat
✍️ This is how can I spoof ANY Sentry.Io log infinitely and create fake error-logs
✍️ How I was able to list some internal information from PayPal #BugBounty
✍️ AWS WAF Clients Left Vulnerable to SQL Injection Due to Unorthodox MSSQL Design Choice
✍️ Group Admin Can’t Able to Moderate Comments When Posted Through Page : Facebook Bug Bounty 2020
✍️ How I found 5 store XSS on a private program. Each worth "1,016.66$"
✍️ Why I paid 3.5K to become a TLD registrar reseller when doing bug bounty
✍️ $10.000 bounty for exposed .git to RCE
✍️ [web3] Low bug in Warden Swap found by ABDul Rehman worth 1k
✍️ Google Acquisition XSS (Apigee)
✍️ Broken Access Control & Stored XSS - Easy Hunt
✍️ Remote Deserialization Bug in Microsoft's RDP Client through Smart Card Extension (CVE-2021-38666)
✍️ How I hacked Vending Machine
✍️ Exploiting Admin Panel Like a Boss
✍️ How I was able to bypass the current password?
✍️ Unauthd - Logic bugs FTW
✍️ Auth Bypass Via Exposed Credentials
✍️ External XML Entity via File Upload (SVG)
✍️ Reflected XSS Moogaloop SWF ( Version < 6.2.x )
✍️ Admin Panel? Pwned!
✍️ Keybase App Vulnerability: Incomplete Cleanup of Messages In Keybase for Android/iOS, CVE-2021-34421
✍️ Crashing Industrial Control Systems at Pwn2Own Miami 2022
✍️ Mitigating RBAC-Based Privilege Escalation in Popular Kubernetes Platforms
✍️ Flash XSS in ajax.googleapis.com
✍️ Hacking Unity Games with Malicious GameObjects
✍️ Fixed : Register any email address on Facebook Account
✍️ Sign-in with World ID: XSS and ATO via OIDC Form Post Response Mode
✍️ [BugTales] UnZiploc: From 0-click To Platform Compromise
✍️ SharePoint Webpart Property Traversal Vulnerability Analysis (CVE-2022–38053, CVE-2023–21742, CVE-2023–21717)
✍️ [CVE-2022-34918] A crack in the Linux firewall
✍️ Improper error handling leads to exposing internal tokens
✍️ More secure Facebook Canvas Part 2: More Account Takeovers
✍️ Game On – Finding vulnerabilities in Valve’s “Steam Sockets”
✍️ Story of a Parameter Specific XSS!
✍️ 3 Symfony (RCE): A Peek Behind the Curtain
✍️ Exploit Disclosure: Turning Thunderbird into a Decryption Oracle
✍️ Vulnerability in Hangouts Chat: from open redirect to code execution
✍️ Bug: Cisco IOS SNMPv3 ACL Issues
✍️ Google SSO misconfiguration leading to Account Takeover
✍️ Vocera Report Server Pwnage
✍️ Unsecured Content Provider leads to Account Takeover
✍️ Account Takeover Using CSRF(json-based)
✍️ What an injection into jQuery-selector can lead to
✍️ How I Hacked the Microsoft Outlook Android App and Found CVE-2019-1105
✍️ [Yahoo Bug Bounty] Unauthorized Access to Unisphere Management Server Debugging Facility on https://bf1-uaddbcx-002.data.bf1.yahoo.com/Debug/
✍️ for PayPal security team,“get user balances and transaction details” is not a vulnerability!
✍️ Generate online votes using Race Condition Vulnerability in Woobox Web Application (Write Up)
✍️ Story of a weird CSRF bug
✍️ Inside the Black Box | How We Fuzzed Microsoft Defender for IoT and Found Multiple Vulnerabilities
✍️ Secret Input Header leads to Password Reset Poisoning
✍️ Bypass Chrome Ad-Heavy detection mechanism
✍️ Stories Of IDOR
✍️ OTP Manipulation
✍️ Remote Code Execution in Google Cloud Dataflow
✍️ How I was able to pwned 30000+ user’s webhook
✍️ Hacking into a Toyota/Eicher Motors insurance company by exploiting their premium calculator website
✍️ Medium Content Spoofing Leads to XSS
✍️ Manage Engine OpManager Multiple Authenticated RCE Vulnerabilities
✍️ One Bug To Rule Them All: Modern Android Password Managers and FLAG_SECURE Misuse
✍️ Taking over Facebook accounts using Free Basics partner portal
✍️ Forcing for a bounty$$
✍️ [Still work] Redirect Yahoo Subdomain XSS Reflected from americangreetings.com
✍️ RCE in GitHub Desktop < 2.9.4
✍️ [UNPATCHED] Cli: gh run download implementation allows overwriting git repository configuration upon artifacts downloading
✍️ TikTok Careers Portal Account Takeover
✍️ Stored XSS on Zendesk via Macro’s PART 2
✍️ Apple TV for Fire OS code execution
✍️ Cleartext password in LocalStorage (Writeup)
✍️ SSD Advisory – Apple Safari ICU Out-Of-Bounds Write
✍️ CVE-2023-35150: Arbitrary Code Injection In XWiki.Org XWiki
✍️ Authorization bug that every bug hunter missed on a popular program
✍️ How does my recon win $250 in 15 minutes
✍️ Github Secrets exposed due to RCE in Formatter Action from pull_request_target event
✍️ ModSecurity: Path Confusion and really easy bypass on v2 and v3
✍️ Chromium: Same Origin Policy bypass within a single site a.k.a. "Google Roulette"
✍️ Subdomain Takeover Through Expired Cloudfront Distribution | live.lamborghini.co
✍️ Fixing Typos And Breaching Microsoft’s Perimeter
✍️ Back To School - Exploiting A Remote Code Execution Vulnerability In Moodle
✍️ Blind-XSS in Chrome Experiments - Google (Write Up)
✍️ DownNotifier SSRF
✍️ [web3] Critical bug in Polkadot Frontier EVM found by pwning.eth worth 1M
✍️ Hacking into the worldwide Jacuzzi SmartTub network
✍️ BlackBerry MDM Has Some Authentication Flaws
✍️ $3K Bounty For Elastic-Search Takeover
✍️ reCAPTCHA Exploits
✍️ Always escalate! From Self-XSS to Persistent XSS on Login Portal
✍️ HUNT for SQL Injection- The Smart Way!
✍️ Fuzzing Microsoft's RDP Client using Virtual Channels: Overview & Methodology
✍️ Contact Point Deanonymization Vulnerability in Meta
✍️ Transforming a Domain into the Matrix (an open redirect story)
✍️ SSRF on a Headless Browser Becomes Critical!
✍️ [web3] Axelar Network Cross-Chain Halt Vulnerability
✍️ How I got Reflected Cross Site Scripting(RXSS) on Manchester Metropolitan University
✍️ Bragging Rights: Let’s head back to bug bucket
✍️ Advisory | NetModule Router Software Race Condition Leads to Remote Code Execution
✍️ How I managed to trigger XSS automatically to get critical account takeover
✍️ Uncursing the ncurses: Memory corruption vulnerabilities found in library
✍️ Think Outside the Scope: Advanced CORS Exploitation Techniques
✍️ SSRF & Google HOF(Hall of Fame)
✍️ Visual Studio Code Jupyter Notebook RCE
✍️ Bypassing browser tracking protection for CORS misconfiguration abuse
✍️ XSS Is Love <3 !
✍️ CVE-2021-2471 MySQL JDBC XXE
✍️ Bug Bounty: Bypassing a crappy WAF to exploit a blind SQL injection
✍️ Facebook PageAnalyst Could Add oneself as Moderator on Group
✍️ Oh-Auth - Abusing OAuth to take over millions of accounts
✍️ [web3] Cronos Gravity Bridge Bugs
✍️ Using URI to pop shells via the Discord Client
✍️ [web3] Enzyme Finance Price Oracle Manipulation Bug Fix Postmortem. This is a postmortem of a vulnerability… | by Immunefi | Nov, 2021 | Medium
✍️ How I was able to buy t-shirt for €1 — Payment Price Manipulation
✍️ How I Get my first P1 (Sensitive Information Disclosure) using WPScan
✍️ MeshCentral Cross-Site Websocket Hijacking Vulnerability (CVE-2024-26135)
✍️ Facebook Bug bounty Story: $X000 for an Information Disclosure Bug
✍️ Deleted data stored permanently on Instagram? Facebook Bug Bounty 2020
✍️ Facebook DOM Based XSS using postMessage
✍️ CSRF Protection Bypass in Atlassian Confluence Server
✍️ Cacti: Unauthenticated Remote Code Execution
✍️ Alternative link
✍️ Bugbounty | A Dom Xss
✍️ P1: Critical - Discovering and Foiling a Threat Actor
✍️ How I became a millionaire in 3h | Fintech Bug Bounty — Part 1
✍️ Reflected XSS Through Insecure Dynamic Loading
✍️ urlscan.io's SOAR spot: Chatty security tools leaking private data
✍️ Discovering Headroll (CVE-2023–0704) in Chromium
✍️ Finding Initial Access on a real life Penetration Test
✍️ CVE-2021-39246 – Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack excessive verbose logging – Windows, macOS, Linux
✍️ From Zero to Hero Part 2: From SQL Injection to RCE on Intel DCM (CVE-2022-21225)
✍️ Silver Peak Unity Orchestrator RCE
✍️ A phishing document signed by Microsoft – part 1
✍️ challenge writeup content-type shenanigans
✍️ All your parcel are belong to us – Talk at Troopers 2023
✍️ Broken Link Hijacking — 404 Google Play Store— xxx$ Bounty
✍️ HigherLogic Community RCE Vulnerability
✍️ A simple post auth bypass leads to unauthorized web server access
✍️ CVE-2018-9539: Use-after-free vulnerability in privileged Android service
✍️ My Weirdest Bug Bounty — Getting PII from O365.
✍️ Prototype Pollution in xml2js
✍️ Just 5 minute to get my 2nd stored XSS on Edmodo.com
✍️ Remote Code Execution – LimeSurvey (CVE-2018-7556)
✍️ Analysis of CVE-2019-14994 – Jira Service Desk Path Traversal leads to Massive Information Disclosure
✍️ LOLBINed — Finding “LOLBINs” In AV Uninstallers
✍️ IDOR Vulnerability: A Journey to Full Account Takeover
✍️ A QUIC Shutdown: DoS Vulnerability in Windows Servers Running SMB over QUIC
✍️ CVE-2022-40300: SQL Injection In Manageengine Privileged Access Management
✍️ Amazon Quickly Fixed A Vulnerability In Ring Android App That Could Expose Users’ Camera Recordings
✍️ Pwn2Own Miami: Aveva Edge Arbitrary DLL Loading Vulnerability
✍️ CrossTalk and Secret Agent: Two Attack Vectors on Okta's Identity Suite
✍️ How i found credential enriched redis dump
✍️ Chaining rate limiting for account lockout
✍️ Google Chrome portal element fuzzing
✍️ Pwning Microsoft Azure Defender for IoT | Multiple Flaws Allow Remote Code Execution for All
✍️ Part-I
✍️ Facebook iOS address bar spoofing
✍️ MongoDB NoSQL Injection with Aggregation Pipelines
✍️ How I hacked one cryptocurrency service
✍️ The Untold SendBird Misconfigurations
✍️ Obtaining XSS Using Moodle Features and Minor Bugs
✍️ A Bug's Life: CVE-2021-21225
✍️ Fuzzing Till
✍️ Teleport Security Whitepaper - Practical Analysis of and Hardening Against Compromised IdP Scenarios
✍️ Blind SSRF on coda.io
✍️ Automating reflected XSS with burp-suite Intruder
✍️ The Story of My first 4 digit bounty from Facebook
✍️ 2FA Bypass via Basic Authentication on private bug bounty program
✍️ How Private Cache Can Lead to Mass Account Takeover – pentest case
✍️ npm search RCE? - Escape Sequence Injection
✍️ Identity Crisis: The Curious Case of a Delinea Local Privilege Escalation Vulnerability
✍️ Pwning Admin Panel To Change Movie Ticket Prices at Disney
✍️ Generate valid signatures for FBCDN urls
✍️ I helped a top Indian health benefits management platform from major PII leak by hacking their SQL Servers, AWS instance, DCs etc.
✍️ Story about Escalation of HTML Injection to EC2 Instance credentials leak
✍️ [web3] Crit: Compound Liquidators May Seize Assets Not Held As Collateral (Closed as Known Issue) | Trust
✍️ CVE-2020-9964 - An iOS infoleak
✍️ Judge0 Sandbox Escape
✍️ SQL injection through User-Agent
✍️ SSD Advisory – Cisco Secure Manager Appliance remediation_request_utils SQL Injection Remote Code Execution
✍️ Android Browser Same Origin Policy Bypass < 4.4 - CVE-2014-6041
✍️ API Misconfiguration which leads to unauthorized access to servicedesk tickets
✍️ How I Earned $750 Bounty Reward From AT&T bug Bounty -Adesh Kolte
✍️ Breaking Business Logic - Part: 2^7 = 1
✍️ Remote ASLR Leak in Microsoft's RDP Client through Printer Cache Registry (CVE-2021-38665)
✍️ An unknown Linux secret that turned SSRF to OS Command injection
✍️ Some Tips to Finding IDORs more easily and Fixing them
✍️ CVE-2023–0759 / Privilege Escalation in the Cockpit CMS
✍️ iCloud XXS’ed
✍️ Multiple vulnerability leading to account takeover in TikTok SMB subdomain.
✍️ How 100% Manual Hacking (Without Even Kali And Burp) Led To 2 Medium Vulnerabilities On YesWeHack
✍️ This Man Thought Opening A TXT File Is Fine, He Thought Wrong. MacOS CVE-2019-8761
✍️ Another Tale Of IBM I (AS/400) Hacking
✍️ Can't Wait to Shut You Down — Remote DoS Using Wininit.exe
✍️ Remote Code Execution in Spotify’s Backstage via vm2 Sandbox Escape (CVSS Score of 9.8)
✍️ Bypassing CORS
✍️ Medium Full Account Takeover By One Click
✍️ HackerOne redacted usernames disclosure in “Export as .pdf” feature
✍️ Executing Arbitrary Code & Executables in Read-Only FileSystems
✍️ Posting on groups as people whenever their email was known by an attacker
✍️ How I Found multiple SQL Injection with FFUF and Sqlmap in a few minutes
✍️ Uploading the Webshell using filename of Content-Disposition Header Story!
✍️ draw.io CVEs
✍️ Uber Bug Bounty: 1000$ for two “high severity” issue
✍️ PHP Development Server <= 7.4.21 - Remote Source Disclosure
✍️ bypass user-restriction registration
✍️ Exploiting Redash instances with CVE-2021-41192
✍️ Directory traversal in PDF viewing application. Leading to full database takeover
✍️ Cloudflare WAF XSS
✍️ Bitwarden Heist - How To Break Into Password Vaults Without Using Passwords
✍️ Intigriti XSS Challenge July 2024 — Finding a new DOMPurify bug
✍️ Privileged Escalation in Facebook Messenger Rooms
✍️ suPHP - The vulnerable ghost in your shell🎯Business Logic Flaw in Google Acquisition! (Hall Of Fame)🎯
✍️ How to get RCE on AEM instance without Java knowledge
✍️ Alternative link
✍️ XSS in WordPress via open embed auto discovery
✍️ Yahoo Small Business (Luminate) and the Not-So-Secret Keys
✍️ Hacking GitHub with Unicode’s dotless ‘i’
✍️ Cache Poisoning at Scale
✍️ How to hunt for Malvertising ads on Android
✍️ Reveal the page admin that uploaded a video on the page in comment section
✍️ Weird (im)possible XSS on error page
✍️ How to do 55.000+ Subdomain Takeover in a Blink of an Eye
✍️ Tarfile: Exploiting the World With a 15-Year-Old Vulnerability
✍️ Windows Kernel: Exploit CVE-2022-35803 in Common Log File System
✍️ How I could have hacked your Uber account
✍️ IDOR in session cookie leading to Mass Account Takeover
✍️ Blind XSS via SMS Support Chat — $1100 Bug Bounty!
✍️ DOM Based XSS In AVG
✍️ ProtoBuffer ReUtilization “New Way to Security Test GoogleCaptcha”
✍️ Worth $1,500 IDOR (Access Unauthorize Data)
✍️ Cache Me If You Can: Local Privilege Escalation in Zscaler Client Connector (CVE-2023-41973)
✍️ Ray, Versions 2.6.3, 2.8.0
✍️ Race Condition that could Result to RCE - (A story with an App that temporary stored an uploaded file within 2 seconds before moving it to Amazon S3)
✍️ My story of hacking Dutch Government
✍️ Cache Deception Without Path Confusion
✍️ XSS in hidden input fields
✍️ Dank Writeup On Broken Access Control On An Indian Startup
✍️ How “I hacked the Dutch government and got the lousy t-shirt”
✍️ A 7500$ Google sites IDOR
✍️ Beware of Java's String.getBytes
✍️ Crazy Simple Insecure Design & 300$ Bounty!
✍️ ICloud.com DOM-Based XSS! #BugBounty
✍️ Page Admin Disclosure when Posting a Reel
✍️ Defeating Length Filters to Dump the Database - SQLi
✍️ RCE in Ruby using Mustache Templates
✍️ Okta Response to Security Report
✍️ Van1338: Design Flaw in Riot Vanguard: $6,000
✍️ Information Exposure — My Fourth Finding on Hackerone!
✍️ URL Validation Bypass Using Browser URI Normalization
✍️ Finding Hidden Threats: How I Found Leaked AWS Credentials in an Android App API Using DAST
✍️ 13 Nagios Vulnerabilities, #7 will SHOCK you!
✍️ Partial File Read in phpList <= 3.6.12 (CVE-2023-35834)
✍️ Interesting Stored XSS in sandboxed environment to Full Account Takeover
✍️ Opinions are like Bugs - Every Spec has one.
✍️ LFI to Command Execution: Deutche Telekom Bug Bounty
✍️ From Host Header injection to SQL injection
✍️ This is how i was able to Permanently Crash all Mapillary users within minutes
✍️ Svg XSS in Unifi v5.0.2
✍️ How I got Two RCE at EPAM-Bounty Program
✍️ Hertzbleed Attack
✍️ From Multiple IDORs leading to Code Execution on a different Host Container
✍️ weird bug using fake id via photoshop worth $***
✍️ Non-persistent XSS at Microsoft -Adesh Kolte
✍️ CVE-2024-20693: Windows cached code signature manipulation
✍️ Google Cloud Blog platform vulnerability
✍️ How I get an easy Blind SSRF by just reading writeups
✍️ How I was able to Bypass Philips Authentication
✍️ Server Side Request Forgery - A Forged Document
✍️ Some critical vulnerabilities found with passive analysis on bug bounty programs explained
✍️ Worth $1,500 IDOR (Access Unauthorize Data)
✍️ Abusing HTTP Path Normalization and Cache Poisoning to steal Rocket League accounts
✍️ Breaking Appointments and Job Interview Schedules With Malformed Times
✍️ How I hacked Google to read files from their servers for free!
✍️ How I get +10 SQLi and +30 XSS via Automation Tool
✍️ Facebook BugBounty : Short story on Page admin disclosure
✍️ Account Takeover via IDOR
✍️ How I upgraded my privileges to the administrator of Odnoklassniki’s url shortener
✍️ Dox Facebook Employees Behind “Did You Know” Questions
✍️ How Inspect Element Got me a Bounty
✍️ Leaking ObjRefs to Exploit HTTP .NET Remoting
✍️ Fickle PDFs: exploiting browser rendering discrepancies
✍️ Cache Poisoning via SelfXSS + Path Parameter
✍️ Gaining access to protected components
✍️ How I could have compromised any account on one of the biggest startup based in California
✍️ BreakingApp – WhatsApp Crash & Data Loss Bug
✍️ Full account takeover vulnerability in Minecraft
✍️ Cookie-based-injection XSS making exploitable with-out exploiting other Vulns
✍️ How I accidentally found Bug in Google Search Console
✍️ Password Reset Token Leak Via Referrer
✍️ Token Brute-Force to Account Take-over to Privilege Escalation to Organization Take-Over
✍️ When Equal is Not, Another WebView Takeover Story

Frequently Asked Questions

The following are frequently asked questions about common vulnerabilities and security misconfigurations found during bug bounty hunting. Understanding these concepts is crucial for anyone starting their bug hunting journey.

What is an XSS vulnerability? Cross-Site Scripting (XSS) attacks are a type of injection attack in which malicious scripts are inserted into otherwise trustworthy and innocuous websites. XSS attacks occur when an attacker uses a web application to send malicious code to a particular end user, usually in the form of a browser side script. The flaws that enable these attacks to succeed are common and can be found wherever a web application uses input from a user within the output it generates without validating or encoding it.

There are mainly 3 types of XSS:

What is an IDOR vulnerability? When a web application or API exposes a reference to an internal implementation object, it is referred to as Insecure Direct Object Reference (IDOR). This method exposes the element's true identifier and the data format it uses. This is a common access control flaw.

An example would be an API that gives you access to data belonging to other users, through an endpoint - /api/users/:id where an attacker can fetch data of any user by manipulating the id parameter.
What is an SSRF vulnerability? In a Server-Side Request Forgery (SSRF) attack, the attacker can read or update internal resources by abusing server features. The attacker may supply or change a URL to which the server's code can read or send data, and by carefully choosing the URLs, the attacker might be able to read server configuration such as AWS metadata, connect to an internal service, or access sensitive files.
What is a SQLi vulnerability? A SQL injection attack involves inserting or "injecting" a SQL query into the application through the client's input data. An effective SQL injection exploit can read sensitive data from the database, alter database data (Insert/Update/Delete), and even perform database administration operations.
What is an RCE vulnerability? If user input is inserted into a File or a String and then executed (evaluated) by the backend programming language's parser, a remote code execution (RCE) vulnerability can be exploited. A Remote Code Evaluation will result in the entire web application and web server being compromised as it allows an attacker to execute arbitrary commands on the server.
How can I reach you? If you have any feedback or, concerns about this site, I can be reached on Twitter.