>

🚀 We've added new community writeups and a Web3 section! Click here to see what's new.

🐛 Bug Bounty Hunting Search Engine

Made with ❤️ by @payloadartist
NEW
Example search: http://bugbountyhunting.com/?q=keyword
Showing 1337 random writeups. Use the search bar to find more.
✍️ Multiple Vulnerabilities in Fortra Globalscape EFT Administration Server [FIXED]
✍️ Inf0rM@tion Disclosure via IDOR
✍️ Cloning internal Google repos for fun and… info?
✍️ Web application firewall bypass
✍️ Google Security Misconfiguration Leads to Account Takeover !
✍️ New Clubhouse Security Vulnerabilities Could Happen to Any Growing Unicorn
✍️ Prototype Pollution in fast-xml-parser
✍️ Blind OS Command Injection via Activation Request
✍️ Disclose internal CMS objects content
✍️ Traeger Grill D2 Wi-Fi Controller, Version 2.02.04
✍️ Cache Deception: How I discovered a vulnerability in Medium and helped them fix it
✍️ iPhone Camera Hack
✍️ How I Managed to Create Unauthorized Comments on Facebook Live Stream
✍️ The Confused Mailman: Sending SPF and DMARC passing mail as any Gmail or G Suite customer
✍️ Tokopedia Account Takeover Bug Worth 8 Million IDR
✍️ Hacking the Subway Android app
✍️ Listing all registered email addresses on Google’s Crisis Map thanks to IDOR and incremental IDs
✍️ How I Hacked Microsoft Teams and got $150,000 in Pwn2Own
✍️ How I get an easy Blind SSRF by just reading writeups
✍️ 500$ Bounty in just 5 minutes through Recon!!!!
✍️ Weird and very easy authentication bypass found with Google dorking
✍️ Flask Security
✍️ How i Found Information Disclosure on Scribd.com
✍️ Blind SSRF in URL Validator
✍️ Story of YouTube’s Unfixable Ads Bypass
✍️ AWS Chain Attack- Thousands of Vulnerable EKS Clusters
✍️ Elevation of privileges from Everyone through Avast Sandbox to System AmPPL (CVE-2021-45335, CVE-2021-45336 and CVE-2021-45337)
✍️ Remote code execution On Microsoft edge using URL Protocol
✍️ The Short tale of two bugs on Google Cloud Product— Google VRP [Resolved]
✍️ Hunting for bugs in VMware: View Planner and vRealize Business for Cloud
✍️ Vulnerability in Dahua’s ONVIF Implementation Threatens IP Camera Security
✍️ Facebook Business Takeover
✍️ Page Admin Disclosure | Facebook Bug Bounty 2019
✍️ Your Vulnerability Is In Another OEM!
✍️ RCE in Citrix ShareFile Storage Zones Controller (CVE-2021-22941) – A Walk-Through
✍️ Metadata service MITM allows root privilege escalation (EKS / GKE)
✍️ Disclose contact_email of any Facebook application
✍️ Hacking my “smart” toothbrush
✍️ A Misconfiguration in techprep.fb.com REST API allowed me to modify any user profile.
✍️ CVE-2022-21587 (Oracle E-Business Suite Unauthenticated RCE)
✍️ Microsoft’s first bug
✍️ Blog: OmniSpace, from automated 0day XSS to RCE
✍️ Dodging OAuth origin restrictions for Firebase spelunking
✍️ This domain is my domain — G Suite A record vulnerability
✍️ [Still work] Redirect Yahoo Subdomain XSS Reflected from americangreetings.com
✍️ Hacking Facebook Pages
✍️ Android: Exploring vulnerabilities in WebResourceResponse
✍️ [SSRF] Server Side Request Forgery in a private Program developers.example.com
✍️ How I Tracked You Around The Globe 🌎
✍️ So you found Auth0 secrets, now what?
✍️ $10,000 for automatic email confirmation bug in Microsoft's Edge browser
✍️ Support supports a Hacker
✍️ [web3] Medium bug in OpenZeppelin found by Daniel Cohen Hillel
✍️ Full Account Take Over by very simple trick.
✍️ How I snooped into your private Slack messages [Slack Bug bounty worth $2,500]
✍️ SSD Advisory – Apple Safari IDN URL Spoofing
✍️ How I got $200 in 30 Seconds.
✍️ HackerOne report
✍️ Dynamic Linking Injection and LOLBAS Fun
✍️ [SSRF] Server Side Request Forgery in a private Program developers.example.com
✍️ Windows Installer EOP (CVE-2023-21800)
✍️ Sorry, ChatGPT Is Under Maintenance: Persistent Denial of Service through Prompt Injection and Memory Attacks
✍️ How I access other domains in infinityfree.net using Directory Traversal
✍️ IDOR - Inside the Session Storage
✍️ Revisiting OMI: Analysis of CVE-2022-29149, a privilege escalation vulnerability in Azure OMI
✍️ Gaining Unlimited access to graph AuditLogs endpoint using complex filters with non-privileged user account
✍️ 5,000 USD XSS Issue at Avast Desktop AntiVirus for Windows (Yes, Desktop!)
✍️ Rediscovering Epic Games 0-Days (Forever Unpatched?)
✍️ Sysdreams
✍️ XSSing Google Employees — Blind XSS on googleplex.com
✍️ Remote Code Execution (RCE) on Microsoft’s ‘signout.live.com’
✍️ Disclose leads form details of any Facebook Business Account or Facebook Page (Bug Bounty)
✍️ Reveal if a Facebook merchant page has pending or completed orders.
✍️ A Simple bypass of Registration Activation that Lead to many Bug -
✍️ Zero click vulnerability in Apple’s macOS Mail
✍️ How I was able to reveal page admin of almost any page on Facebook
✍️ XSS, RCE & HTML File Upload in same endpoint
✍️ A Five Minute SQL-I
✍️ From Google Dorking to Information Disclosure
✍️ Leveraging LFI to RCE in a website with +20000 users
✍️ Stranger Strings: An exploitable flaw in SQLite
✍️ How I Hacked Facebook Again! Unauthenticated RCE on MobileIron MDM
✍️ How I bypassed 2 Factor Authentication
✍️ SQL Injection - The File Upload Playground
✍️ Header spoofing via a hidden parameter in Facebook Batch GraphQL APIs
✍️ Technical Analysis of CVE-2022-22583: Bypassing macOS System Integrity Protection (SIP)
✍️ Hacking Admin Panel & Getting free subscription
✍️ Exploiting a Seagate service to create a SYSTEM shell (CVE-2022-40286)
✍️ Static Taint Analysis Using Binary Ninja: A Case Study Of MySQL Cluster Vulnerabilities
✍️ Performance, Diagnostics, and WMI
✍️ Unique Case for Price Manipulation | BugBounty | VAPT
✍️ What’s in a Name? Writing custom DNS tunnelling protocol, exploiting unexpected AWS Lambda misconfiguration – in a web app Pen test (Part 1)
✍️ Disclose page’s admins and its Monetization payout details
✍️ Rate Limit Bypass Leads to 0 Click ATO
✍️ Hijacking shared report links in Google Data Studio
✍️ CVE-2023-33733 RCE via HTMLi in reportlab
✍️ CVE-2016-3473
✍️ How I Found Multiple Bugs On FaceBook In 1 Month And a Part For My Methodology & Tools
✍️ Leaking ObjRefs to Exploit HTTP .NET Remoting
✍️ Cracking my windshield and earning $10,000 on the Tesla Bug Bounty Program
✍️ How I found XSS via SSRF vulnerability -Adesh Kolte
✍️ How I got Two RCE at EPAM-Bounty Program
✍️ [web3] High bug in Vesu found by kankodu
✍️ How I made 1000$ with AT&T Bug Bounty(H1)
✍️ How I hacked Apple.com (Unrestricted File Upload)
✍️ PII Disclosure Worth $750
✍️ How I was able to delete any image in Facebook community question forum
✍️ Misconfiguration of Demographics Privacy in a Page
✍️ From Recon to Bypassing MFA Implementation in OWA by Using EWS Misconfiguration
✍️ Remote Code Execution Vulnerability in Google They Are Not Willing To Fix
✍️ Mobile OAuth Attacks - iOS URL Scheme Hijacking Revamped
✍️ How Did I Leak 5.2k Customer Data From a Large Company? (via Broken Access Control)
✍️ Injecting {{6*200}} to $1200
✍️ How to hunt for Malvertising ads on Android
✍️ The Story of My first 4 digit bounty from Facebook
✍️ CORS Misconfiguration to Account TakeOver [Out of scope to grab items In-Scope]
✍️ SSD Advisory – pfSense Post Auth RCE
✍️ Critical vulnerability on TP-Link service or how I got 0$
✍️ Google adwords 3133.7$ Stored XSS
✍️ XSS by Javascript Overriding
✍️ Plan Change Logic in Google Fiber (Webpass)
✍️ How I was able to get account takeover via IDOR form JWT
✍️ How i get $100 in just 10 minutes !
✍️ The Art of Intrusion: File Upload Bypass & WAF XSS Evasion in AWS S3 Demystified
✍️ CVE-2014-7216: A Journey Through Yahoo’s Bug Bounty Program
✍️ [GraphQL IDOR]Leaking credit card information of 1000s of users
✍️ Abusing Client-Side Desync on Werkzeug
✍️ Server-side Template Injection Leading to RCE on Google VRP
✍️ Github Secrets exposed due to RCE in Formatter Action from pull_request_target event
✍️ Bypassing WAF for $2222
✍️ CVE-2023-20864: Remote Code Execution In VMware Aria Operations For Logs
✍️ P1 Vulnerability in 60 seconds
✍️ Exploiting stale ADIDNS entries
✍️ Repo Jacking: The Great Source-code Swindle
✍️ Finding Multiple Security Issues on Agorapulse
✍️ How I turned 0000 into $600: Phone Verification Bypass
✍️ EN | Account Takeover via Web Cache Poisoning based Reflected XSS
✍️ OMGCICD - Attacking GitLab CI/CD Via Shared Runners
✍️ Subdomain Takeover Through Expired Cloudfront Distribution
✍️ Threat Alert: Private npm Packages Disclosed via Timing Attacks
✍️ How I was able to takeover the company’s LinkedIn Page
✍️ A Developer's Nightmare Part-2
✍️ Blind XSS To SSRF
✍️ Foxit PDF Reader - Use after Free - Remote Code Execution Exploit - CVE-2022-28672
✍️ Account takeover by OTP bypass
✍️ Facebook Vulnerability – a “Cute Bug” that reveals the “likes” of deleted posts regardless of their privacy settings
✍️ IDOR leads to account takeover
✍️ Subdomain Takeover: How a Misconfigured DNS Record Could Lead to a Huge Supply Chain Attack
✍️ You do not need to run 80 reconnaissance tools to get access to user accounts
✍️ How Orca Found Server-Side Request Forgery (SSRF) Vulnerabilities in Four Different Azure Services
✍️ Bypassing Safe Links in Exchange Online Advanced Threat Protection
✍️ KeePass Triggers Are Dead, Long Live KeePass Triggers!
✍️ Getting Root - A Technical Walkthrough
✍️ PoC
✍️ Web Cache Deception Attack leads to user info disclosure
✍️ The story of how I was able to chain SSRF with Command Injection Vulnerability
✍️ Every XSS is different
✍️ Vimeo SSRF with code execution potential.
✍️ Auth Issues
✍️ Unauthorized Access to OData Entities + $2K Bounty From Microsoft
✍️ CVE-2022-31813: Forwarding Addresses Is Hard
✍️ Injecting Punycode URL Within the Arbitrary Text via Comment Box In Google Photo Sharing Option
✍️ How I Could Have Hacked Any Instagram Account
✍️ How i was able to dump SqlDB | Simple bug
✍️ I got emails - G Suite Vulnerability
✍️ Taking Over Employee Accounts by Managers with Zero Employee Interaction
✍️ Navigating the Sea, Exploiting DigitalOcean APIs
✍️ Self (XSS) on [komunitas.bukalapak.com]
✍️ Let’s know How I have explored the buried secrets in React Native application
✍️ Accessing 2 million Verizon Pay Monthly contracts
✍️ I found 2 Zero-Days in popular Linux distros that includes Mint, Kali, Parrot
✍️ How spending our Saturday hacking earned us 20k
✍️ Weak Password Setting function on practo.com
✍️ Facebook account takeover due to a bypass of allowed callback URLs in the OAuth flow
✍️ We Hacked Ourselves With DNS Rebinding
✍️ The $12,000 Intersection between Clickjacking, XSS, and Denial of Service
✍️ NTLM Credential Theft in Python Windows Applications
✍️ Brocade Fabric OS ≤ v8.0.2c rbash escape to read system files
✍️ Curesec article
✍️ [No Bounty] Git Exposed: How a Government Website Left Its Secrets Open | by Sachin Kewat
✍️ Effortlessly finding Cross Site Script Inclusion (XSSI) & JSONP for bug bounty
✍️ Chaining for Critical: Unauthorized to Cloud Administrator
✍️ How I Was Able To See The Bounty Balance Of Any Bug Bounty Program In HackerOne
✍️ Disclose WhatsApp Number of Instagram Accounts Despite Setting Set to be Hidden
✍️ 2FA Bypass via Forced Browsing
✍️ 5 Ways to do Account Takeover in a Single Website
✍️ Captcha Bypass Techniques | by Akshat Honey
✍️ How ChatGPT helped me find a bug
✍️ The forgotten IPFS vulnerabilities
✍️ Apache SCXML Remote Code Execution
✍️ Attack Surface Analysis - Part 3 - Resurrected Code Execution
✍️ Magic XSS with two parameters
✍️ Unique Rate limit bypass worth 1800$
✍️ Hey UserID x, what’s your secret token? Broken API enables me to leak/modify any users personal information
✍️ Reveal the page admin that uploaded a video on the page in comment section
✍️ How I Found CVE-2018-8819: Out-of-Band (OOB) XXE in WebCTRL
✍️ CVE-2023-33298 - Perimeter81 Local Privilege Escalation
✍️ Supply Chain Attacks: A New Era
✍️ Hidden in Plain Sight: Uncovering RCE on a Forgotten Axis2 Instance
✍️ CVE-2023–0759 / Privilege Escalation in the Cockpit CMS
✍️ How I downed acronis.com in 2 minutes — Lucky bug write up
✍️ Internshala Bug in Internshala Student Partner
✍️ Gotta cache 'em all: bending the rules of web cache exploitation
✍️ IDOR at Login function leads to leak user’s PII data
✍️ "CI Knew There Would Be Bugs Here" — Exploring Continuous Integration Services as a Bug Bounty Hunter
✍️ HackenProof Customer Story: Uklon
✍️ Hacking Starbucks and Accessing Nearly 100 Million Customer Records
✍️ Discourse SNS webhook RCE
✍️ Unauthenticated RCE in Goanywhere
✍️ Disclose Instagram Personal Private Archived posts when switching to Professional account through creative hub
✍️ Getting your first Bug Part II | by Remon
✍️ [web3] Medium bug in Sovryn found by gandu worth 15k
✍️ An inconsistent CSRF
✍️ Bypassing restricted port protection in WebKit
✍️ P3 (Medium) : How I Gain Access To NASA's Internal Workspace?!
✍️ How I got RCE in one of Bugcrowd's Public Programs
✍️ Logical Bug which let me stop Users from Creating Ads at a Website
✍️ A smorgasbord of a bug chain: postMessage, JSONP, WAF bypass, DOM-based XSS, CORS, CSRF…
✍️ Pulling SYSTEM out of Windows GINA
✍️ Account hijacking using "dirty dancing" in sign-in OAuth-flows
✍️ CVE-2021-22555: Turning \x00\x00 into 10000$
✍️ Stored XSS in Google Ads Android Application— $3133.70
✍️ Old RCE worth $3362.
✍️ Alternative link
✍️ IDOR, unpin posts for fun.
✍️ Another image removal vulnerability on Facebook
✍️ Escalating subdomain takeovers to steal cookies by abusing document.domain
✍️ CVE-2021-44790: Code Execution On Apache Via An Integer Underflow
✍️ POST to XSS: Leveraging Pseudo Protocols to Gain JavaScript Evaluation in SSO Flows
✍️ Can analyzing javascript files lead to remote code execution?
✍️ Facebook android webview vulnerability : Execute arbitrary javascript (xss) and load arbitrary website
✍️ How I Found XSS In Another Govt. Site :: NCIIPC VDP !!
✍️ Exploit Feature To Get High Bug impact
✍️ #BugBounty — How I was able to delete anyone’s account in an Online Car Rental Company
✍️ ArtiPACKED: Hacking Giants Through a Race Condition in GitHub Actions Artifacts
✍️ Abusing new Claps feature in Medium
✍️ Privilege Escalation via Account Takeover on NodeBB Forum Software — Bug Bounty (512$)
✍️ Visual Studio Code - Remote Code Execution in Restricted Mode (CVE-2021-43908)
✍️ SSD Advisory – SonicWall SMA100 Stored XSS To RCE
✍️ Microsoft CSRF Vulnerability
✍️ CSRF Protection Bypass in Atlassian Confluence Server
✍️ Hackerone Bug Bounty Report: Hinge
✍️ Relative Path File Injection: The Next Evolution in RPO
✍️ Unsubscribe any user’s e-mail notifications via IDOR
✍️ Keylogging users via Slack themes
✍️ Simple Remote Code Execution Vulnerability Examples for Beginners
✍️ My first Google HOF
✍️ How I hacked worldwide Tiktok users
✍️ An interesting idor that allowed me to See all projects ($$$$ Bounty)
✍️ Tale of Account Takeovers (Part-1)
✍️ Story of a very lethal IDOR.
✍️ $500 for Cracking Invitation Code For Unauthorized Access & Account Takeover
✍️ Files.app Symbolic Link Following
✍️ How often do we overlook vulnerabilities?
✍️ Key and E: A Pentester’s Tale on How a Photo Opened Real Doors
✍️ 4300$ Instagram IDOR Bug (2022)
✍️ Facebook android vulnerability: Launching internal/tighten deeplink onbehalf of user
✍️ Stealing cookies from subdomain leads to takeover user accounts at redacted.com
✍️ Unauthorized access to the admin panel via leaked credentials on the WayBackMachine
✍️ Google Groups Authorization Bypass
✍️ Auth Bypass in Google Workspace Real Time Collaboration
✍️ Rolling around and Bypassing Facebook’s Linkshim protection on iOS
✍️ Send()-ing Myself Belated Christmas Gifts - GitHub.com's Environment Variables & GHES Shell
✍️ If It’s a Feature!!! Let’s Abuse It for $750
✍️ How We hacked (bypassed) Admin Panel just by JS file
✍️ GitHub Cache Poisoning
✍️ Finding hidden gems vol. 4: Rakefile a.k.a. how to get AWS keys again
✍️ CVE-2021-43444 to 43449: Exploiting ONLYOFFICE Web Sockets for Unauthenticated Remote Code Execution
✍️ Broken access control + misconfiguration = Beautiful privilege escalation
✍️ XSS in Zoom.us Signup Flow
✍️ #BugBounty @ Linkedln-How I was able to bypass Open Redirection Protection
✍️ The risk in malicious AI models: Wiz Research discovers critical vulnerability in AI-as-a-Service provider, Replicate
✍️ How re-signing up for an account lead to account takeover
✍️ Zoom Session Takeover - Cookie Tossing Payloads, OAuth Dirty Dancing, Browser Permissions Hijacking, and WAF abuse
✍️ Steal authentication token with one-click on misconfigured WebView.
✍️ SSRF Exploitation in Libreoffice Spreadsheet File Converter
✍️ Finding an unseen SQL Injection by bypassing escape functions in mysqljs/mysql
✍️ HackerOne report
✍️ How I earned $$$$ by Amazon S3 Bucket misconfigurations?
✍️ Hacking Hackers for fun and profit
✍️ Stealing Your Private YouTube Videos, One Frame at a Time
✍️ Missing Authentication in ZKTeco ZEM/ZMM Web Interface
✍️ DOM Based XSS In AVG
✍️ How I hacked into a Cambridge’s server and got appreciation letter.
✍️ This is how I managed to win $2000 through Facebook Bug Bounty
✍️ SQL Injection, Reflected XSS and Information Disclosure in one subdomain in just 10 minutes
✍️ From CRLF Injection to XSS: Elevating the Stakes in Apple iTunes Security
✍️ Optimizing Hunting Results in VDP for use in Bug Bounty Programs - From Sensitive Information Disclosure to Accessing Hidden APIs which can be used to Retrieve Customer Data
✍️ Allow arbitrary URLs, expect arbitrary code execution
✍️ Proofpoint Discovers Potentially Dangerous Microsoft Office 365 Functionality that can Ransom Files Stored on SharePoint and OneDrive
✍️ Long String DoS
✍️ WordPress Design Flaw Leads to WooCommerce RCE
✍️ How I Found CVE-2018-8819: Out-of-Band (OOB) XXE in WebCTRL
✍️ RCE in Progress WS_FTP Ad Hoc via IIS HTTP Modules (CVE-2023-40044)
✍️ Denial of Service in the protection service provided by Avast Security Premium.
✍️ Avast Anti-Virus privileged arbitrary file create on virus quarantine (CVE-2023-1585 and CVE-2023-1587)
✍️ Remote Code execution at ws1.aholdusa.com — Compromising logins of Ahold Delhaize USA employees for >3.5 years (or even 18 years?)
✍️ A Hilarious ESET Broken Authentication Vulnerability (one click free purchase)
✍️ Stealing User Information Via XSS Via Parameter Pollution
✍️ Access Any Owner Account without Authentication (Auth bypass + 2FA bypass)
✍️ LedgerSMB – CVE-2024-23831: Privilege escalation through CSRF attack on “setup.pl”
✍️ Hey Google Lets submit bug from Victim Account !
✍️ AWS SageMaker Jupyter Notebook Instance Takeover
✍️ Google.com cross site scripting and privilege escalation in Consumer Surveys
✍️ WordPress < 5.8.3 - Object Injection Vulnerability
✍️ Another XSS in Google Colaboratory
✍️ Let’s Hack Citizens Bank
✍️ Should you be concerned about LastPass uploading your passwords to its server?
✍️ Distorted and Undeletable Posts in Facebook Group
✍️ WordPress 5.1 CSRF to Remote Code Execution
✍️ Account Takeover Using CSRF(json-based)
✍️ Neighbourhood Watch - Hikvision Intercom Eavesdropping
✍️ HTTP Parameter Pollution - It’s Contaminated
✍️ No Rate limiting eligible for bounty ?
✍️ DMCA.COM Hack, Full Disclosure (With Proof-of-Concept)
✍️ Improper Authentication in Android App
✍️ Bug bounty - PHI/PII critical data exposure
✍️ Cookie Tossing to RCE on Google Cloud JupyterLab
✍️ Gcash Vulnerability Walkthrough
✍️ Abusing Azure Hybrid Workers for Privilege Escalation – Part 1
✍️ Bug Bounty - Information Disclosure through error message + WAF Bypass led to Local File Inclusion
✍️ Account Takeover via iFrame Injection
✍️ How Race Condition helped me break Business Logic of the application
✍️ CVE-2022-25165: Privilege Escalation to SYSTEM in AWS VPN Client
✍️ Conditional Love for AWS Metadata Enumeration
✍️ Local File XSS Vulnerability in Wordpress.com (Write Up)
✍️ Java Exploitation Restrictions in Modern JDK Times
✍️ 2-byte DoS in freebsd-telnetd / netbsd-telnetd / netkit-telnetd / inetutils-telnetd / telnetd in Kerberos Version 5 Applications - Binary Golf Grand Prix 3
✍️ Increasing reward points N number of time
✍️ How I was Able To Bypass Email Verification
✍️ XSS->Fix->Bypass: 10000$ bounty in Google Maps
✍️ Bypass Admin approval, Mute Member and Posting Permissions for Only admins in Facebook groups
✍️ IDOR on HackerOne Hacker Review “What Program Say”
✍️ Publicly Accessible Android Crash Reports Containing Sensitive Information
✍️ How I Takeover Wordpress Admin fiiipay.my
✍️ Not a fancy bug, just HTML Injection in Clause - clause.io (Write Up)
✍️ CSRF Bypass Using Domain Confusion Leads To ATO
✍️ Abusing feature to steal your tokens
✍️ Microsoft Office 365 Message Encryption Insecure Mode of Operation
✍️ CORS Misconfiguration leading to Private Information Disclosure
✍️ IDOR leads to account takeover
✍️ Size Matters — CVE-2021–0485 (High)
✍️ The neglected bug that can infect All Facebook users who pay for leads ads.
✍️ Attack of the clones: Git clients remote code execution
✍️ Exploiting Request forgery on Mobile Applications.
✍️ Content Injection in DuoLingo’s TinyCards App for Android [CVE-2017-16905]
✍️ DOM Based XSS In Microsoft
✍️ (ZOHO) Manage Engine Desktop Central – SQL Injection / Arbitrary File Write
✍️ Increasing impact of Information Disclosure — Full Account Takeover !
✍️ CVE-2021-44142: Details On A Samba Code Execution Bug Demonstrated At Pwn2Own Austin
✍️ Feedback Analyzer Exploitation
✍️ Exploiting A Remote Heap Overflow With A Custom TCP Stack
✍️ Pwn2Own Miami 2022: Inductive Automation Remote Code Execution
✍️ Apache Superset Part II: RCE, Credential Harvesting and More
✍️ Windows Installer arbitrary content manipulation Elevation of Privilege (CVE-2020-0911)
✍️ How I was able to do Mass Account Takeover[Bug Bounty]
✍️ Bug Report; Bypassing Weekly Limits In Basic (Free) LinkedIn Account
✍️ Vulnerability In PayPal worth 200000$ bounty, Attacker can Steal Your Balance by One-Click
✍️ 2023 Starlink Router Gen 2 XSS
✍️ Cache Poisoning via SelfXSS + Path Parameter
✍️ From Multiple IDORs leading to Code Execution on a different Host Container
✍️ From Shared Dash to Root Bash :: Pre-Authenticated RCE in VMWare vRealize Operations Manager
✍️ U.S. Department of Defense - Info Disclosure and SQLi Writeup
✍️ Exploring ZIP Mark-of-the-Web Bypass Vulnerability (CVE-2022-41049)
✍️ [BugBounty] how do I get a premium tier account without paying a penny
✍️ How I Discovered Authentication Bypass That Blocks Users from Accessing the Website ?
✍️ [web3] Hackers in Arbitrum’s Inbox. I found a critical vulnerability in… | by riptide | Sep, 2022 | Medium
✍️ Protected Users: you thought you were safe uh?
✍️ TheHole New World - how a small leak will sink a great browser (CVE-2021-38003)
✍️ Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk
✍️ Attacking .NET Web Services
✍️ How I was able to access IBM internal documents
✍️ How I broke into Google Issue Tracker
✍️ How Attacker could have suffocated the company staff
✍️ BrokenPrint: A Netgear stack overflow
✍️ Introducing Wrapwrap: Using PHP Filters To Wrap A File With A Prefix And Suffix
✍️ Tampering with Conditional Access Policies Using Azure AD Graph API
✍️ The Outlook Winner is Dash
✍️ Diving into Open-source LMS Codebases
✍️ Hunting for bounties antihack.me case study
✍️ XSS Stored On [ Outlook Web — Outlook Android App ]
✍️ Leaking API keys in Bing Maps Portal
✍️ Improper Storage of Private Project’s Files
✍️ SONY Hunting I: Discovering Hidden Parameters (5x SWAG)
✍️ BLIND SSRF in *.stripe.com due to Sentry Misconfiguration
✍️ How I hacked Github again.
✍️ CVE-2023–50220 — Inductive Automation Ignition XML Deserialization to RCE
✍️ How the Sys:All Loophole Allowed Us To Penetrate GKE Clusters in Production
✍️ Story of a Beautiful Account Takeover.
✍️ Holiday Hunting With Aquatone
✍️ Fullscreen API Attack’s Revisited and the FaceBook NA Story
✍️ The Frustrating XSS
✍️ Vulnerability in Bumble dating app reveals any user's exact location
✍️ My Hacking Adventures With Safari Reader Mode
✍️ Authorization bypass in Google’s ticketing system (Google-GUTS)
✍️ #BugBounty — AWS S3 added to my “Bucket” list!
✍️ Subdomain Takeover via Campaignmonitor.com
✍️ I’d TAP That Pass
✍️ Apple Security Bounty: A personal experience
✍️ How I hacked a Crypto Exchange (Bug Bounty Writeup)
✍️ 3 Easy cash via cache
✍️ [web3] Critical bug in Sherlock Yield Strategy found by GothicShanon89238 worth 250k
✍️ Admin Disclosure of Facebook Business all Pages by normal employees:
✍️ SonicWall WXA – Authentication Bypass and Remote Code Execution Vulnerability
✍️ Google Books X-Hacking
✍️ $10.000 bounty for exposed .git to RCE
✍️ $9240 Bounty in 30 days Hunt Challenge
✍️ Yahoo – Root Access SQL Injection – tw.yahoo.com
✍️ Wormable remote code execution in Alien Swarm
✍️ Exploiting a File Upload Vulnerability — A Directory Traversal Attack
✍️ Kubernetes pentest — Bypassing load balancer
✍️ 5 Different Vulnerabilities in Google’s Threadit
✍️ CVE-2023-38146: Arbitrary Code Execution via Windows Themes
✍️ Podman API service listening on TCP can be used from websites
✍️ IDOR FACEBOOK: malicious person add people to the “Top Fans”
✍️ Patched Facebook Vulnerability Could Have Exposed Private Information About You and Your Friends
✍️ Exploiting Distroless Images
✍️ Ssrf to Read Local Files and Abusing the AWS metadata
✍️ How I Unveiled a Critical Vulnerability: Exposing All Buyers’ Invoices PII with a Single Trick
✍️ How We Are Able To Hack Any Company By Sending Message – $20,000 Bounty [CVE-2021–34506]
✍️ Csrf Bypass Using Cross Frame Scripting
✍️ View Facebook payouts for any Facebook Trivia Game
✍️ Encrypting our way to SSRF in VMWare Workspace One UEM (CVE-2021-22054)
✍️ Bug Bounty: Broken API Authorization
✍️ WhatsApp Bug Bounty: Bypassing biometric authentication using voip
✍️ Pwning Microsoft Azure Defender for IoT | Multiple Flaws Allow Remote Code Execution for All
✍️ SATisfying our way into remote code execution in the OPC UA industrial stack
✍️ From GitHub To Account Takeover: Misconfigured Actions Place GCP & AWS Accounts At Risk
✍️ Exploiting File Upload Functionality in Unique Way.
✍️ Hemant Singh Manral
✍️ Rooting Xiaomi WiFi Routers
✍️ CVE-2020–13956
✍️ Stealing $10,000 Yahoo Cookies!
✍️ Simple Open Redirect Bypass.
✍️ Mistuned Part 1: Client-side XSS to Calculator and More
✍️ [web3] Port Finance Logic Error Bugfix Review. This is a postmortem of a vulnerability… | by Immunefi | May, 2022 | Medium
✍️ Paracosme - CVE-2022-33318 - Remote Code Execution in ICONICS Genesis64
✍️ Bypassed! and uploaded a sweet reverse shell
✍️ Graphql Bug to Steal Anyone’s Address
✍️ Reposted [2019]: Hacking YouTube for #fun and #profit
✍️ Bypassing Payments In Apple For Free Trails For Lifetime
✍️ My First Case of SSRF Using Dirsearch
✍️ How I got access to Essilor International company customer PII INFO by AWS metadata access through SSRF
✍️ PrivateDrop: Breaking and Fixing Apple AirDrop
✍️ Exposing Millions of Voter ID card users’ details.
✍️ Alternative link
✍️ Response Manipulation in the Admin panel lead to PII leakage
✍️ How I made 1000$ with AT&T Bug Bounty(H1)
✍️ How I found a Privilege Escalation Bug in a private Ecommerce?
✍️ Bypassing Imperva SecureSphere WAF (CVE-2023-50969)
✍️ Sending out phishing e-mails from @microsoft.com
✍️ Open Redirect Vulnerability On Zapier: An Accidental Find
✍️ How I CSRF’d My First Bounty!
✍️ Auth Bypass in https://nearbydevices-pa.googleapis.com
✍️ XSS “403 forbidden” bypass (Akamai Security )write up
✍️ A fever Worth 750$- [Accessing Private Projects ]
✍️ Patched Zoom Exploit: Altering Camera Settings via Remote SQL Injection
✍️ How I accidentally found Bug in Google Search Console
✍️ Simple CORS misconfig leads to disclose the sensitive token worth of $$$
✍️ Discovering 7 Open Redirect Bypasses and 3 XSS Bypasses Within a Single Program Using the Same Parameters
✍️ Exploiting an Unbounded memcpy in Parallels Desktop: A Pwn2Own 2021 Guest-to-Host Virtualization Escape
✍️ Discovering The Less-known Vulnerability In Oracle Peoplesoft
✍️ Bypassing API Restrictions for Fun and Profit
✍️ Weblogic RCE by only one GET request — CVE-2020–14882 Analysis
✍️ [web3] Beanstalk: Insufficient Input Validation Bugfix Review. This is a postmortem of a vulnerability… | by Immunefi | Jan, 2024 | Medium
✍️ $1,250 worth of Host Header Injection
✍️ ($$$) Origin ip to account takeover
✍️ Advisory CVE-2023-43042 – IBM Backup Products Superuser Information Disclosure
✍️ NPM might be executing malicious code in your CI without your knowledge
✍️ CSV Injection -> Meterpreter on Pornhub
✍️ Unrestricted CV File Upload
✍️ How I earned \(\) by finding confidential customer data including plain-text passwords!
✍️ Stored XSS in Yahoo!
✍️ The False Oracle — Azure Functions Padding Oracle Issue
✍️ Bypassing Authentication Using Javascript Debugger.
✍️ RoguePuppet – A Critical Puppet Forge Supply Chain Vulnerability
✍️ SSRF Attack Leading To AWS Metadata
✍️ Facebook PageAnalyst Could Add oneself as Moderator on Group
✍️ Escalating Privileges With SSRF
✍️ Microsoft Office Online Server Remote Code Execution
✍️ Credential stuffing in Bug bounty hunting
✍️ XSS in WordPress via open embed auto discovery
✍️ Lucky Bug Which Let Me Change Name of Every Accounts at a Single Click
✍️ HackerOne report
✍️ Email Confirmation bypass at Instagram
✍️ Fixed : Brute-force Instagram account’s passwords
✍️ ZOL Zimbabwe Authentication Bypass to XSS & SQLi Vulnerability – Bug Bounty POC
✍️ CVE-2022-3236: Sophos Firewall User Portal and Web Admin Code Injection
✍️ Stored XSS on Indeed
✍️ DOM based open redirect to the leak of a JWT token
✍️ Victim’s Anti CSRF Token could be exposed to Third-party Applications installed on user’s Device (500$)
✍️ Reflected XSS on Stack Overflow
✍️ Debugging the undebuggable and finding a CVE in Microsoft Defender for Endpoint
✍️ How I was Able to see someone’s all private files with a single file share link through Atom feed & Never Give Up #togetherwehitharder HackerOne
✍️ Interesting Stored XSS via meta data
✍️ How Token Misconfiguration can lead to takeover account
✍️ (POC) Update business fyi message as Facebook page analyst
✍️ A Tale Of 5250$: How I Accessed Millions Of User’s Data Including Their National ID’s
✍️ mXSS: The Vulnerability Hiding in Your Code
✍️ Password Reset Token Leak Via Referrer
✍️ From an error message to DB disclosure
✍️ SSD Advisory – Foscam R4M UDTMediaServer Buffer Overflow
✍️ Beware of the GIF: Account Takeover Vulnerability in Microsoft Teams
✍️ Wordpress Plugin Update Confusion - The full guide how to scan and mitigate the next big Supply Chain Attack
✍️ 700$ Denial of Service(DoS) vulnerability in script-loader.php (CVE-2018-6389)
✍️ How i found credential enriched redis dump
✍️ Alternative link
✍️ Facebook hidden redirection vulnerability
✍️ PwnAgent: A One-Click WAN-side RCE in Netgear RAX Routers with CVE-2023-24749
✍️ Windows AppX Deployment Service Local Privilege Escalation (CVE-2020-1488
✍️ TypeORM Prototype Pollution Leading To SQL Injection (CVE-2022-36531)
✍️ How I Hacked 100K+ Godaddy Users And Help To Secure For Free
✍️ ExifTool CVE-2021-22204 - Arbitrary Code Execution
✍️ Popping Alerts in Mixmax Chrome Extension (Write Up)
✍️ Hacking Netflix Eureka!
✍️ challenge writeup content-type shenanigans
✍️ Yahoo Bug Bounty: Exploiting OAuth Misconfiguration To Takeover Flickr Accounts
✍️ [Writeup][Bug Bounty][Tokopedia] Manipulate Other User’s Cart and Wishlist on Tokopedia [EN]
✍️ Filter Bypass to Reflected XSS on https://finance.yahoo.com (mobile version)
✍️ How I approached Dependency Confusion!
✍️ Firmware Security: Alcatel-Lucent ALE-DeskPhone
✍️ chonked pt.1: minidlna 1.3.2 http chunk parsing heap overflow (cve-2023-33476) root cause analysis
✍️ How I could have Hacked IIT Guwahati’s website
✍️ Java applet + serialization in 2024! What could go wrong?
✍️ Bypass 2FA like a Boss
✍️ Securing Developer Tools: OneDev Remote Code Execution
✍️ chonked pt.2: exploiting cve-2023-33476 for remote code execution
✍️ Leaking secrets through caching with Bunny CDN
✍️ Multiple xss in *.skype.com (2)
✍️ Leaking OpenID tokens with “ — the bug right infront of you
✍️ http: properly reject empty http header field names
✍️ From broken link to subfolder takeover on Bukalapak
✍️ iCloud XXS’ed
✍️ Hijacking GitHub Runners To Compromise The Organization
✍️ Discovering a zero day and getting code execution on Mozilla’s AWS Network
✍️ 18th Acknowledgement From Microsoft
✍️ Blind XSS and Time-Based SQL Injection to Admin Panel Control and Database Takeover
✍️ CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities
✍️ Corrupting memory without memory corruption
✍️ A simple Account takeover misusing JWT late expiration
✍️ Finding bugs on Chess.com
✍️ AWS Cognito pitfalls: Default settings attackers love (and you should know about)
✍️ IDOR leads to getting Access tokens of users linked to Google Drive on Edmodo
✍️ CVE-2023-38205: Adobe ColdFusion Access Control Bypass [FIXED]
✍️ Subdomain takeover via nolt.io
✍️ Imagemagick GIF coder vulnerability leads to memory disclosure (Hackerone)
✍️ Leaking Credit card Activity in logs? Yes Sir!
✍️ Subdomain Takeover via HubSpot
✍️ [web3] Rounding convention bug disclosure
✍️ Exploiting HTTP Request Smuggling (TE.CL)— XSS to website takeover
✍️ Unauthenticated user can upload an attachment at HackerOne
✍️ CVE-2022-0185 - Winning a $31337 Bounty after Pwning Ubuntu and Escaping Google's KCTF Containers
✍️ Stored XSS vulnerability in Microsoft booking
✍️ LFI to 10 servers pwn
✍️ FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive (CVE-2022-40684)
✍️ Full Team Takeover
✍️ Odoo: Get your Content Type right, or else!
✍️ How a Port scan got me Nokia Hall of Fame
✍️ MobileIron MDM Contains Static Key Allowing Account Enumeration
✍️ VMware Official VCDX Reflected XSS
✍️ Rooting A Common-criteria Certified Printer To Improve Opsec
✍️ Part 2
✍️ Let’s steal some tokens!
✍️ Bypassing 403
✍️ DoS on Facebook Android app using 65530 characters of ZERO WIDTH NO-BREAK SPACE.
✍️ How I was able to access a properly Configured S3 Bucket
✍️ SQL Injection On MEGA.NZ
✍️ Satyendra Shrivastava
✍️ Subdomain Takeover in Azure Trafficmanager for Fun & Profit
✍️ You’ve Crossed the Line — Disturbing a Host’s Rest
✍️ Reversing UK mobile rail tickets
✍️ Telegram addresses another privacy issue
✍️ Circumventing Browser Security Mechanisms For SSRF
✍️ CVE-2021-26420: Remote Code Execution In Sharepoint Via Workflow Compilation
✍️ Finding and Exploiting Unintended Functionality in Main Web App APIs
✍️ How I could have mass uploaded from every Flickr account!
✍️ Improper Spring @Query Usage Allows N1QL Injection
✍️ MS Enterprise app management service RCE. CVE-2022-35841
✍️ CVE from 2018 Strikes Again
✍️ CVE-2022-38627: A journey through SQLite Injection to compromise the whole enterprise building
✍️ [web3] Diving Deep into a Critical Protocol Insolvency Bug in Fringe.fi Lending Platform | Trust
✍️ Hijacking Someone Else’s DCSync
✍️ PayPal IDOR via billing Agreement Token (closed Informative, payment fraud)
✍️ Tarfile: Exploiting the World With a 15-Year-Old Vulnerability
✍️ Reflected XSS in Django REST Framework Api at MapBox Subdomain
✍️ Stealing Cookies to Login in any Account
✍️ The effectiveness of employing BChecks to uncover significant secrets
✍️ Post Account Takeover? Account Takeover of Internal Tesla Accounts
✍️ How I hacked one of the biggest Airline in the world
✍️ Blinding Snort: Breaking The Modbus OT Preprocessor
✍️ Encrypted Doesn't Mean Authenticated: ShareFile RCE (CVE-2023-24489)
✍️ Bruteforce Instagram account’s passwords (lack of rate limiting protection).
✍️ [web3] Low bug in Warden Swap found by ABDul Rehman worth 1k
✍️ Reflected XSS in Google Code Jam
✍️ Write Up – XSS Stored In files.slack.com Via XML/SVG File (iOS) – $1,000 USD
✍️ Attacking Titan M with Only One Byte
✍️ CVE-2022-30211: Windows L2TP VPN Memory Leak and Use after Free Vulnerability
✍️ The Android kernel mitigations obstacle race
✍️ iOS App Pentesting and Security with Real-World Case Studies Part 2
✍️ How I leveraged an interesting CSRF vulnerability to turn self XSS into a persistent attack?
✍️ Exploiting an unknown vulnerability
✍️ Forcing Firefox to Execute XSS Payloads during 302 Redirects
✍️ Making a Blind SQL Injection a Little Less Blind
✍️ Facebook Workplace Privilege Escalation Vulnerability To Change The Post Privacy As Public
✍️ Bypassing Instagram’s stories restriction
✍️ Stealing HttpOnly Cookie via XSS
✍️ A successful prototype pollution chained to a DOM XSS
✍️ A small change, and things go in your hand : Story of a $250 bounty
✍️ HTML Injection(Unique Exploitation)
✍️ Leaking Your GitHub Repositories With Snyk Code
✍️ How A Blackbox Target Turned To Whitebox With Recon
✍️ Exploiting an Order of Operations Bug to Achieve RCE in Oracle Opera
✍️ Telegram bug bounties: XSS, privacy issues, official bot exploitation and more…
✍️ Subdomain takeover and Text injection on a 404 error page-$100 bounty
✍️ [UNPATCHED] Cli: gh run download implementation allows overwriting git repository configuration upon artifacts downloading
✍️ My New Discovery In Oracle E-Business Login Panel That Allowed To Access For All Employees Information's & In Some cases Passwords At More Than 1000 Companies
✍️ The Printer Goes Brrrrr, Again!
✍️ Command Injection in Google Cloud Shell
✍️ CVE-2021–34506: How We Are Able To Hack Any Company By Sending Message - $20,000 Bounty
✍️ How I Test For Web Cache Vulnerabilities + Tips And Tricks
✍️ How Redirects work on Facebook? Technical breakdown
✍️ Revisiting an Old Bug: File Upload to Code Execution
✍️ Vulnerabilities in Tenda's W15Ev2 AC1200 Router
✍️ [Netflix][Smart TV] — Chaining Self-XSS with Session poisoning.
✍️ From Shodan Dork to Grafana 📊Local File Inclusion
✍️ Refocusing in bug hunting, Bonus: An interestingly simple to test CSRF bypass
✍️ Critical IDOR Vulnerability on Medium?
✍️ Facebook Vulnerability: $1500 for Removing Document Cover
✍️ Facebook: Linkshim protection bypass using fb://webview
✍️ Shodan Recon to $1000 bounty in 2 mins
✍️ From CVE-2022-33679 to Unauthenticated Kerberoasting
✍️ Artsy
✍️ Patch. Bypass. Repeat: Story of a FaceBook Page Admin Disclosure bug worth $5000
✍️ Roles allowing to abuse Entra ID federation for persistence and privilege escalation
✍️ ShazLocate! Abusing CVE-2019-8791 & CVE-2019-8792
✍️ How I was able to see likes and dislikes count even though is hidden by victim | YouTube #4
✍️ Two weeks of securing Samsung devices: Part 2
✍️ Hacker's Guide to Directory/Endpoint Enumeration
✍️ From Self-Hosted GitHub Runner to Self-Hosted Backdoor
✍️ A story of leaking uninitialized memory from Fastly
✍️ CVE-2022-30216 - Authentication coercion of the Windows “Server” service
✍️ Rxss inside href attribute - Bypassing lots of weird checks to takeover accounts!
✍️ CVE-2018-16794 on fs.thefacebook.com
✍️ Remote Code Execution by Abusing Apache Spark SQL
✍️ Magic of the Back Slash
✍️ Bypass CSP by Abusing XSS Filter in Edge
✍️ How was i able to find privilege escalation.
✍️ SSRF via FFmpeg HLS processing
✍️ Part 2: Dive into Zoom Applications
✍️ Spilling Local Files via XXE when HTTP OOB fails
✍️ Hacking 6.5+ million websites => CVE-2022-29455 (Elementor)
✍️ Reflected XSS on Microsoft
✍️ Exploiting an SQL injection with WAF bypass
✍️ GKE Autopilot Node Compromise via Race Condition
✍️ Bypass Mobile PIN Verification
✍️ Looking for vulnerabilities in Strapi (CVE-2024-34065)
✍️ My Experience with the PayPal Bug Bounty Programme
✍️ A Simple IDOR to Account Takeover
✍️ CyberGhostVPN - the story of finding MITM, RCE, LPE in the Linux client
✍️ Exploiting CORS to perform an IDOR Attack leading to PII Information Disclosure
✍️ Facebook Invitees Email Address Disclosure
✍️ How I found read/write access to the personal data of 3 million users of an E-commerce website?
✍️ How I was able to Retrieve your Personal Documents using the Wayback Machine!
✍️ How I was able to modify and delete any user’s data file (filestack API)
✍️ Reflected XSS ON ASUS.
✍️ Gumtree – leaking your data and not really listening
✍️ The 2.5mins or 2.5k$ hawk-eye bug – A Facebook Pages Admins Disclosure Vulnerability!
✍️ Hacking Google Bard - From Prompt Injection to Data Exfiltration
✍️ SD-PWN — Part 3 — Cisco vManage — Another Day, Another Network Takeover
✍️ How I made $31500 by submitting a bug to Facebook
✍️ Using XAMPP and Burp Intruder when scanning for subdomains to look for interesting behaviour & code
✍️ [Writeup][Bug Bounty][Tokopedia] Manipulate Other User’s Cart and Wishlist on Tokopedia [EN]
✍️ Account Takeover via Access Token Leakage | by M’BAREK Imad
✍️ Digging in to SCP Command Injection
✍️ Messenger Rooms Bug Bounty Write-up
✍️ Race conditions on the web
✍️ How I Hacked the Dutch Government with SQLi and Won the Famous T-Shirt?
✍️ CVE-2022–43781
✍️ Write Up: Google VRP N/A – Sandboxed Rce As Root On Apigee API Proxies
✍️ Parameter Tampering ₹→$
✍️ Manipulating AES Traffic using a Chain of Proxies and Hardcoded Keys
✍️ Another Zoho ManageEngine Story
✍️ Exploitation Of CVE-2021-21220 – From Incorrect JIT Behavior To RCE
✍️ A vulnerability on Patreon, and their elusive bounty program.
✍️ A business Logic issue worth $1500
✍️ How I was able to revoke your Instagram 2FA
✍️ SHAREit Flaw Could Lead to Remote Code Execution
✍️ OLE object are still dangerous today — Exploiting Microsoft Office
✍️ How I Hacked the Dutch Government: Exploiting an Innocent Image for Remote Code Execution
✍️ How I bypassed 403 forbidden domain using a simple trick
✍️ Permanent Crash Instagram Followers.
✍️ Hijacking Cloud CI/CD Systems for Fun and Profit
✍️ Workplace by Facebook | Unauthorized access to companies environment — $27,5k
✍️ Calling Home, Get Your Callbacks Through RBI
✍️ How I was able to find 100+ XSS in United nations Bug Bounty Program
✍️ Stealing Access Token of One-drive Integration By Chaining CSRF Vulnerability
✍️ Race Condition vulnerability in Azure Video Indexer allowed trial account users use Advance / Premium feature
✍️ CSRF + Stored XSS Leading to Full Account Takeover
✍️ Client, not client!
✍️ Stored XSS in message.alibaba.com ($2,000)
✍️ Exploiting Lambda Functions for Fun and Profit
✍️ How i found blind XSS in Apple
✍️ IIS welcome page to source code review to LFI!
✍️ How I Found P1 bug Due to Sensitive data exposure And Earn $$$$
✍️ Technical Advisory – Multiple vulnerabilities in Nuki smart locks (CVE-2022-32509, CVE-2022-32504, CVE-2022-32502, CVE-2022-32507, CVE-2022-32503, CVE-2022-32510, CVE-2022-32506, CVE-2022-32508, CVE-2022-32505)
✍️ Multiple vulnerabilities in Delmia Apriso 2017 to 2022
✍️ Reflected XSS Injection & Permanent Open Redirection
✍️ An exciting journey to find SSRF , Bypass Cloudflare , and extract AWS metadata !
✍️ Prezi (map.prezi.com) Path Traversal
✍️ Zoom Security Exploit – Cracking private meeting passwords
✍️ Exploiting Cache Poisoning via Unkeyed Parameters and Headers in a Drupal Application
✍️ Zimbra Open Bucket Data Leak – Responsible Disclosure
✍️ Godaddy XSS affects parked domains redirector/processor!
✍️ External XML Entity via File Upload (SVG)
✍️ Brave Browser Script Blocker Bypass Vulnerability
✍️ Mr. Robot: Self Xss from Informative to high 1200$ ,csrf, open redirect,self xss to stored
✍️ How I found XSS on Amazon?
✍️ More secure Facebook Canvas Part 2: More Account Takeovers
✍️ Facebook Android Application
✍️ How I Took Over 2 Subdomains with Azure CDN Profiles
✍️ SSRF leads to access AWS metadata.
✍️ Hacking into gRPC-Web
✍️ Apache Example Servlet leads to \(\)
✍️ [Yahoo Bug Bounty] Unauthorized Access to Unisphere Management Server Debugging Facility on https://bf1-uaddbcx-002.data.bf1.yahoo.com/Debug/
✍️ Where is my Train : Tracking to Hacking !
✍️ How I was able to take over any users account with host header injection
✍️ Patch Diffing CVE-2023-28121 to Compromise a WooCommerce
✍️ $5,005 worth vulnerability Duplicated, How I loose $5,005 in a day? Denial of Service - Billion LAUGH Attack (XXE)
✍️ Recon and YouTube
✍️ Accidental IDOR that Deleted Admin Account.
✍️ Chaining rate limiting for account lockout
✍️ Molding Lies Into Reality || Exploiting CVE-2024-4358
✍️ Bug bounty failure stories to learn from: how we ended up to hack a bank with no reward
✍️ Malicious Kubernetes Helm Charts can be used to steal sensitive information from Argo CD deployments
✍️ CVE-2023–1410 : Stored XSS in the Graphite Function Description tooltip
✍️ Backslash Powered Scanning: hunting unknown vulnerability classes
✍️ $7.5k Google services mix-up
✍️ [Critical] Bypass CSRF protection on IBM
✍️ This is how I was able to see Private, Archived Posts/Stories of users on Instagram without following them
✍️ External XML Entity via File Upload (SVG)
✍️ New features means new bugs
✍️ CVE-2021-38297 – Analysis of a Go Web Assembly vulnerability
✍️ “Hey Siri, follow that car!” - How traffic cameras expose your location through parking apps.
✍️ White Hats - Nepal
✍️ Account Takeover via Custom OTP, No User Interaction Required!
✍️ $10,000 for a vulnerability that doesn’t exist
✍️ Poch, Poch, is this thing on? Bypass AMSI with Divide & Conquer
✍️ Broken Link Hijacking — My Second Finding on Hackerone!
✍️ 3CX Phone System Local Privilege Escalation Vulnerability
✍️ Open Redirect in SLACK
✍️ Yeah! I got P2 in 1 minute - Stored XSS via Markdown Editor
✍️ Inside Xerox WorkCentre: Two Unauthenticated RCEs
✍️ Time-based Blind SQLi on news.starbucks.com
✍️ SVG SSRFs and saga of bypasses
✍️ How I found 5 store XSS on a private program. Each worth "1,016.66$"
✍️ Mistuned Part 2: Butterfly Effect
✍️ Multiple Times I Hacked Duke University With RXSS Vulnerability!!!
✍️ CVE-2020–9934: Bypassing the macOS Transparency, Consent, and Control (TCC) Framework for unauthorized access to sensitive user data
✍️ macOS Atlassian Companion Remote Code Execution
✍️ How I could have read your confidential bug reports by simple mail?
✍️ Android Reddit App leaks images
✍️ Stealing Facebook Access Tokens with a Double Submit
✍️ HTTP Request Smuggling CL.TE
✍️ Some Tips to Finding IDORs more easily and Fixing them
✍️ pcextreme.nl fake bug bounty
✍️ [web3] Low bug in Nomad found by Nikita Stupin
✍️ Obtaining XSS Using Moodle Features and Minor Bugs
✍️ How I hacked one cryptocurrency service
✍️ 900$ XSS in yahoo ( Recon Wins )
✍️ How I got RCE In The World Largest Russian Company
✍️ CORS To CSRF Attack
✍️ You can’t stop me. MS Teams session hijacking and bypass
✍️ $5000 Google IDOR Vulnerability Writeup
✍️ XSS on Google{5.000$}-Google Vulnerability Reward Program (VRP)
✍️ How I was able to get subscription of $120/year For Free
✍️ Caching the Un-cacheables - Abusing URL Parser Confusions (Web Cache Poisoning Technique)
✍️ [P2O Vancouver 2023] SharePoint Pre-Auth RCE chain (CVE-2023–29357 & CVE-2023–24955)
✍️ How we escalated a DOM XSS to a sophisticated 1-click Account Takeover for $8,000 — Part 1 | by The Frog Sec
✍️ Alternative link
✍️ Bypassing CORS configurations to produce an Account Takeover for Fun and Profit
✍️ CSRF account takeover Explained Automated/Manual — Bug Bounty
✍️ From payload to 300$ bounty: A story of CRLF injection and responsible disclosure on HackerOne
✍️ Broken Authentication — Bug Bounty
✍️ My First CSRF to Account Takeover worth $750
✍️ PDF report
✍️ Microsoft accidentally exposed their private Xbox game developer forums
✍️ Super Admin panel without Credentials 😎
✍️ AWS takeover through SSRF in JavaScript
✍️ One Way to Find Hidden IDOR Vulnerability
✍️ Multiple vulnerabilities in Cisco Unified Communications Manager version 11.5.1
✍️ XSS Vulnerability in IBM Content Navigator (CVE-2020-4757)
✍️ I discovered a browser bug
✍️ #BugBounty — “Let me reset your password and login into your account “-How I was able to Compromise any User Account via Reset Password Functionality
✍️ Telegram App Store Secret-Chat Messages in Plain-Text Database
✍️ Gatekeeper’s Achilles heel: Unearthing a macOS vulnerability
✍️ Exploiting HTTP Parsers Inconsistencies
✍️ The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)
✍️ LFI in Nokia maps
✍️ Cross-Site Scripting in CodeIgniter version 3.1.13
✍️ Leaking WordPress CSRF Tokens for Fun, $1337 bounty, and CVE-2017-5489
✍️ Paypal’s Security Check Bypassed
✍️ Account Takeover Using Cross-Site WebSocket Hijacking (CSWH)
✍️ A Confused Deputy Vulnerability in AWS AppSync
✍️ Account takeover via HTTP Request Smuggling
✍️ Two-Factor Authentication Bypass
✍️ How i found “Broken Access Control Through out-of-sync setup” and got $1000
✍️ mfa bypass in private program, the abdulsec way
✍️ CVE-2022-23088: Exploiting A Heap Overflow In The Freebsd Wi-fi Stack
✍️ Bug Bounty 101 — Always Check The Source Code
✍️ Story About OTP Bypass To Stored XSS
✍️ How I earned $10,000 within the last 7 months — a 17y/o Edition
✍️ Major Security Flaws in Popular QuickBlox Chat And Video Framework Expose Sensitive Data Of Millions
✍️ Remote Command Execution in a Bank Server
✍️ Discovering Zero-Day Vulnerabilities in McAfee Products
✍️ [3/3] Cache Poisoning & Lateral Movement @ GitLab
✍️ Finding Reflected XSS In A Strange Way
✍️ Story of my Biggest Bounty ever : Command Execution on Jenkin
✍️ Admob creative image cross-site scripting vulnerability
✍️ Back to the (Clip)board with Microsoft Whiteboard and Excalidraw in Meta (CVE-2023-26140)
✍️ Accessing the website directly through its IP address, a case of a poorly hidden sql injection
✍️ Baking Flask cookies with your secrets
✍️ Bypassing The Client Side Encryption To Read Internal Windows Server Files
✍️ Change payment account of any Facebook commerce page
✍️ Vulnerability Netflix (cross-site-scripting) XSS
✍️ ‘Websocket Hijacking’ to steal Session_ID of victim users
✍️ [web3] Critical bug in OpenZeppelin found by Ashiq Amien
✍️ Privilege Escalation to remove the owner from the organization
✍️ Spring WebFlux – CVE-2023-34034 – Write-Up and Proof-of-Concept
✍️ Facebook ClickJacking – How we put a new dress on Facebook UI
✍️ Facebook Bug bounty page admin disclose bug {Facebook Android app}
✍️ Escalating Self-XSS To Stored XSS via Image injection + IDOR
✍️ Guest Blog Post: Rollback Attack
✍️ IDOR leads to Data leakage and Profile Update
✍️ How I Get my first P1 (Sensitive Information Disclosure) using WPScan
✍️ Disclose private attachments in Facebook Messenger Infrastructure - 15,000$
✍️ Bypass Admin approval, Mute Member and Posting Permissions for Only admins in Facebook groups
✍️ Disclosing information with a side-channel in Django
✍️ M1 Macs GateKeeper bypass aka CVE-2021-30658
✍️ runc mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs (CVE-2021-30465)
✍️ Confirm an email address belonging to a specific user
✍️ Bypass Content Security Policy framing restriction rule - OLX
✍️ Advisory: IDOR in Microsoft Teams Allows for External Tenants to Introduce Malware
✍️ Bypassing Message Request inbox
✍️ HTTP Chunk Extension Processing Vulnerabilities
✍️ Journeys in Quoteless and Multi Reflection XSS
✍️ Exploiting CORS Miss configuration using XSS
✍️ Duo Finds SAML Vulnerabilities Affecting Multiple Implementations
✍️ By Design: How Default Permissions on Microsoft Power Apps Exposed Millions
✍️ 403 Forbidden? No Problem, Here’s a POST XSS
✍️ Redstrom Denial Of Service — Write Up
✍️ Into the Borg – SSRF inside Google production network
✍️ Break Me Out Of Sandbox In Old Pipe - CVE-2022-22715 Windows Dirty Pipe
✍️ How I Hacked Netflix users & Use it free forever
✍️ Ryan Pickren
✍️ Write Up – Apple N/A: PII Information, Full Contact List, Main Phone No. And Main Icloud Email Extracted; Bug Patched: Arbitrary Local File Read Via Zip File And Symlinks On Ios Files App.
✍️ When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project
✍️ Stealing Videos From VLC
✍️ A Twist in the Code: OpenMeetings Vulnerabilities through Unexpected Application State
✍️ When URL parsers disagree (CVE-2023-38633)
✍️ The Ticklish XSS
✍️ CVE-2021-39165: A Bug Bounty Journey from a Laravel SQL Injection Vulnerability
✍️ Facebook Bug Bounty: secondary damage (revisited) why I really like reporting to Facebook too :)
✍️ Chains on Chains: Chaining multiple low-level vulns into a Critical.
✍️ Client Side Path Manipulation
✍️ How I bypassed Facebook CSRF once again!
✍️ CVE-2022-26730 | ColorSync | Hoyt LLC
✍️ Account Takeover via OTP Bruteforce (Apigee API)
✍️ Hunting for bugs in Telegram's animated stickers remote attack surface
✍️ Fuzzing For Hidden Params
✍️ Page Admin Disclosure When Replying Comments
✍️ XXE with Auto-Update in install4j
✍️ SSD Advisory – Linux CLOCK_THREAD_CPUTIME_ID LPE
✍️ Let me Unmask my next 👻
✍️ Near universal XSS in McAfee Web Gateway
✍️ Business Logic Errors - A New Look
✍️ ICMAD SAP Vulnerabilities (CVE-2022-22536, CVE-2022-22532 & CVE-2022-22533)
✍️ Yet Another Telerik UI Revisit
✍️ I Want that Cookie !!!
✍️ Digging JS files to find BUGs
✍️ Fun With CORS
✍️ Sudoedit bypass in Sudo <= 1.9.12p1 (CVE-2023-22809)
✍️ How we abused Slack’s TURN servers to gain access to internal services
✍️ SSD Advisory – File History Service (FHSVC.DLL) Elevation Of Privilege
✍️ [web3] Dacian: $28k Bounty: Admin Brick Forced Revert
✍️ Why You Should Always Check The Audit Log [Medium] — $500
✍️ XS-Leak: Deanonymize Microsoft Skype Users by any 3rd-party websites
✍️ Windows Task Scheduler Application, Version 19044.1706 Advisory
✍️ Crowdsource Success Story: From an Out-of-Scope Open Redirect to CVE-2020-1323
✍️ #SecurityBreach — ”How I was able to book hotel room for 1.50₹!”
✍️ Analysis Of CVE-2021-1810 Gatekeeper Bypass
✍️ Better Make Sure Your Password Manager Is Secure
✍️ Default Credentials on Sony- Swag Time
✍️ Leaking Browser URL/Protocol Handlers
✍️ Weird Vulnerabilities Happening on Load Balancers, Shallow Copies and Caches
✍️ Fixing the Unfixable: Story of a Google Cloud SSRF
✍️ Hacking Chess.com: My Journey to Unlock Premium Bots on the Android App
✍️ Exploiting SQL Error SQLSTATE[42000] To Own MariaDB of A Large Online Media Leader
✍️ IDOR on clientauthconfig.googleapis.com
✍️ Blind SSRF on coda.io
✍️ RocketChat - Unauthenticated access to messages
✍️ A Case Study of API Vulnerabilities - Part 2, and Empty Heads
✍️ View the ranked messenger users for any page
✍️ LDAP Admin Account Bypassed :)
✍️ CVE-2018–5230 | JIRA Cross Site Scripting
✍️ How I Scored 2K Bounty via an IDOR
✍️ $4500 bounty - How I got lucky
✍️ From android app to access admin dashboard
✍️ How i was able to bypass Email Confirm — P4
✍️ How I find open redirect in Facebook
✍️ Facebook Messenger exposing deleted messages using [Remove for Everyone]
✍️ Google.com – Mobile Feedback URL Redirect Regex/Validation Flaw
✍️ Breaking Business Logic via Coupons — The Story of my 1st Valid Bug Bounty
✍️ Pre-Auth RCE in Moodle Part I - PHP Object Injection in Shibboleth
✍️ Unveiling Access Control Flaws: How a Viewer Became an Editor
✍️ ELECTRONizing macOS privacy
✍️ The Bad Twin: a peculiar case of JWT exploitation scenario
✍️ XSS Through Parameter Pollution
✍️ Horizontal Privilege Escalation on Quora which can compromise all users on Quora
✍️ Chaobin Zhang
✍️ Taking over Azure DevOps Accounts with 1 Click
✍️ Account Take Over Due to AWS Cognito Misconfiguration | by Deshine
✍️ Remote Deserialization Bug in Microsoft's RDP Client through Smart Card Extension (CVE-2021-38666)
✍️ Less SmartScreen More Caffeine: (Ab)Using ClickOnce for Trusted Code Execution
✍️ Targeting Visual Studio Code for macOS: File Discovery and a TCC bypass (kinda)
✍️ [BBP系列三] Hijack the JS File of Uber's Website
✍️ Critical Security Flaw Found in WhatsApp Desktop Platform Allowing Cybercriminals Read From The File System Access
✍️ A tale of a full Business Takeover — Red Team Diaries
✍️ Misconfigured s3 bucket leads to Sensitive Data exposure(No super controls )
✍️ 3 ways to get Remote Code Execution in Kafka UI
✍️ Hassan Khan Yusufzai
✍️ draw.io CVEs
✍️ Opera Browser (XSS)
✍️ Privilege Escalation to stored XSS
✍️ Exploiting a Race Condition Vulnerability
✍️ Adding a malicious notebook to be treated like a trusted notebook in Google Colab — 1337$
✍️ A Bug That Was 23 Years Old Or Not
✍️ All *.intercom.help subdomains vulnerable to Subdomain Takeover from intercom Service
✍️ Vulnerability To Bypass Clickjacking Protection In Youtube
✍️ Reflected Cross Site Scripting at Paypal.com
✍️ Craft CMS – Why case matters
✍️ Self XSS To Stored Through IDOR/
✍️ Tale of a Misconfiguration in Password Reset
✍️ CRLF injection allow => cookie injection in root domain & xss
✍️ Pre-Auth RCE in Aspera Faspex: Case Guide for Auditing Ruby on Rails
✍️ RCE on Spip and Root-Me, v2!
✍️ Account Takeover Vulnerability :)
✍️ Hacking CloudKit - How I accidentally deleted your Apple Shortcuts
✍️ OTP Bypass Account Takeover to Admin Panel — Ft. Header Injection
✍️ GitHub Desktop RCE (OSX)
✍️ CVE-2022-35256 - HTTP Request Smuggling in NodeJS
✍️ Grafana Admin Panel bypass in Google Acquisition(VirusTotal)
✍️ Remote Code Execution in Spotify’s Backstage via vm2 Sandbox Escape (CVSS Score of 9.8)
✍️ WhatsUp Gold Pre-Auth RCE GetFileWithoutZip Primitive (CVE-2024-4885)
✍️ PHP deserialization attacks and a new gadget chain in Laravel
✍️ Vulnerability in Electron-based Application: Unintentionally Giving Malicious Code Room to Run
✍️ The PDF Trojan Horse: Leveraging HTML Injection for SSRF and Internal Resource Access
✍️ How i found massive information disclosure of 1500 famous people
✍️ Bypass password confirmation in Facebook “DYI” feature
✍️ Access Twitter blue features using deeplink without a subscription.
✍️ Facebook bug: A Journey from Code Execution to S3 Data Leak
✍️ Never underestimate the power of open redirect, a story of a full account takeover
✍️ The 2.5 BTC Stored XSS
✍️ [DOM based XSS] Or why you should not rely on Cloudflare too much
✍️ Bypassing Firebase authorization to create custom goo.gl subdomains
✍️ Link injection on 2 Twitter Subdomain
✍️ Escaping Adobe Sandbox: Exploiting an Integer Overflow in Microsoft Windows Crypto Provider
✍️ $600 for IDOR (File or Folder Download)
✍️ A Pain in the NAS: Exploiting Cloud Connectivity to PWN your NAS: WD PR4100 Edition
✍️ Bypassing Safe-Redirect in Rails 7.0
✍️ How I find Open-Redirect Vulnerability in redacted.com (One of the top online payment processing service website)
✍️ Arbitrary File Write On Client By ADB Pull
✍️ Unleashing the Cloud: A Journey into Hacking College Servers and Uncovering Security Vulnerabilities
✍️ Cors Blimey: The power of chaining CORS
✍️ Business logic flaw in the invitation system allows to Takeover any account at a private company
✍️ AWS S3 bucket misconfiguration - Paytm
✍️ Not Your Stdout Bug - RCE in Cosmos SDK
✍️ Pwn2Own Austin 2021 : Defeating The Netgear R6700V3
✍️ Bug Bounty Collaboration and Manual Exploitation of an Interesting Boolean SQL Injection
✍️ XSS Vulnerabilities in Multiple iFrame Busters Affecting Top Tier Sites
✍️ Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032) – Overview and Mitigations
✍️ CVE-2021-22204 - Recreating a critical bug in ExifTool, no Perl smarts required.
✍️ crewjam/saml - IdP XSS Via Missing Binding Syntax Validation In ACS Location
✍️ Hacking the NHS for Fun and No Profit
✍️ FFUF and my first bounty
✍️ An interesting XXE in SAP.
✍️ The Importance of keeping up to date, or how I found an interesting bug thanks to a tweet
✍️ Page Admin Disclosure via an Upgraded Page Post
✍️ Reflected XSS on www.yahoo.com
✍️ Weird “Subdomain Take Over” pattern of Amazon S3
✍️ CVE-2022-1040 Sophos XG Firewall Authentication bypass
✍️ WordPress 5.1 CSRF to Remote Code Execution
✍️ Exploiting URL Parsers: The Good, Bad, And Inconsistent
✍️ How I was able to takeover Facebook account
✍️ Hack Your Form – New vector for Blind XSS
✍️ AngularJS Client-Side Template Injection: The orderBy Filter.
✍️ BMW Bug Bounty – Account Verification Bypass writeup
✍️ Assumed Breach Assessment Case Study: Uncovering WeSecureApp’s Approach
✍️ [No Bounty] CEH Practical Exam Review. A small review of my experience with… | by SpoopyHost
✍️ Finding Gem in Someone’s Report: Instant $500USD at HackerOne Platform
✍️ What I Found on Sony Vulnerability Disclosure Program
✍️ Pwning ManageEngine — From PoC to Exploit: A deep dive into CVE-2020–11531 and CVE-2020–11532
✍️ Zomatoooo! IDOR in Saved Payments
✍️ How I got RCE in + 10 websites…
✍️ ZDI-21-1053: Bypassing Windows Lock Screen
✍️ Power of Your Own Wordlist — Fuzz for Log File Leads to Information Leakage
✍️ [No Bounty] DoS Vulnerability in Smart Contracts | by Hacking articles
✍️ Social Media Take Over = Easy Money
✍️ How I escalate my Self-Stored XSS to Account Takeover with the help of IDOR
✍️ An Unusual Bug 🐛 on Braintree [PayPal]
✍️ My First Bug on VDP & BBP - Bug Bounty
✍️ Control Your Types Or Get Pwned: Remote Code Execution In Exchange Powershell Backend
✍️ Azure HDInsight: The Sequel – Unveiling 3 New Vulnerabilities That Could Have Led to Privilege Escalations and Denial of Service
✍️ Sleep SQL injection on Name Parameter While Updating Profile
✍️ How I Earned $469 Bounty: Bypassing Plan Restriction
✍️ Improper Privilege Management in Grails Spring Security Core <= 5.1.0 (CVE-2022-41923)
✍️ Blind SQL injection with a little WAF
✍️ Escalating From Reader To Contributor In Azure API Management
✍️ Google Bug Bounty: Clickjacking on Google Payment (1337$)
✍️ Stealing money from one account to another account
✍️ Iconv, Set The Charset To RCE: Exploiting The Glibc To Hack The PHP Engine (Part 2)
✍️ Firebase Exploit bug bounty
✍️ Recon in 2 minutes and got $250 easy
✍️ Internal path disclosure in Instagram server
✍️ How did i find information Disclosure on Facebook-Writeup
✍️ IDOR: Payment Fraud
✍️ GitHub Actions Exploitation: Self Hosted Runners
✍️ Three Microsoft Store vulnerabilites
✍️ A Tale Of Another SOP Bypass In Android Browser < 4.4
✍️ $1800 in less than an hour.
✍️ Can I See Your “USER AGENT” Please?
✍️ Google Chrome portal element fuzzing
✍️ The Story of Blind SSRF leads to internal Host discovery.
✍️ Write-up - Love story, from closed as informative to $3,500 USD, XSS stored in Yahoo! iOS MaiL app
✍️ How I found DOM XSS via postMessage on Bing.com - Microsoft Bug Bounty
✍️ PDFReacter SSRF to ROOT Level Local File Read which led to RCE
✍️ Source code leakage due to exposed sourcemap
✍️ Super Blind SQL Injection- $20000 bounty | Thousands of targets still vulnerable
✍️ CSS Injection via PostMessages to stealing Credit Card Info
✍️ Executing scripts in Safari Reader Mode to CSP Bypass
✍️ How a Single Parameter Led to Two ATO Cases
✍️ How I was able to delete 13k+ Microsoft Translator projects
✍️ Apple XAR – Arbitrary File Write (CVE-2021-30833)
✍️ Alternative link
✍️ How I Found A Simple Stored XSS
✍️ SSRF to fetch AWS credentials with full access to multiple services
✍️ WRITE UP – TELEGRAM BUG BOUNTY – WHATSAPP N/A [“Blind” XSS Stored iOS in messengers twins, who really care about your security?]
✍️ How we was able to takeover whole organization via Privilege Escalation
✍️ Bypassing WAF to Weaponize a Stored XSS
✍️ Beyond the wall: command injection still alive.
✍️ How I was able to see likes and dislikes count which is hidden by victim | YouTube #1
✍️ Part 2 - ProxyOracle!
✍️ Payload
✍️ How I Got Bugs From Google Dorks
✍️ From . in regex to SSRF — part 1
✍️ API Endpoint leads to Account Takeover In Android Application
✍️ First Valid BUG Finding At Microsoft And I Got the Acknowledgments Page Microsoft
✍️ CVE-2019-18426 - WhatsApp Vulnerabilities Disclosure - Open Redirect + CSP Bypass + Persistent XSS + FS read permissions + potential for RCE
✍️ Response Filter Denial of Service (RFDoS): shut down a website by triggering WAF rule
✍️ Testing a new encrypted messaging app's extraordinary claims
✍️ Bypass of biometrics & password security functionality for Android
✍️ ACSESSED: Cross-tenant network bypass in Azure Cognitive Search
✍️ Business Logic Error Methodology (easy way) + PoC-s
✍️ SOP Bypass
✍️ How I was able to track the location of any Tinder user.
✍️ Authentication bypass on Uber’s Single Sign-On via subdomain takeover
✍️ How I Hacked Dutch Government in 5 Minutes? Twitter Account Takeover
✍️ Securing Developer Tools: Git Integrations
✍️ #BugBounty — ”How I was able to hack any user account via password reset?”
✍️ POODLE SSLv3 bug on multiple twitter smtp servers
✍️ Find out the IP address through a call to Telegram…
✍️ Overwriting Banner Images on Etsy
✍️ OOB XXE in PrizmDoc (CVE-2018–15805)
✍️ Breaking the Barrier: Admin Panel Takeover Worth $3500
✍️ Reporting - Amazon 1 click device XSS
✍️ Hacking GitHub with Unicode’s dotless ‘i’
✍️ Remote Code Execution on Western Digital PR4100 NAS (CVE-2022-23121)
✍️ Interesting Privilege Escalation In an Old Private Program
✍️ XSS On Twitter [Worth 1120$]
✍️ How a simple bug in Facebook Lite let me win my first bug bounty from Facebook
✍️ Reflected DOM-based XSS on DomaiNesia
✍️ I scanned every package on PyPi and found 57 live AWS keys
✍️ Race conditions on Facebook, DigitalOcean and others (fixed)
✍️ This is how I was able to view anyone’s private email and birthday on Instagram
✍️ Account Takeover in Canvas Apps served in Comet due to failure in Cross-Window-Message Origin validation
✍️ Private giant chat app – Send message to victim while sender blocked
✍️ Facebook iOS address bar spoofing
✍️ How I found my first AEM related bug.
✍️ A Infinite Loop Story.
✍️ 403 bypass on a fortune 100 financial institution (P3)
✍️ Simple story of some complicated XSS on Facebook
✍️ This Man Thought Opening A TXT File Is Fine, He Thought Wrong. MacOS CVE-2019-8761
✍️ OS Command Injection in cPH2 Charging Station <2.0.0 (CVE-2023-46359 and CVE-2023-46360)
✍️ SSD Advisory – Zyxel VPN Series Pre-auth Remote Command Execution
✍️ XSS attacks on Googlebot allow search index manipulation
✍️ GitHub Pages - Multiple RCEs via insecure Kramdown configuration - $25,000 Bounty
✍️ XSS in Gmail's Amp4Email
✍️ How dangerous is Request Splitting, a vulnerability in Golang or how we found the RCE in Portainer and hacked Uber
✍️ Framing, Part 1: Click-Jacking Etsy
✍️ Microsoft Yammer Clickjacking – Exploiting HTML5 Security Features
✍️ Dropping root shell in a Crypto Exchange for Fun and Profitn't
✍️ Spear texting via parameter injection
✍️ Low hanging fruits on Facebook Group Room. Unable to remove post on group when post room add with event ($500)
✍️ Bug Bounty catches part -1
✍️ Weblogic Remote Code Execution (Exploiting CVE-2019-2725)
✍️ From Limited file read to full access on Jenkins (CVE-2024-23897)
✍️ How often do we overlook vulnerabilities?
✍️ $900 Blind XSS
✍️ Media deletion CSRF vulnerability on Instagram
✍️ Daniel Svartman
✍️ Open Redirection into Bentley System
✍️ Timing Attack on SQL Queries Through Lobste.rs Password Reset
✍️ SSD Advisory – VhdmpiValidateVirtualDiskSurface LPE
✍️ Oracle Access Manager Pre-Auth RCE (CVE-2021–35587 Analysis)
✍️ IDOR via Websockets
✍️ Abusing Microsoft Teams rate limiting for DDoS
✍️ Why you shouldn't use a commercial VPN: Amateur hour with Windscribe
✍️ Stored XSS via Invite leading to Mass Account Takeover at Opera.
✍️ Vulnerabilities In Apache Batik Default Security Controls – SSRF And RCE Through Remote Class Loading
✍️ How we got LFI in apache Drill (Recon like a boss)
✍️ Mangobaaz hacked | XSS to credentials exposure to pwn
✍️ CRLF Injection Into PHP’s cURL Options
✍️ How I found two api vulnerabilities by analyzing JS source code
✍️ IDOR FACEBOOK: malicious person add people to the “Top Fans”
✍️ Compromising HP SAN appliances
✍️ Stored XSS with two different parameters
✍️ Pwning child company to get access to ParentCompany’s Slack Team
✍️ XSS without HTML: Client-Side Template Injection with AngularJS
✍️ Fixing Typos And Breaching Microsoft’s Perimeter
✍️ Abusing Microsoft Teams Direct Routing
✍️ New npm Flaws Let Attackers Better Target Packages for Account Takeover
✍️ Interesting case of SQLi
✍️ Simple & Sweet: Bypass email update restriction to change emails of team members
✍️ One port can be a costly mistake | Attack The Rsync Service in a Private Program
✍️ My Fourth Account takeover through password reset
✍️ KindleDrip — From Your Kindle’s Email Address to Using Your Credit Card
✍️ Some ways to find more IDOR
✍️ $15k RCE Through Monitoring Debug Mode
✍️ From TOMCAT to NT AUTHORITY\SYSTEM
✍️ CraftCMS RCE
✍️ 2FA Bypass - IDN Mischief
✍️ XSS through DHCP: How Attackers Use Standards
✍️ Agent 007: Pre-Auth Takeover of Build Pipelines in GoCD
✍️ Blind XSS fired on Admin panel worth $2000
✍️ Price Manipulation Bypass Using Integer Overflow Method
✍️ Incident Response during Christmas
✍️ An Out Of Scope domain Leads To a Critical Bug[$1500]
✍️ Exploiting a double-edged SSRF for server and client-side impact
✍️ Bug Bounty: Bypassing a crappy WAF to exploit a blind SQL injection
✍️ Workplace Logo ID to workplace owner name Disclosure Facebook Bug Bounty
✍️ Ok Google! bypass ‘flag_secure’
✍️ CVE-2022-22947: SpEL Casting And Evil Beans
✍️ Detecting and exploiting mass-assignments in order to manipulate user columns and read private messages
✍️ Hyperlink Injection On IRC Cloud
✍️ Multiple xss in *.skype.com
✍️ Flickr XSS (Stored / DOM XSS)
✍️ The beauty of chaining client-side bugs
✍️ CVE-2022-26712: The POC for SIP-Bypass Is Even Tweetable
✍️ SQL Injection in private-site.com/login.php
✍️ Using a GitHub app to escalate to an organization owner for a $10,000 bounty
✍️ Ghost Sites: Stealing Data From Deactivated Salesforce Communities
✍️ Bring Your Own SSRF – The Gateway Actuator
✍️ Escalating SSTI to Reflected XSS using curly braces {}
✍️ Multiple Denial of Service (DoS) Vulnerabilities in GoProxy, Smokescreen libraries
✍️ My First Bug: A Unique $500 XSS.
✍️ Bypassing the macOS Gatekeeper
✍️ sqlol (CVE-2023-32422) - a macOS TCC bypass
✍️ Missing Authorization check while deleting App Review for Marketing API
✍️ Penetrating PornHub – XSS vulns galore (plus a cool shirt!)
✍️ Azure Monitor – Malicious KQL Query
✍️ PenTales: “User enumeration is not a vulnerability” – I beg to differ
✍️ Samsung Galaxy Apps MiTM vulnerabilities
✍️ Instagram’s Million Dollar Bug
✍️ Full Account Takeover via Changing Email And Password of any User through API Parameters
✍️ Pentest-Story: Empirum password decryption
✍️ Uploading files to api.techprep.fb.com
✍️ How did I find Log4j vulnerability via Static Code Analysis and receive €€€ bounty?
✍️ Exploiting Misconfigured CORS on popular BTC Site
✍️ How i made 500$ with XSS
✍️ Dependabot Confusion: Gaining Access to Private GitHub Repositories using Dependabot
✍️ WPML Multilingual CMS Authenticated Contributor+ Remote Code Execution (RCE) via Twig Server-Side Template Injection (SSTI)
✍️ Replying Comments On Someone’s Livestream From Page Is Posted As Personal Identity
✍️ Apache Dubbo Consumer Risks: The Road Not Taken
✍️ Authentication bypass on Ubiquity’s Single Sign-On via subdomain takeover
✍️ The first step to PWN2OWN - A sad one
✍️ How I could have hacked your Uber account
✍️ Making desync attacks easy with TRACE
✍️ REMOTE CODE EXECUTION ! 😜 Recon Wins
✍️ Escalating Privileges with Azure Function Apps
✍️ How to hack a company by circumventing its WAF through the abuse of a different security appliance and win bug bounties
✍️ Advisory: Western Digital My Cloud Pro Series PR4100 RCE
✍️ Oracle Cross Site Scripting Vulnerability -Adesh Kolte
✍️ Wiz Research finds architecture risks that may compromise AI-as-a-Service providers and consequently risk customer data; works with Hugging Face on mitigations
✍️ Blind XSS in Email Field; 1000$ bounty
✍️ How i was able to pwned application by Bypassing Cloudflare WAF
✍️ Gadgets chain in WordPress
✍️ The Bugs Are Out There, Hiding in Plain Sight
✍️ Bug Bounty Experience: Unvalidated Redirection Vulnerability
✍️ The Dark Side of Contact Forms: How I Identified 7 CVEs in WordPress Plugins
✍️ Account takeover via stored xss
✍️ Improper Access Control — My Third Finding on Hackerone!
✍️ Stored XSS at https://www.tiktok.com/ the name of the attacker’s account carrying XSS payload will be triggered when the victim Send Video
✍️ Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol
✍️ CVE-2022-28219: Unauthenticated XXE to RCE and Domain Compromise in ManageEngine ADAudit Plus
✍️ I Got United Nation’s Hall Of Fame With This Simple Technique!
✍️ Obtained a bunch of sensitive data in just few steps — Hacking
✍️ HTML and Hyperlink Injection via Share Option In Microsoft Onenote Application
✍️ Smashing the Modern Web Tech Stack — Part 1: The Evolving Threat Landscape in 2022 and DOM-based XSS in Cloud-Native React Apps.
✍️ BatBadBut: You can't securely execute commands on Windows
✍️ RCE Vulnerabilite in Yahoo Subdomain! ( Yahoo! RCE via Spring Engine SSTI ) By tghawkins
✍️ Bypassing LFI (Local File Inclusion)
✍️ Adminer Script Results to Pwning Server?, Private Bug Bounty Program
✍️ How I could have compromised any account on one of the biggest startup based in California
✍️ How, I dumped crypto data by chaining directory listing to open S3 Bucket
✍️ Blind Xss (A mind game to win the battle)
✍️ A subtle stored-XSS in WordPress core
✍️ Authorization bug that every bug hunter missed on a popular program
✍️ How I Prevented a Mass Data Breach - $15,000 bounty - @bxmbn
✍️ Don’t Trust the Host Header for Sending Password Reset Emails
✍️ XSS in hidden input fields
✍️ #BugBounty — “How I was able to shop for free!”- Payment Price Manipulation
✍️ Exploiting JWT - Lack of Signature Verification
✍️ Wind River VxWorks tarExtract directory traversal vulnerability (CVE-2023-38346)
✍️ The 3 Day Account Takeover
✍️ How I Get 5x Swag From Sony
✍️ [demo.paypal.com] Node.js code injection (RCE)
✍️ Piercing the Cloud Armor - The 8KB bypass in Google Cloud Platform WAF
✍️ Vertical Privilege Escalation: The user can takeover an admin account via response manipulation
✍️ Hacking Razer Pay Ewallet App
✍️ Reflected XSS Through Insecure Dynamic Loading
✍️ Reading Your Emails With A Read&Write Chrome Extension Same Origin Policy Bypass (~8 Million Users Affected)
✍️ How I Got $5,000 for Out-of-Scope XSS
✍️ Leaked Database and SMTP credentials through .env file
✍️ Do not trust this Group Policy!
✍️ XSS in hidden input field
✍️ Shambles: The Next-Generation IoT Reverse Engineering Tool to Discover 0-Day Vulnerabilities
✍️ Part 3
✍️ IDOR Vulnerability: A Journey to Full Account Takeover
✍️ RCE via WebDav - Power Of PUT
✍️ How I Earned $1800 for finding a (Business Logic) Account Takeover Vulnerability?
✍️ Multiple Host Header Attacks after bypassing protection with… a Header Attack
✍️ Security vs Compliance-Cloudflare Password Policy Restriction Bypass
✍️ SQL injection in harvard subdomain
✍️ GraphQL abuse: Bypass account level permissions through parameter smuggling
✍️ How I made 300 GitHub repos point to my blog using Azure subdomains takeover
✍️ CVE-2023-22524: RCE Vulnerability in Atlassian Companion for macOS
✍️ Broken Access Control & Stored XSS - Easy Hunt
✍️ Unauthorized access to Django Admin Dashboard by endpoint leaked on GitHub
✍️ Full Account Takeover via Referer Header (OAuth token Steal, Open Redirect Vulnerability Chaining)
✍️ How i hacked BBC mail servers
✍️ Bee-yond Capacity: Unauthenticated RCE in Extreme Networks/Aerohive Wireless APs - CVE-2023-35803
✍️ Reflected User Input == XSS!
✍️ A pair of Plotly bugs: Stored XSS and AWS Metadata SSRF
✍️ 1st Bug Bounty WriteUp: Open Redirect To XSS on Login Page
✍️ $10k host header
✍️ My Bug Bounty Journey and My First Critical Bug — Time Based Blind SQL Injection
✍️ Bypassing Crossdomain Policy and Hit Hundreds of Top Alexa Sites
✍️ How I Built An XSS Worm On Atmail
✍️ A business logic error bug worth 600$
✍️ How I was able to Takeover Accounts on Foxit.com
✍️ CVE-2021-30481: Source engine remote code execution via game invites
✍️ Getting SYSTEM on Windows in style
✍️ #BugBounty —” Database hacked of India’s Popular Sports company”-Bypassing Host Header to SQL injection to dumping Database — An unusual case of SQL injection.
✍️ DOM Purify - untrusted Node bypass
✍️ Variant Cloud Analysis
✍️ (CRITICAL) Blind Storage XSS — My first Bug Bounty 💰
✍️ How I Earned $$$ for Excessive Data Exposure Through Directory Traversal Leads to Product Price Manipulation
✍️ Safari is hot-linking images to semi-random websites
✍️ How I Could Steal Money from Instagram, Google and Microsoft
✍️ Get as image function pulls any Insights/NRQL data from any New Relic account (IDOR)
✍️ LFI to Command Execution: Deutche Telekom Bug Bounty
✍️ Stealing private messages using XSS on subdomain
✍️ LibreOffice Arbitrary File Write (CVE-2023-1883)
✍️ The code that wasn’t there: Reading memory on an Android device by accident
✍️ Facebook BugBounty: Tale of an Instagram bug disclosing user’s phone number via checkpoint
✍️ How I Found SQL Injection worth of $4,000 bounty
✍️ Account Takeover via Stored XSS
✍️ Open Sesame: Escalating Open Redirect to RCE with Electron Code Review
✍️ Exfiltrating AWS Credentials via PDF Rendering of Unsanitized Input
✍️ How i Almost got 2K$ through a Race condition
✍️ CVE-2022-32898: ANE_ProgramCreate() multiple kernel memory corruption
✍️ Bypass HackerOne 2FA requirement and reporter blacklist
✍️ Download Facebook internal mobile builds
✍️ Easy Bounty With Exposed Buckets & Blobs
✍️ Security Flaws within ChatGPT Ecosystem Allowed Access to Accounts On Third-Party Websites and Sensitive Data
✍️ Jumping Over The Fence
✍️ Disclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty program
✍️ How i bypassed AKAMAI KONA WAF , XSS in overstock.com !
✍️ Alternative link
✍️ An Accidental XSS on uu.nl
✍️ Walid Hossain (@NoobWalid)
✍️ Alternative link
✍️ Waze: How I Tracked Your Mother
✍️ Grand Theft Auto - A peek of BLE relay attack
✍️ Unauthenticated RCE in Adobe Coldfusion – CVE-2023-26360
✍️ Reflected XSS in Yahoo Subdomain ( hk.movies.yahoo.com )
✍️ Modifying any Ad Space and Placement
✍️ DNS Recursion Leads to DoS Attack Vivo Play (IPTV) — CVE-2023–31893
✍️ How I got $$$$ Bounty within 5 mins
✍️ “2022: A Year of Fascinating Discoveries”
✍️ When not to rely on Automated Tools
✍️ How I Saved Christmas for Google 🎄
✍️ How I found my first RCE!
✍️ Okta For Red Teamers
✍️ Open Redirect via Sendgrid Email Misconfiguration
✍️ How I was able to steal users credentials via Swagger UI DOM-XSS
✍️ CVE-2022-35405 Manage engines RCE (Password Manager Pro, PAM360 and Access Manager Plus)
✍️ Unrar Path Traversal Vulnerability affects Zimbra Mail
✍️ Two XSS Vulnerabilities in Azure with Embedded postMessage IFrames
✍️ [VDP] Stored XSS at acm.org – Shwani
✍️ How i found a 1500$ worth Deserialization vulnerability
✍️ IDOR (at Private Bug Bounty Program) that could Leads to Personal Data Leaks
✍️ My mindset while hunting on Yandex and my SSRF
✍️ Making an XSS triggered by CSP bypass on Twitter.
✍️ Disclose the Instagram account linked to a Facebook user account or page
✍️ Hacking into the worldwide Jacuzzi SmartTub network
✍️ How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE!
✍️ 20 Security Issues Found in Xiaomi Devices
✍️ How I was able to send Authentic Emails as others — Google VRP [Resolved]
✍️ Mail.Ru Ext.B Scope Account Takeover [ $1500 ]
✍️ Hacking Chess.com and Accessing 50 Million Customer Records
✍️ Hacking a Tapo TC60 Camera
✍️ Denial of service in Facebook Fizz due to integer overflow (CVE-2019-3560)
✍️ $55,000 Facebook token leak vs Funny Airline token leak.
✍️ InfluxDB Access at redact.8x8.com
✍️ Android Browser Same Origin Policy Bypass < 4.4 - CVE-2014-6041
✍️ Bypassing required reviews using GitHub Actions
✍️ Exploiting a “Useless” Cookie-Based XSS and Making it Useful
✍️ We Hacked Apple for 3 Months: Here’s What We Found
✍️ XSS to Database Credential Leakage & Database Access — Story of total luck!
✍️ Leaking Secrets From GitHub Actions: Reading Files And Environment Variables, Intercepting Network/Process Communication, Dumping Memory
✍️ How I got my first $13500 bounty through Parameter Polluting (HPP)
✍️ Exploiting Out Of Band XXE using internal network and php wrappers
✍️ TikTok for Android 1-Click RCE
✍️ SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250)
✍️ [web3] Critical bug in Spartan found by gogo
✍️ CVE-2021-4191: GitLab GraphQL API User Enumeration (FIXED)

Frequently Asked Questions

The following are frequently asked questions about common vulnerabilities and security misconfigurations found during bug bounty hunting. Understanding these concepts is crucial for anyone starting their bug hunting journey.

What is an XSS vulnerability? Cross-Site Scripting (XSS) attacks are a type of injection attack in which malicious scripts are inserted into otherwise trustworthy and innocuous websites. XSS attacks occur when an attacker uses a web application to send malicious code to a particular end user, usually in the form of a browser side script. The flaws that enable these attacks to succeed are common and can be found wherever a web application uses input from a user within the output it generates without validating or encoding it.

There are mainly 3 types of XSS:

What is an IDOR vulnerability? When a web application or API exposes a reference to an internal implementation object, it is referred to as Insecure Direct Object Reference (IDOR). This method exposes the element's true identifier and the data format it uses. This is a common access control flaw.

An example would be an API that gives you access to data belonging to other users, through an endpoint - /api/users/:id where an attacker can fetch data of any user by manipulating the id parameter.
What is an SSRF vulnerability? In a Server-Side Request Forgery (SSRF) attack, the attacker can read or update internal resources by abusing server features. The attacker may supply or change a URL to which the server's code can read or send data, and by carefully choosing the URLs, the attacker might be able to read server configuration such as AWS metadata, connect to an internal service, or access sensitive files.
What is a SQLi vulnerability? A SQL injection attack involves inserting or "injecting" a SQL query into the application through the client's input data. An effective SQL injection exploit can read sensitive data from the database, alter database data (Insert/Update/Delete), and even perform database administration operations.
What is an RCE vulnerability? If user input is inserted into a File or a String and then executed (evaluated) by the backend programming language's parser, a remote code execution (RCE) vulnerability can be exploited. A Remote Code Evaluation will result in the entire web application and web server being compromised as it allows an attacker to execute arbitrary commands on the server.
How can I reach you? If you have any feedback or, concerns about this site, I can be reached on Twitter.