pentester.land
Open in
urlscan Pro
2606:4700:3030::ac43:9606
Public Scan
Submission: On July 01 via manual from CA
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 14th 2020. Valid for: a year.
This is the only time pentester.land was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 4 | 2606:4700:303... 2606:4700:3030::ac43:9606 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 7 | 65.9.77.85 65.9.77.85 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:802::200a | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 23.45.110.243 23.45.110.243 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:80f::200e | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:827::2003 | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:82a::200e | 15169 (GOOGLE) (GOOGLE) | |
| 16 | 7 |
ASN16625 (AKAMAI-AS, US)
PTR: a23-45-110-243.deploy.static.akamaitechnologies.com
| mc.us17.list-manage.com |
ASN15169 (GOOGLE, US)
| www.google-analytics.com |
ASN15169 (GOOGLE, US)
| www.google-analytics.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
mailchimp.com
downloads.mailchimp.com |
87 KB |
| 4 |
pentester.land
pentester.land |
230 KB |
| 2 |
google-analytics.com
www.google-analytics.com |
19 KB |
| 1 |
gstatic.com
fonts.gstatic.com |
13 KB |
| 1 |
list-manage.com
mc.us17.list-manage.com |
2 KB |
| 1 |
googleapis.com
fonts.googleapis.com |
468 B |
| 16 | 6 |
| Domain | Requested by | |
|---|---|---|
| 7 | downloads.mailchimp.com |
pentester.land
downloads.mailchimp.com |
| 4 | pentester.land |
pentester.land
|
| 2 | www.google-analytics.com |
pentester.land
www.google-analytics.com |
| 1 | fonts.gstatic.com |
fonts.googleapis.com
|
| 1 | mc.us17.list-manage.com |
downloads.mailchimp.com
|
| 1 | fonts.googleapis.com |
pentester.land
|
| 16 | 6 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-08-14 - 2021-08-14 |
a year | crt.sh |
| downloads.mailchimp.com Amazon |
2020-07-10 - 2021-08-10 |
a year | crt.sh |
| upload.video.google.com GTS CA 1O1 |
2021-05-31 - 2021-08-23 |
3 months | crt.sh |
| wildcardsan.list-manage.com DigiCert Secure Site ECC CA-1 |
2020-08-26 - 2021-11-25 |
a year | crt.sh |
| *.google-analytics.com GTS CA 1C3 |
2021-06-07 - 2021-08-30 |
3 months | crt.sh |
| *.gstatic.com GTS CA 1C3 |
2021-06-07 - 2021-08-30 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://pentester.land/list-of-bug-bounty-writeups.html
Frame ID: 76112BBCD089458E3992C5D59FEA8CFA
Requests: 12 HTTP requests in this frame
Frame:
https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css
Frame ID: B422D2C51B5D6AEEE4AB98485BB56C5A
Requests: 2 HTTP requests in this frame
Frame:
https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css
Frame ID: 052F997D6892155D99D53A4591172702
Requests: 2 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare
(CDN)
Expand
Detected patterns
- headers server /^cloudflare$/i
Google Analytics
(Analytics)
Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Google Font API
(Font Scripts)
Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
3676 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)
Search URL Search Domain Scan URL
Title: Michael Stepankin (@artsploit)
Search URL Search Domain Scan URL
Title: gcp-dhcp-takeover-code-exec
Search URL Search Domain Scan URL
Title: How I found my first Chrome bug (CVE-2021–21210)
Search URL Search Domain Scan URL
Title: Misconfigured $3 Bucket - A Semi Opened Environment
Search URL Search Domain Scan URL
Title: Yukesh Kumar (@3th1c_yuk1)
Search URL Search Domain Scan URL
Title: Escalating XSS to Arbitrary File Read
Search URL Search Domain Scan URL
Title: Pethuraj (@Pethuraj)
Search URL Search Domain Scan URL
Title: Oversightboard.com site-wide CSRF due to missing checking
Search URL Search Domain Scan URL
Title: Samm0uda (@samm0uda)
Search URL Search Domain Scan URL
Title: Disclose unconfirmed email/phone of a Facebook user
Search URL Search Domain Scan URL
Title: Some ways to find more IDOR
Search URL Search Domain Scan URL
Title: Thái Vũ (@thaivd98)
Search URL Search Domain Scan URL
Title: Gaining access to protected components
Search URL Search Domain Scan URL
Title: DavMehtab Zafar (@0xmzfr)
Search URL Search Domain Scan URL
Title: From Information Disclosure to interesting Privilege Escalation
Search URL Search Domain Scan URL
Title: David Shaul (@dudy2kk)
Search URL Search Domain Scan URL
Title: PII Leakage - Revealing Secrets
Search URL Search Domain Scan URL
Title: Jerry Shah (@Jerry)
Search URL Search Domain Scan URL
Title: A supply-chain breach: Taking over an Atlassian account
Search URL Search Domain Scan URL
Title: Roman Zaikin (@R0m4nZ41k1n)
Search URL Search Domain Scan URL
Title: Oded Vanunu (@Od3dV)
Search URL Search Domain Scan URL
Title: Flywheel Subdomain Takeover
Search URL Search Domain Scan URL
Title: Smaran Chand (@smaranchand)
Search URL Search Domain Scan URL
Title: MSRC is confused! 😕
Search URL Search Domain Scan URL
Title: Ricardo Iramar dos Santos (@ricardo_iramar)
Search URL Search Domain Scan URL
Title: Microsoft Store free purschase vulnerabilites
Search URL Search Domain Scan URL
Title: Marlon Fabiano (@astrounder)
Search URL Search Domain Scan URL
Title: Three Microsoft Store vulnerabilites
Search URL Search Domain Scan URL
Title: How i was able to get Appreciation from the organization of a website just by changing a sign..!!!
Search URL Search Domain Scan URL
Title: Fardeen Ahmed (@fardeenahmed411)
Search URL Search Domain Scan URL
Title: Cracking Encrypted Credit Card Numbers Exposed By API
Search URL Search Domain Scan URL
Title: Craig Hays (@craighays)
Search URL Search Domain Scan URL
Title: Stored XSS via Invite leading to Mass Account Takeover at Opera.
Search URL Search Domain Scan URL
Title: Samrat Gupta (@Sm4rty_)
Search URL Search Domain Scan URL
Title: Unprivileged User with Read/Write permission to User Access can escalate their role to ADMIN — Privilege Escalation
Search URL Search Domain Scan URL
Title: Ertugrul Ozdemir (@ertugrulphp)
Search URL Search Domain Scan URL
Title: How I Found A Vulnerability To Hack iCloud Accounts and How Apple Reacted To It
Search URL Search Domain Scan URL
Title: Laxman Muthiyah (@laxmanmuthiyah)
Search URL Search Domain Scan URL
Title: Full Local File Read via Error Based XXE using XLIFF File
Search URL Search Domain Scan URL
Title: pwn.vg / Tomi (@mastomii)
Search URL Search Domain Scan URL
Title: Zero Click account Takeover
Search URL Search Domain Scan URL
Title: Zahir Tariq (@ZahirTariq3)
Search URL Search Domain Scan URL
Title: Exploiting File Upload Functionality in Unique Way.
Search URL Search Domain Scan URL
Title: Accessing Restricted Documents With Extra JSON Body Content
Search URL Search Domain Scan URL
Title: Imran Huda (@imranHudaA)
Search URL Search Domain Scan URL
Title: Account takeover via stored XSS with arbitrary file upload
Search URL Search Domain Scan URL
Title: 0xbadb00da (@0xbadb00da)
Search URL Search Domain Scan URL
Title: How We Are Able To Hack Any Company By Sending Message - $20,000 Bounty [CVE-2021–34506]
Search URL Search Domain Scan URL
Title: Video PoC
Search URL Search Domain Scan URL
Title: Th3Pr0xyB0y (@Th3Pr0xyB0y)
Search URL Search Domain Scan URL
Title: Shivam Kumar Singh (@MrRajputHacker)
Search URL Search Domain Scan URL
Title: Archived content
Search URL Search Domain Scan URL
Title: HTML Injection and a dream in Google Chrome for Linux (Write Up)
Search URL Search Domain Scan URL
Title: Evan Ricafort (@evanricafort)
Search URL Search Domain Scan URL
Title: Crashing your LinkedIn app with a connection request.
Search URL Search Domain Scan URL
Title: Renganathan (@renganathanofficial)
Search URL Search Domain Scan URL
Title: Why dynamic code loading could be dangerous for your apps: a Google example
Search URL Search Domain Scan URL
Title: Oversecured (@OversecuredInc)
Search URL Search Domain Scan URL
Title: Part-1 Dive into Zoom Applications
Search URL Search Domain Scan URL
Title: Rakesh Thodupunoori (@rakesh_3895)
Search URL Search Domain Scan URL
Title: Story of Google Hall of Fame and Private program bounty worth \(\)
Search URL Search Domain Scan URL
Title: Basavaraj Banakar (@basu_banakar)
Search URL Search Domain Scan URL
Title: One-click DOS via Response Manipulation
Search URL Search Domain Scan URL
Title: Authentication Bypass | Easy P1 in 10 minutes
Search URL Search Domain Scan URL
Title: Anirudh Makkar (@anirudhmakkar)
Search URL Search Domain Scan URL
Title: This is how I was able to see Private, Archived Posts/Stories of users on Instagram without following them
Search URL Search Domain Scan URL
Title: Mayur Fartade (@mayurfartade)
Search URL Search Domain Scan URL
Title: Importance of burp history analysis to bypass 403
Search URL Search Domain Scan URL
Title: Exploiting outdated Apache Airflow instances
Search URL Search Domain Scan URL
Title: Ian Carroll (@iangcarroll)
Search URL Search Domain Scan URL
Title: Stealing tokens, emails, files and more in Microsoft Teams through malicious tabs
Search URL Search Domain Scan URL
Title: Evan Grant (@stargravy)
Search URL Search Domain Scan URL
Title: An exciting journey to find SSRF , Bypass Cloudflare , and extract AWS metadata !
Search URL Search Domain Scan URL
Title: User’s location diclosure in the “Nearby Friends” feature. $15,500 Bounty
Search URL Search Domain Scan URL
Title: [Google VRP] Privilege escalation on https://dialogflow.cloud.google.com
Search URL Search Domain Scan URL
Title: lalka (@0x01alka)
Search URL Search Domain Scan URL
Title: Story of Account Takeover : Using Social Login with Mass Assignment Vulnerability to hack accounts !
Search URL Search Domain Scan URL
Title: How I found the silliest logical vulnerability for $750 that no one found for 3 years
Search URL Search Domain Scan URL
Title: Sina Kheirkhah (@Sin_Khe)
Search URL Search Domain Scan URL
Title: How I was able to bypass the admin panel without the credentials.
Search URL Search Domain Scan URL
Title: Pratikkhalane (@KhalanePratik)
Search URL Search Domain Scan URL
Title: Bypassing 2FA using OpenID Misconfiguration
Search URL Search Domain Scan URL
Title: Youstin (@iustinBB)
Search URL Search Domain Scan URL
Title: Two weeks of securing Samsung devices: Part 1
Search URL Search Domain Scan URL
Title: Second Order Race Condition
Search URL Search Domain Scan URL
Title: Prasoon Gupta (@0xdekster)
Search URL Search Domain Scan URL
Title: Unexpected IDOR Vulnerability in [REDACTED] - [redacted].net (Write Up)
Search URL Search Domain Scan URL
Title: Author spoofing in Google Colaboratory
Search URL Search Domain Scan URL
Title: How i was able to bypass parental pin of showmax
Search URL Search Domain Scan URL
Title: abdoul gadiri balde (@moodiAbdoul)
Search URL Search Domain Scan URL
Title: Story of my first cash bounty on hackerone.
Search URL Search Domain Scan URL
Title: Vedant Tekale (@_justYnot)
Search URL Search Domain Scan URL
Title: How I could have accessed all your private videos/photos saved inside your device without even unlocking it?
Search URL Search Domain Scan URL
Title: How Github recon help me to find NINE FULL SSRF Vulnerability with AWS metadata access
Search URL Search Domain Scan URL
Title: Santosh Kumar Sha (@killmongar1996)
Search URL Search Domain Scan URL
Title: Shopify Multipass Misconfiguration
Search URL Search Domain Scan URL
Title: Pop-Ups in a good-world
Search URL Search Domain Scan URL
Title: Guilherme Keerok (@k33r0k)
Search URL Search Domain Scan URL
Title: Executing CSRF With Phone Validation
Search URL Search Domain Scan URL
Title: 403 Forbidden Bypass
Search URL Search Domain Scan URL
Title: th3.d1p4k (@DipakPanchal05)
Search URL Search Domain Scan URL
Title: Android: Exploring vulnerabilities in WebResourceResponse
Search URL Search Domain Scan URL
Title: Server Side Request Forgery - A Forged Document
Search URL Search Domain Scan URL
Title: Bypassing LFI (Local File Inclusion)
Search URL Search Domain Scan URL
Title: Abhishek (@abhishake21)
Search URL Search Domain Scan URL
Title: XSS in the AWS Console
Search URL Search Domain Scan URL
Title: Nick Frichette (@frichette_n)
Search URL Search Domain Scan URL
Title: Exploiting Open Redirect - Whitelist Bypass Using Salesforce Environment
Search URL Search Domain Scan URL
Title: Gaurav Nayak (@4auvar)
Search URL Search Domain Scan URL
Title: Escalating SSRF to Accessing all user PII information by aws metadata
Search URL Search Domain Scan URL
Title: Facebook Page Admin Disclosure
Search URL Search Domain Scan URL
Title: Kunjan Nayak (@kunjannayak5)
Search URL Search Domain Scan URL
Title: AppCache’s forgotten tales
Search URL Search Domain Scan URL
Title: Luan Herrera (@lbherrera_)
Search URL Search Domain Scan URL
Title: runc mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs (CVE-2021-30465)
Search URL Search Domain Scan URL
Title: Metadata service MITM allows root privilege escalation (EKS / GKE)
Search URL Search Domain Scan URL
Title: Account Takeover via iFrame Injection
Search URL Search Domain Scan URL
Title: xbforce (@xbforce)
Search URL Search Domain Scan URL
Title: The beauty of chaining client-side bugs
Search URL Search Domain Scan URL
Title: Master SEC (@MasterSEC_AR)
Search URL Search Domain Scan URL
Title: CafeBazaar and Subdomain Takeover
Search URL Search Domain Scan URL
Title: Github, The Goldmine for P1s and P2s - Sensitive Information Exposure via Github by a Company Employee
Search URL Search Domain Scan URL
Title: Savir Suda (@savxiety)
Search URL Search Domain Scan URL
Title: Hey WAF! Better Luck Next Time! 👽
Search URL Search Domain Scan URL
Title: How I hacked a Target again and again…
Search URL Search Domain Scan URL
Title: Aditya Verma (@0cirius0)
Search URL Search Domain Scan URL
Title: Bypassing restricted port protection in WebKit
Search URL Search Domain Scan URL
Title: David Schütz (@xdavidhu)
Search URL Search Domain Scan URL
Title: GitLab Arbitrary File Read & Write through Kroki - CVE-2021-22203
Search URL Search Domain Scan URL
Title: Anh Duc Nguyen (@ledz1996)
Search URL Search Domain Scan URL
Title: Stored XSS with two different parameters
Search URL Search Domain Scan URL
Title: Joel Cantu (@InfosecRintox)
Search URL Search Domain Scan URL
Title: Chaining XSS with authentication issues to turn it into full account takeover
Search URL Search Domain Scan URL
Title: N1GHTMAR3 (@n1ghtmar3_2421)
Search URL Search Domain Scan URL
Title: Disclose leads form details of any Facebook Business Account or Facebook Page (Bug Bounty)
Search URL Search Domain Scan URL
Title: Amine Aboud (@amineaboud)
Search URL Search Domain Scan URL
Title: CORS misconfig that worths USD200
Search URL Search Domain Scan URL
Title: Finding and Exploiting Unintended Functionality in Main Web App APIs
Search URL Search Domain Scan URL
Title: Bend Theory (@bendtheory)
Search URL Search Domain Scan URL
Title: Victim’s Anti CSRF Token could be exposed to Third-party Applications installed on user’s Device (500$)
Search URL Search Domain Scan URL
Title: Rohit kumar (@rohitcoder)
Search URL Search Domain Scan URL
Title: CSRF from which we can create a support ticket in Victim’s Account (500$)
Search URL Search Domain Scan URL
Title: How I turned 0000 into $600: Phone Verification Bypass
Search URL Search Domain Scan URL
Title: Shrirang Diwakar
Search URL Search Domain Scan URL
Title: Oculus SSO “Account Linking” bug leads to account takeover on third party websites and inside VR Games/Apps
Search URL Search Domain Scan URL
Title: XSS via postMessage in chat.mozilla.org
Search URL Search Domain Scan URL
Title: Third-Party Apps were still getting your private Facebook data even after their access expiry.
Search URL Search Domain Scan URL
Title: Writeups: Facebook Whitehat program(2021): Instagram Live setting bug
Search URL Search Domain Scan URL
Title: Takashi Suzuki
Search URL Search Domain Scan URL
Title: SSRF in PDF Renderer using SVG
Search URL Search Domain Scan URL
Title: Time-Based SQL Injection to Dumping the Database
Search URL Search Domain Scan URL
Title: Naveen J (@thevillagehackr)
Search URL Search Domain Scan URL
Title: Finding my First Critical Web Cache Poisoning
Search URL Search Domain Scan URL
Title: Yasser Khan (@N3T_hunt3r)
Search URL Search Domain Scan URL
Title: Path Traversal in MobileSafari
Search URL Search Domain Scan URL
Title: Just Gopher It: Escalating a Blind SSRF to RCE for $15k
Search URL Search Domain Scan URL
Title: SirLeeroyJenkins (@SirLeeroyJenkin)
Search URL Search Domain Scan URL
Title: Clickjacking in Nearby Devices Dashboard
Search URL Search Domain Scan URL
Title: My Fourth Account takeover through password reset
Search URL Search Domain Scan URL
Title: Omar Hamdy (@seaman00o)
Search URL Search Domain Scan URL
Title: How i hijacked 12 Subdomains in one Program
Search URL Search Domain Scan URL
Title: Naveen kumawat (@nvk0x)
Search URL Search Domain Scan URL
Title: Auth Bypass in https://nearbydevices-pa.googleapis.com
Search URL Search Domain Scan URL
Title: MSSQL Injection In JSON Request
Search URL Search Domain Scan URL
Title: Kailash (@Corrupted_brain)
Search URL Search Domain Scan URL
Title: Edmodo Bug Bounty Writeup
Search URL Search Domain Scan URL
Title: 2FA Bypass via Forced Browsing
Search URL Search Domain Scan URL
Title: Mass Assignment exploitation in the wild - Escalating privileges in style
Search URL Search Domain Scan URL
Title: Gal Nagli (@naglinagli)
Search URL Search Domain Scan URL
Title: One-click reflected XSS in www.instagram.com due to unfiltered URI schemes leads to account takeover
Search URL Search Domain Scan URL
Title: Blind XSS on Google Internal System
Search URL Search Domain Scan URL
Title: Counter-Strike Global Offsets: reliable remote code execution
Search URL Search Domain Scan URL
Title: brymko (@brymko)
Search URL Search Domain Scan URL
Title: dezk (@cffsmith)
Search URL Search Domain Scan URL
Title: Simon Scannell (@scannell_simon)
Search URL Search Domain Scan URL
Title: How I find my first Stored XSS
Search URL Search Domain Scan URL
Title: Filipe Azevedo (@filipaze_)
Search URL Search Domain Scan URL
Title: My story of hacking Dutch Government
Search URL Search Domain Scan URL
Title: Tuhin Bose (@tuhin1729_)
Search URL Search Domain Scan URL
Title: CVE-2020-35580
Search URL Search Domain Scan URL
Title: hateshape (@hateshaped)
Search URL Search Domain Scan URL
Title: CVE-2021-27075: Microsoft Azure Vulnerability Allows Privilege Escalation and Leak of Private Data
Search URL Search Domain Scan URL
Title: 2FA Verification Bypass in Shapeshift [shapeshift.com] (Write Up)
Search URL Search Domain Scan URL
Title: Stored XSS to Organisation Takeover
Search URL Search Domain Scan URL
Title: Zaid Bhat (@zaidozaid)
Search URL Search Domain Scan URL
Title: Simple logical Bug turned into a bounty
Search URL Search Domain Scan URL
Title: Exploiting Activity in medium android app
Search URL Search Domain Scan URL
Title: Raju kumar (@MrCyberwarrior)
Search URL Search Domain Scan URL
Title: Unauthorized access to Django Admin Dashboard by endpoint leaked on GitHub
Search URL Search Domain Scan URL
Title: Microsoft bug bounty writeup
Search URL Search Domain Scan URL
Title: Workplace by Facebook | Unauthorized access to companies environment — $27,5k
Search URL Search Domain Scan URL
Title: Marcos Ferreira (@mvinni_)
Search URL Search Domain Scan URL
Title: Apple Bug bounty writeups XSS(2021)
Search URL Search Domain Scan URL
Title: Identify a Facebook user by his phone number despite privacy settings set
Search URL Search Domain Scan URL
Title: CVE-2021-1815 – MacOS Local Privilege Escalation Via Preferences
Search URL Search Domain Scan URL
Title: Offensive Security (@offsectraining)
Search URL Search Domain Scan URL
Title: How I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit
Search URL Search Domain Scan URL
Title: Account takeover of Instagram accounts due to unrestricted permissions of third-party application’s generated tokens
Search URL Search Domain Scan URL
Title: How I Found Sql Injection on intensedebate.com (h1) in 5 minute $350
Search URL Search Domain Scan URL
Title: Ahmad A Abdulla (@lu3ky13)
Search URL Search Domain Scan URL
Title: XSS Through Parameter Pollution
Search URL Search Domain Scan URL
Title: Saajan Bhujel (@saajanbhujel11)
Search URL Search Domain Scan URL
Title: Injecting Punycode URL Within the Arbitrary Text via Comment Box In Google Photo Sharing Option
Search URL Search Domain Scan URL
Title: Divyanshu Shukla (@justm0rph3u5)
Search URL Search Domain Scan URL
Title: ExifTool CVE-2021-22204 - Arbitrary Code Execution
Search URL Search Domain Scan URL
Title: William Bowling / vakzz (@wcbowling)
Search URL Search Domain Scan URL
Title: $20,000
Search URL Search Domain Scan URL
Title: Exploiting the Source Engine (Part 2) - Full-Chain Client RCE in Source using Frida
Search URL Search Domain Scan URL
Title: Exploiting the Source Engine (Part 1)
Search URL Search Domain Scan URL
Title: Geebz (@Gbps111)
Search URL Search Domain Scan URL
Title: Deep Dive into Open Source Bug Bounty
Search URL Search Domain Scan URL
Title: Ritik Sahni (@ritiksahni22)
Search URL Search Domain Scan URL
Title: Finding known exploits for bugbounties.
Search URL Search Domain Scan URL
Title: ipanda (@ipanda915)
Search URL Search Domain Scan URL
Title: IDOR Leads To Leak Any Uber Eats Restaurant Analytics
Search URL Search Domain Scan URL
Title: Prial Islam Khan (@prial261)
Search URL Search Domain Scan URL
Title: Basic recon to RCE
Search URL Search Domain Scan URL
Title: Joshua Martinelle (@J0_mart)
Search URL Search Domain Scan URL
Title: Chaining CSRF with XSS to deactivate Mass user accounts by single click
Search URL Search Domain Scan URL
Title: SSRF Through PDF Generation
Search URL Search Domain Scan URL
Title: How I found my first RCE?
Search URL Search Domain Scan URL
Title: Facebook account takeover due to unsafe redirects after the OAuth flow
Search URL Search Domain Scan URL
Title: My first OOB XXE exploitation
Search URL Search Domain Scan URL
Title: How I was able to Retrieve your Personal Documents using the Wayback Machine!
Search URL Search Domain Scan URL
Title: Exploiting memory corruption vulnerabilities on Android
Search URL Search Domain Scan URL
Title: $1,100
Search URL Search Domain Scan URL
Title: A tale of Html to Pdf converter ssrf and various bypasses
Search URL Search Domain Scan URL
Title: Jatin Aesthetic (@techyfreakk)
Search URL Search Domain Scan URL
Title: De-anonymising Anonymous Animals in Google Workspace
Search URL Search Domain Scan URL
Title: The False Oracle — Azure Functions Padding Oracle Issue
Search URL Search Domain Scan URL
Title: polarply (@polarply)
Search URL Search Domain Scan URL
Title: How did I earn €€€€ by breaking the back-end logic of the server
Search URL Search Domain Scan URL
Title: Dewanand Vishal (@dewcode91)
Search URL Search Domain Scan URL
Title: Reflected DOM-based XSS on DomaiNesia
Search URL Search Domain Scan URL
Title: Exploiting XSS via Markdown on Xiaomi
Search URL Search Domain Scan URL
Title: WordPress 5.7 XXE Vulnerability
Search URL Search Domain Scan URL
Title: $600
Search URL Search Domain Scan URL
Title: Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol
Search URL Search Domain Scan URL
Title: Antonio Cocomazzi (@splinter_code)
Search URL Search Domain Scan URL
Title: Andrea Pierini (@decoder_it)
Search URL Search Domain Scan URL
Title: Reflected XSS on Microsoft
Search URL Search Domain Scan URL
Title: From Wayback Machine To Account Takeover
Search URL Search Domain Scan URL
Title: Demon (@R29k_)
Search URL Search Domain Scan URL
Title: Supply Chain Attacks via GitHub.com Releases
Search URL Search Domain Scan URL
Title: Nightwatch Cybersecurity (@nightwatchcyber)
Search URL Search Domain Scan URL
Title: How I found Cross-Site-Scripting (Reflected) on more than 300 systems!
Search URL Search Domain Scan URL
Title: MR SINISTER (@KabirSuda)
Search URL Search Domain Scan URL
Title: RCE via Internal Access to Adminer Database Management (Critical)
Search URL Search Domain Scan URL
Title: Ahmad Halabi (@Ahmad_Halabi_)
Search URL Search Domain Scan URL
Title: AWS internal metadata accessed through SSRF by Chaining an Open Redirect bug
Search URL Search Domain Scan URL
Title: Page Owners Can’t remove or change page roles of deactivated users (or if Attacker blocks the page owner) in Facebook Lite, Facebook for Android and touch.facebook.com
Search URL Search Domain Scan URL
Title: Baibhav Anand (@SpongeBhav)
Search URL Search Domain Scan URL
Title: Brave — Stealing your cookies remotely
Search URL Search Domain Scan URL
Title: Pedro Oliveira (@kanytu)
Search URL Search Domain Scan URL
Title: Telegram bug bounties: XSS, privacy issues, official bot exploitation and more…
Search URL Search Domain Scan URL
Title: PrivateDrop: Breaking and Fixing Apple AirDrop
Search URL Search Domain Scan URL
Title: New Clubhouse Security Vulnerabilities Could Happen to Any Growing Unicorn
Search URL Search Domain Scan URL
Title: Katie Moussouris (@k8em0)
Search URL Search Domain Scan URL
Title: Remote code execution in Homebrew by compromising the official Cask repository
Search URL Search Domain Scan URL
Title: RyotaK (@ryotkak)
Search URL Search Domain Scan URL
Title: Got Nice catch by Google
Search URL Search Domain Scan URL
Title: Parth Desani (@DesaniParth)
Search URL Search Domain Scan URL
Title: How I was able to inject XSS payload into any user’s mailbox
Search URL Search Domain Scan URL
Title: Gaurav Popalghat (@N008x)
Search URL Search Domain Scan URL
Title: CVE-2021-30481: Source engine remote code execution via game invites
Search URL Search Domain Scan URL
Title: floesen (@floesen_)
Search URL Search Domain Scan URL
Title: Auth Bypass in Google Workspace Real Time Collaboration
Search URL Search Domain Scan URL
Title: Blind SSRF to Port Scanning through response time
Search URL Search Domain Scan URL
Title: Unauthorized access to admin setpassword page BY bypassing 403 Forbidden
Search URL Search Domain Scan URL
Title: (POC) Untrim any live video on Facebook
Search URL Search Domain Scan URL
Title: Exploiting Unrestricted File Upload to achieve Remote Code Execution on a bug bounty program
Search URL Search Domain Scan URL
Title: Jadek Mark (@mase289)
Search URL Search Domain Scan URL
Title: Pwning your assignments: Stored XSS via GraphQL endpoint
Search URL Search Domain Scan URL
Title: Kartik Sharma (@dominat0r98)
Search URL Search Domain Scan URL
Title: Misconfiguration in Change-password Functionality Leads to Account Takeover
Search URL Search Domain Scan URL
Title: Mahmoud Radwan (@0x___2m)
Search URL Search Domain Scan URL
Title: Mahmoud samaha (@0x__2m)
Search URL Search Domain Scan URL
Title: XSS via Exif Data - The P2 Elevator
Search URL Search Domain Scan URL
Title: (POC) Remove any Facebook’s live video ($14,000 bounty)
Search URL Search Domain Scan URL
Title: Lets Learn English - Hacking 10M+ Users
Search URL Search Domain Scan URL
Title: Aseem Shrey (@AseemShrey)
Search URL Search Domain Scan URL
Title: (POC) Update business fyi message as Facebook page analyst
Search URL Search Domain Scan URL
Title: How I earned \(\) through Stored XSS
Search URL Search Domain Scan URL
Title: Fun sql injection — mod_security bypass
Search URL Search Domain Scan URL
Title: Y000 (@Y000)
Search URL Search Domain Scan URL
Title: Allow arbitrary URLs, expect arbitrary code execution
Search URL Search Domain Scan URL
Title: How I got 9000 USD by hacking into iCloud
Search URL Search Domain Scan URL
Title: Alexandre Fernandes (@fernale)
Search URL Search Domain Scan URL
Title: Remote exploitation of a man-in-the-disk vulnerability in WhatsApp (CVE-2021-24027)
Search URL Search Domain Scan URL
Title: Vulnerability Spotlight: Multiple remote code execution vulnerabilities in Microsoft Azure Sphere
Search URL Search Domain Scan URL
Title: Google Photos : Theft of Database & Arbitrary Files Android Vulnerability
Search URL Search Domain Scan URL
Title: Rahul Kankrale (@RahulKankrale)
Search URL Search Domain Scan URL
Title: You Talking To Me?
Search URL Search Domain Scan URL
Title: Li JianTao (@cursered)
Search URL Search Domain Scan URL
Title: ELECTRIC CHROME - CVE-2020-6418 on Tesla Model 3
Search URL Search Domain Scan URL
Title: Chris Williams (@HawaiiFive0day)
Search URL Search Domain Scan URL
Title: Unauthenticated Account Takeover Through Forget Password
Search URL Search Domain Scan URL
Title: Nikhil (niks) (@niksthehacker)
Search URL Search Domain Scan URL
Title: Stored XSS on the DuckDuckGo search results page
Search URL Search Domain Scan URL
Title: PMOC (@pmofcats)
Search URL Search Domain Scan URL
Title: Cookie poisoning leads to DoS and Privacy Violation
Search URL Search Domain Scan URL
Title: (CRITICAL) Blind Storage XSS — My first Bug Bounty 💰
Search URL Search Domain Scan URL
Title: What if you could deposit money into your Betting account for free? Oh wait where has this 25k came from…
Search URL Search Domain Scan URL
Title: Mikey (@mikey96_bh)
Search URL Search Domain Scan URL
Title: Chaining an Blind SSRF bug to Get an RCE
Search URL Search Domain Scan URL
Title: I Built a TV That Plays All of Your Private YouTube Videos
Search URL Search Domain Scan URL
Title: Apple TV for Fire OS code execution
Search URL Search Domain Scan URL
Title: Razvan Sima (@0xraaz)
Search URL Search Domain Scan URL
Title: Cloud Based Storage Misconfigurations -> Critical Bounties
Search URL Search Domain Scan URL
Title: Weird and very easy authentication bypass found with Google dorking
Search URL Search Domain Scan URL
Title: GrumpinouT (@RVerwilghen)
Search URL Search Domain Scan URL
Title: Intro to Open-source Bug Bounty
Search URL Search Domain Scan URL
Title: Arjun Shibu (@0xsegf)
Search URL Search Domain Scan URL
Title: CSRF in YouTube Leanback API
Search URL Search Domain Scan URL
Title: Breaking GitHub Private Pages for $35k
Search URL Search Domain Scan URL
Title: Robert Chen (@NotDeGhost)
Search URL Search Domain Scan URL
Title: Remote code execution through unsafe unserialize in PHP
Search URL Search Domain Scan URL
Title: Journeys in Quoteless and Multi Reflection XSS
Search URL Search Domain Scan URL
Title: RCE on Starbucks Singapore and more for $5600
Search URL Search Domain Scan URL
Title: Kamil Onur Özkaleli (@ko2sec)
Search URL Search Domain Scan URL
Title: Automate Cache Poisoning Vulnerability - Nuclei
Search URL Search Domain Scan URL
Title: Mohamed Elbadry (@_melbadry9)
Search URL Search Domain Scan URL
Title: This Man Thought Opening A TXT File Is Fine, He Thought Wrong. MacOS CVE-2019-8761
Search URL Search Domain Scan URL
Title: Paulos Yibelo (@PaulosYibelo)
Search URL Search Domain Scan URL
Title: Bragging Rights: Let’s head back to bug bucket
Search URL Search Domain Scan URL
Title: Manas Harsh (@ManasH4rsh)
Search URL Search Domain Scan URL
Title: XSS in Large Messenger and Payment App - a Shout Out to Parameter Guessing
Search URL Search Domain Scan URL
Title: Lauritz (@lauritz)
Search URL Search Domain Scan URL
Title: Play a game, get Subscribed to my channel - YouTube Clickjacking Bug | #GoogleVRP
Search URL Search Domain Scan URL
Title: Sriram Kesavan (@sriramoffcl)
Search URL Search Domain Scan URL
Title: Who Contains the Containers?
Search URL Search Domain Scan URL
Title: James Forshaw (@tiraniddo)
Search URL Search Domain Scan URL
Title: Facebook account takeover due to a wide platform bug in ajaxpipe responses
Search URL Search Domain Scan URL
Title: Facebook account takeover due to a bypass of allowed callback URLs in the OAuth flow
Search URL Search Domain Scan URL
Title: Zero click vulnerability in Apple’s macOS Mail
Search URL Search Domain Scan URL
Title: Mikko Kenttälä (@Turmio_)
Search URL Search Domain Scan URL
Title: Download Facebook internal mobile builds
Search URL Search Domain Scan URL
Title: Philippe Harewood (@phwd)
Search URL Search Domain Scan URL
Title: Missing CORS leads to Complete Account Takeover
Search URL Search Domain Scan URL
Title: Niraj Modi (@nirajmodi51)
Search URL Search Domain Scan URL
Title: I felt like there were no more bugs left after winning € 2000 … But an email worth €750 changed my mind
Search URL Search Domain Scan URL
Title: Thexssrat (@theXSSrat)
Search URL Search Domain Scan URL
Title: A weird XSS
Search URL Search Domain Scan URL
Title: CSRF to Full Account Takeover
Search URL Search Domain Scan URL
Title: Ashraf Harb (@ashrafharb97)
Search URL Search Domain Scan URL
Title: PHP fopen() function to local file inclusion
Search URL Search Domain Scan URL
Title: أنس روبي (@xhzeem)
Search URL Search Domain Scan URL
Title: How I made to Paypal Bug Bounty $750
Search URL Search Domain Scan URL
Title: How to bypass CloudFlare bot protection ?
Search URL Search Domain Scan URL
Title: jychp (@jychp_fr)
Search URL Search Domain Scan URL
Title: Increasing impact of Information Disclosure — Full Account Takeover !
Search URL Search Domain Scan URL
Title: Abhisek R (@abh1sek_r)
Search URL Search Domain Scan URL
Title: Encrypted Payload -> Decrypted Execution ($600) : Stored XSS
Search URL Search Domain Scan URL
Title: PoC: The easiest 125 Euro’s I Ever made
Search URL Search Domain Scan URL
Title: Exif meta data worth $XXXX
Search URL Search Domain Scan URL
Title: Saddam Hussain (@wisdomfreak1)
Search URL Search Domain Scan URL
Title: How I leveraged XSS to make Privilege Escalation to be Super Admin!
Search URL Search Domain Scan URL
Title: Asem Eleraky (@melotover)
Search URL Search Domain Scan URL
Title: Multiple Authorization bypass issues in Google’s Richmedia Studio
Search URL Search Domain Scan URL
Title: Bypass rate limit to enumeration users through Google Drive
Search URL Search Domain Scan URL
Title: Abdullah Mohamed (@3bodymo_)
Search URL Search Domain Scan URL
Title: Finding and exploiting race condition vulnerability on facebook server
Search URL Search Domain Scan URL
Title: Ad portals and the half blood vulnerability
Search URL Search Domain Scan URL
Title: Adam (@whitechaitai)
Search URL Search Domain Scan URL
Title: How I made it to Google HOF?
Search URL Search Domain Scan URL
Title: Sudhanshu Rajbhar (@sudhanshur705)
Search URL Search Domain Scan URL
Title: Finding My First Critical Vulnerability
Search URL Search Domain Scan URL
Title: OTP brute-force via rate limit bypass
Search URL Search Domain Scan URL
Title: Bilal Muqeet (@blmqt)
Search URL Search Domain Scan URL
Title: Cross Site Port Attack - A Stranger’s Call
Search URL Search Domain Scan URL
Title: OAuth Misconfiguration found in small time-window of attack
Search URL Search Domain Scan URL
Title: Muhammad Aamir (@Muhammad__Aamir)
Search URL Search Domain Scan URL
Title: A short story about an XSS in chat.mozilla.org (CVE-2021-21320)
Search URL Search Domain Scan URL
Title: Walleson Moura (@phor3nsic_br)
Search URL Search Domain Scan URL
Title: How to Harpon Big Blue!
Search URL Search Domain Scan URL
Title: Clark Voss (@clark_voss)
Search URL Search Domain Scan URL
Title: H2C Smuggling in the Wild
Search URL Search Domain Scan URL
Title: Sean Yeoh (@seanyeoh)
Search URL Search Domain Scan URL
Title: TikTok for Android 1-Click RCE
Search URL Search Domain Scan URL
Title: Sayed Abdelhafiz (@dPhoeniixx)
Search URL Search Domain Scan URL
Title: How I hacked Facebook: Part Two
Search URL Search Domain Scan URL
Title: Alaa Abdulridha (@alaa0x2)
Search URL Search Domain Scan URL
Title: Stealing arbitrary GitHub Actions secrets
Search URL Search Domain Scan URL
Title: Teddy Katz (@not_aardvark)
Search URL Search Domain Scan URL
Title: Dangling DNS: Worksites.net
Search URL Search Domain Scan URL
Title: Abusing Data Protection Laws For D0xing & Account Takeovers
Search URL Search Domain Scan URL
Title: Hx01 (@Hxzeroone)
Search URL Search Domain Scan URL
Title: CVE-2021-27076: A Replay-style Deserialization Attack Against Sharepoint
Search URL Search Domain Scan URL
Title: Simon Zuckerbraun (@HexKitchen)
Search URL Search Domain Scan URL
Title: An unknown Linux secret that turned SSRF to OS Command injection
Search URL Search Domain Scan URL
Title: secureITmania (@secureitmania)
Search URL Search Domain Scan URL
Title: An Interesting Account Takeover!!
Search URL Search Domain Scan URL
Title: Mayank Pandey (@mayank_pandey01)
Search URL Search Domain Scan URL
Title: Voice Confusion When Commenting On Watch Party
Search URL Search Domain Scan URL
Title: Prakash Panta (@prakashpanta268)
Search URL Search Domain Scan URL
Title: API Misconfiguration which leads to unauthorized access to servicedesk tickets
Search URL Search Domain Scan URL
Title: De-anonymize the members of a private Facebook Group as a non-member.
Search URL Search Domain Scan URL
Title: Facebook Group Members Disclosure.
Search URL Search Domain Scan URL
Title: IDOR Vulenebility with empty response still exposing sensitive details of customers!
Search URL Search Domain Scan URL
Title: Rahul Varale
Search URL Search Domain Scan URL
Title: How I Found Sql Injection on 8x8 , Cengage,Comodo,Automattic,20 company
Search URL Search Domain Scan URL
Title: Finding keys under the door
Search URL Search Domain Scan URL
Title: Account Takeover Via Reset Password Worth 2000$
Search URL Search Domain Scan URL
Title: Ashutosh mishra (@ashutoshmish_ra)
Search URL Search Domain Scan URL
Title: [Google VRP] How I Get Blind XSS At Google With Dork (First Bounty and HOF )
Search URL Search Domain Scan URL
Title: Rio Mulyadi (@riomulyadi_)
Search URL Search Domain Scan URL
Title: Messing with GitHub’s fork collaboration for fun and profit
Search URL Search Domain Scan URL
Title: Business Logic Error on Registration Leads to SMS Validation Bypass
Search URL Search Domain Scan URL
Title: pleorqy (@pleorqy)
Search URL Search Domain Scan URL
Title: Chain of Low Level Bugs and Misconfigurations Leads to Account Takeover
Search URL Search Domain Scan URL
Title: Finding Basic Authtoken in JAVASCRIPT file BY Full Automation
Search URL Search Domain Scan URL
Title: Write Up – Google VRP N/A: SSRF Bypass With Quadzero In Google Cloud Monitoring
Search URL Search Domain Scan URL
Title: @omespino
Search URL Search Domain Scan URL
Title: Dangling DNS: Amazon EC2 IPs (Current State)
Search URL Search Domain Scan URL
Title: Stored XSS in Google Ads Android Application— $3133.70
Search URL Search Domain Scan URL
Title: Ashish Dhone (@ashketchum_16)
Search URL Search Domain Scan URL
Title: Finding Hidden Login Endpoint Exposing Secret Client ID
Search URL Search Domain Scan URL
Title: Exploiting a hidden and forgotten Bug
Search URL Search Domain Scan URL
Title: The easiest $2500 I got it from bug bounty program
Search URL Search Domain Scan URL
Title: Leveraging Template injection to takeover an account.
Search URL Search Domain Scan URL
Title: Akash Methani (@0xAkash)
Search URL Search Domain Scan URL
Title: Low hanging fruits on Facebook Group Room. Unable to remove post on group when post room add with event ($500)
Search URL Search Domain Scan URL
Title: Stored XSS at Trello.com
Search URL Search Domain Scan URL
Title: Maor Dayan (@mord1234)
Search URL Search Domain Scan URL
Title: Content Injection (RCE) in Yandex Browser for Android [2018]
Search URL Search Domain Scan URL
Title: The Invincible Kid
Search URL Search Domain Scan URL
Title: How I Might Have Hacked Any Microsoft Account
Search URL Search Domain Scan URL
Title: Exploiting CORS to perform an IDOR Attack leading to PII Information Disclosure
Search URL Search Domain Scan URL
Title: Harsh Parekh (@notmarshmllow)
Search URL Search Domain Scan URL
Title: Secret Key Exposure in API Config Directory
Search URL Search Domain Scan URL
Title: Join Facebook Group With Unpublish Page
Search URL Search Domain Scan URL
Title: SSRF to fetch AWS credentials with full access to multiple services
Search URL Search Domain Scan URL
Title: Zonduhackerone (@zonduu1)
Search URL Search Domain Scan URL
Title: Big Bugs: Bitbucket Pipelines Kata Containers Build Container Escape
Search URL Search Domain Scan URL
Title: Alex Chapman (@ajxchapman)
Search URL Search Domain Scan URL
Title: Admin Panel Accessed Via SQL Injection… (Ezy Boooom…😅)
Search URL Search Domain Scan URL
Title: Bragging Rights: Killing File Uploads softly
Search URL Search Domain Scan URL
Title: Jira Auth Bypass bug in Google Acquisition (Apigee)
Search URL Search Domain Scan URL
Title: Jayateertha Guruprasad (@JayateerthaG)
Search URL Search Domain Scan URL
Title: Somebody Call The Plumber, GraphQL is Leaking Again…
Search URL Search Domain Scan URL
Title: Story About Stop 10000+ users to get Their job notification
Search URL Search Domain Scan URL
Title: IDOR which allowed me to view Personal Email Addresses of More than 50K Users!
Search URL Search Domain Scan URL
Title: SSRF: Bypassing hostname restrictions with fuzzing
Search URL Search Domain Scan URL
Title: Dominic (@dee__see)
Search URL Search Domain Scan URL
Title: Account Takeover - Smoking with ‘null’
Search URL Search Domain Scan URL
Title: Stealing user passwords through a VPN’s SSO
Search URL Search Domain Scan URL
Title: Alain Mowat (@plopz0r)
Search URL Search Domain Scan URL
Title: Poisoning your Cache for 1000$ - Approach to Exploitation Walkthrough
Search URL Search Domain Scan URL
Title: Hijacking Reset Password Link in https://www.niteflirt.com/ via Host Header Poising (Write Up)
Search URL Search Domain Scan URL
Title: CSRF through URL with # tag parameter
Search URL Search Domain Scan URL
Title: CVE-2021-23827: Sakura Samurai discover cleartext pictures in Keybase Desktop Client; Windows, macOS, Linux
Search URL Search Domain Scan URL
Title: John Jackson (@johnjhacking)
Search URL Search Domain Scan URL
Title: $1,000
Search URL Search Domain Scan URL
Title: Grafana Admin Panel bypass in Google Acquisition(VirusTotal)
Search URL Search Domain Scan URL
Title: Let’s know How I have explored the buried secrets in Xamarin application
Search URL Search Domain Scan URL
Title: RCE On A Laravel Private Program
Search URL Search Domain Scan URL
Title: Yasho (@YShahinzadeh)
Search URL Search Domain Scan URL
Title: Is Math.random() Safe? from missing rate limit to bypass 2fa and possible sqli
Search URL Search Domain Scan URL
Title: Yasser Mohammed (@boomneroli)
Search URL Search Domain Scan URL
Title: Account Takeover via Response Manipulation worth 1800$..
Search URL Search Domain Scan URL
Title: Build Pipeline Security
Search URL Search Domain Scan URL
Title: xssfox (@xssfox)
Search URL Search Domain Scan URL
Title: Account Take Over by Response Manipulation
Search URL Search Domain Scan URL
Title: Expose information about Partner accounts in Partner portal
Search URL Search Domain Scan URL
Title: Expose Facebook object type (including private objects)
Search URL Search Domain Scan URL
Title: Ability to find Facebook employee’s test accounts which lead to the disclosure of internal information.
Search URL Search Domain Scan URL
Title: Disclose internal CMS objects content
Search URL Search Domain Scan URL
Title: Confirm if an invitation is sent to a specific email in Partners Portal / Possibility to resend the invitation
Search URL Search Domain Scan URL
Title: XSS in Facebook CDN due to improper filtering of uploaded files extensions
Search URL Search Domain Scan URL
Title: Enumerate internal cached URLs which lead to data exposure
Search URL Search Domain Scan URL
Title: Make recruiting referrals on behalf of employees
Search URL Search Domain Scan URL
Title: Leaking Facebook user information to external websites / Setting some cookies values
Search URL Search Domain Scan URL
Title: Access private information about SparkAR effect owners who has a publicly viewable portfolio
Search URL Search Domain Scan URL
Title: Open redirect in Instagram.com
Search URL Search Domain Scan URL
Title: Story of a very lethal IDOR.
Search URL Search Domain Scan URL
Title: From AWS S3 Misconfiguration to Sensitive Data Exposure
Search URL Search Domain Scan URL
Title: Dangling DNS Records leading to Sub-domain Takeover on api.techprep.fb.com!
Search URL Search Domain Scan URL
Title: Binit Ghimire (@WHOISbinit)
Search URL Search Domain Scan URL
Title: Hunting for bugs in Telegram’s animated stickers remote attack surface
Search URL Search Domain Scan URL
Title: polict (@polict_)
Search URL Search Domain Scan URL
Title: Access files uploaded by employees to internal CDNs / Regenerate URL signature of user uploaded content.
Search URL Search Domain Scan URL
Title: Full account takeover worth $1000 Think out of the box
Search URL Search Domain Scan URL
Title: Mohsin Khan (@mokhansec)
Search URL Search Domain Scan URL
Title: Delete linked payments accounts of a Facebook page (or user)
Search URL Search Domain Scan URL
Title: URLs in img tag aren’t passed through safe_image.php which lead to exposure of Facebook users IPs.
Search URL Search Domain Scan URL
Title: Leak of internal categorySets names and employees test accounts.
Search URL Search Domain Scan URL
Title: View orders and financial reports lists for any page shop
Search URL Search Domain Scan URL
Title: Header manipulation to get the premier feature for free
Search URL Search Domain Scan URL
Title: Stored XSS in icloud.com — $5000
Search URL Search Domain Scan URL
Title: My first bounty (stored-xss)
Search URL Search Domain Scan URL
Title: Karan sharma (@karansh491)
Search URL Search Domain Scan URL
Title: IDOR via Websockets allow me to takeover any users account
Search URL Search Domain Scan URL
Title: How I Hacked Everyone’s Resume/CV’s and Got €€€
Search URL Search Domain Scan URL
Title: Changing other users Episode title & description - IDOR Vulnerability in [REDACTED] (Write Up)
Search URL Search Domain Scan URL
Title: [GITLAB] — Server Side Request Forgery in “Project Import” page.
Search URL Search Domain Scan URL
Title: [GITLAB] — Just another SSRF issue.
Search URL Search Domain Scan URL
Title: OAuth Misconfiguration Leads to Full Account takeover
Search URL Search Domain Scan URL
Title: How I was able to get extra coins
Search URL Search Domain Scan URL
Title: Leaked Credentials gives access to internalfb.com
Search URL Search Domain Scan URL
Title: Hacking Chess.com and Accessing 50 Million Customer Records
Search URL Search Domain Scan URL
Title: Sam Curry (@samwcyo)
Search URL Search Domain Scan URL
Title: The “P” in Telegram stands for Privacy
Search URL Search Domain Scan URL
Title: Dhiraj (@RandomDhiraj)
Search URL Search Domain Scan URL
Title: Escalating reflected XSS with HTTP Smuggling
Search URL Search Domain Scan URL
Title: Hazana (@hazanasec)
Search URL Search Domain Scan URL
Title: Fastest Subdomain Take Over & DNS Misconfiguration Hunt.
Search URL Search Domain Scan URL
Title: Kabeer (@iTheKabeer)
Search URL Search Domain Scan URL
Title: Sending ephemeral message to any Facebook user
Search URL Search Domain Scan URL
Title: A Tale of 2nd $xxx Bounty from Facebook
Search URL Search Domain Scan URL
Title: Self-XSS to rXSS via Uploaded File Name
Search URL Search Domain Scan URL
Title: P4nda (@InfoSecP4nda)
Search URL Search Domain Scan URL
Title: Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies
Search URL Search Domain Scan URL
Title: Alex Birsan
Search URL Search Domain Scan URL
Title: Abusing URI Parsers for fun and profit
Search URL Search Domain Scan URL
Title: Mohammad Owais (@_mohammadowais)
Search URL Search Domain Scan URL
Title: Duplicate Registration - The Twinning Twins
Search URL Search Domain Scan URL
Title: Bigbasket Bug Bounty Writeup
Search URL Search Domain Scan URL
Title: Lohith Gowda M (@lohi_gowda_)
Search URL Search Domain Scan URL
Title: Reflected XSS on a Public Program
Search URL Search Domain Scan URL
Title: How I Gain Access to the Server Administration of a Million-Dollar Company
Search URL Search Domain Scan URL
Title: Escalating SSRF to RCE
Search URL Search Domain Scan URL
Title: Sander Wind (@SanderWind)
Search URL Search Domain Scan URL
Title: XXE To AWS Metadata Disclosure
Search URL Search Domain Scan URL
Title: Al-Madjus (@AlMadjus)
Search URL Search Domain Scan URL
Title: Facebook Messenger Desktop App Arbitrary File Read
Search URL Search Domain Scan URL
Title: Renwa (@RenwaX23)
Search URL Search Domain Scan URL
Title: Page Admin Disclosed In Groups Due To Improper Session Handling In Facebook Web
Search URL Search Domain Scan URL
Title: Redwood Report2Web XSS and Frame injection
Search URL Search Domain Scan URL
Title: vict0ni (@vict0ni)
Search URL Search Domain Scan URL
Title: Bug bounty failure stories to learn from: how we ended up to hack a bank with no reward
Search URL Search Domain Scan URL
Title: Red Timmy Security (@redtimmysec)
Search URL Search Domain Scan URL
Title: Open Redirect vulnerability found using link parameter
Search URL Search Domain Scan URL
Title: Microsoft Remote Desktop Web Access Authentication Timing Attack
Search URL Search Domain Scan URL
Title: How I was able to Turn a XSS into a Account Takeover
Search URL Search Domain Scan URL
Title: Josh Fam (@Pullerze)
Search URL Search Domain Scan URL
Title: Spoofing and Attacking With Skype
Search URL Search Domain Scan URL
Title: mr.d0x (@mrd0x)
Search URL Search Domain Scan URL
Title: Stealing Chat session ID with CORS and execute CSRF attack
Search URL Search Domain Scan URL
Title: Sunil Yedla (@sunilyedla2)
Search URL Search Domain Scan URL
Title: Applying Offensive Reverse Engineering to Facebook Gameroom
Search URL Search Domain Scan URL
Title: Eugene Lim (@spaceraccoonsec)
Search URL Search Domain Scan URL
Title: 1st Facebook Bug Bounty | Disclose page’s admin to mod/admin of group
Search URL Search Domain Scan URL
Title: nhiephon (@_nhiephon)
Search URL Search Domain Scan URL
Title: Access developer tasks list of any Facebook Application (GraphQL IDOR)
Search URL Search Domain Scan URL
Title: Disclose the FB profile of Facebook employees who create official announcement messages (Bug Bounty)
Search URL Search Domain Scan URL
Title: An Account Takeover Vulnerability Due to Response Manipulation.
Search URL Search Domain Scan URL
Title: Avanish Pathak (@avanish46)
Search URL Search Domain Scan URL
Title: An unexpected bug
Search URL Search Domain Scan URL
Title: Nitin yadav (@Nitinydv14)
Search URL Search Domain Scan URL
Title: An Interesting Account Takeover Vulnerability
Search URL Search Domain Scan URL
Title: Android apk leaks access token to takeover the whole infrastructure
Search URL Search Domain Scan URL
Title: How I chained P4 To P2 [Open Redirection To Full Account Takeover]
Search URL Search Domain Scan URL
Title: Bishal Shrestha (@bishal0x01)
Search URL Search Domain Scan URL
Title: Broken Access Control & Stored XSS - Easy Hunt
Search URL Search Domain Scan URL
Title: Destroying Armies and Villages through Cross-Site Scripting - Bug Bounty Write-up
Search URL Search Domain Scan URL
Title: Fábio Freitas (@0xfabiof)
Search URL Search Domain Scan URL
Title: Cors Blimey: The power of chaining CORS
Search URL Search Domain Scan URL
Title: Launching Internal & Non-Exported Deeplinks On Facebook
Search URL Search Domain Scan URL
Title: Ashley King (@AshleyKingUK)
Search URL Search Domain Scan URL
Title: Analysing Crash Messages To Achieve Blind Root Command Injection
Search URL Search Domain Scan URL
Title: Shawar Khan (@ShawarkOFFICIAL)
Search URL Search Domain Scan URL
Title: Remote Code Execution – LimeSurvey (CVE-2018-7556)
Search URL Search Domain Scan URL
Title: yeuchimse (@yeuchimse)
Search URL Search Domain Scan URL
Title: OTP Bypass Account Takeover to Admin Panel — Ft. Header Injection
Search URL Search Domain Scan URL
Title: Avinash Jain (@logicbomb_1)
Search URL Search Domain Scan URL
Title: Business Logic Error Methodology (easy way) + PoC-s
Search URL Search Domain Scan URL
Title: How We Escaped Docker in Azure Functions
Search URL Search Domain Scan URL
Title: Weird functionality leads to Account Takeover (Millions of Users affected)
Search URL Search Domain Scan URL
Title: Sahil Mehra (@nullr3x)
Search URL Search Domain Scan URL
Title: Bragging Rights(Part 1): Short story of a bug wave
Search URL Search Domain Scan URL
Title: Hijacking Google Drive Files (Documents, Photo & Video) Through Google Docs Sharing
Search URL Search Domain Scan URL
Title: santuySec (@santuySec)
Search URL Search Domain Scan URL
Title: $500 For No Rate Limit On Forgot Password Page
Search URL Search Domain Scan URL
Title: BBHC (@community_bug)
Search URL Search Domain Scan URL
Title: Finding SSRF BY Full Automation
Search URL Search Domain Scan URL
Title: BMW Bug Bounty – Account Verification Bypass writeup
Search URL Search Domain Scan URL
Title: Leaking issues from linked Jira – Atlassian Confluence Server
Search URL Search Domain Scan URL
Title: Get paid by smuggling, the legal way
Search URL Search Domain Scan URL
Title: James Ling (@James_puppykok)
Search URL Search Domain Scan URL
Title: Chaining a self XSS to Account Takeover
Search URL Search Domain Scan URL
Title: Arman Sameer (@ArmanSameer95)
Search URL Search Domain Scan URL
Title: IDOR Revealing Images CDN Links
Search URL Search Domain Scan URL
Title: Bypassing WAF with incorrect proxy settings for Hunting Bugs.
Search URL Search Domain Scan URL
Title: Shaurya Sharma (@ShauryaSharma05)
Search URL Search Domain Scan URL
Title: Sql Injection via hidden parameter
Search URL Search Domain Scan URL
Title: Rutvik Hajare (@HajareRutvik)
Search URL Search Domain Scan URL
Title: $10,000 for automatic email confirmation bug in Microsoft’s Edge browser
Search URL Search Domain Scan URL
Title: Karan Chaudhary (@0xKaran)
Search URL Search Domain Scan URL
Title: The Secret Parameter, LFR, and Potential RCE in NodeJS Apps
Search URL Search Domain Scan URL
Title: CaptainFreak (@0xCaptainFreak)
Search URL Search Domain Scan URL
Title: CSRF Protection Bypass in Atlassian Confluence Server
Search URL Search Domain Scan URL
Title: Page Admin Disclosure When Replying Comments
Search URL Search Domain Scan URL
Title: Staff Information Disclosure on Support Ticketing System ($x,xxx)
Search URL Search Domain Scan URL
Title: KindleDrip — From Your Kindle’s Email Address to Using Your Credit Card
Search URL Search Domain Scan URL
Title: Story Behind Sweet SSRF.
Search URL Search Domain Scan URL
Title: Rohit Soni (@streetofhacker)
Search URL Search Domain Scan URL
Title: SSRF Exploitation in Libreoffice Spreadsheet File Converter
Search URL Search Domain Scan URL
Title: R4id3n (@R4id3n__)
Search URL Search Domain Scan URL
Title: [Bug Bounty] 600$ Info Disclosure: obtain any user’s backup data
Search URL Search Domain Scan URL
Title: Open-redirect [in email]
Search URL Search Domain Scan URL
Title: Simple & Sweet: Bypass email update restriction to change emails of team members
Search URL Search Domain Scan URL
Title: The Embedded YouTube Player Told Me What You Were Watching (and more)
Search URL Search Domain Scan URL
Title: How I was rewarded a $1000 bounty after abusing File Upload functionality to Stored XSS Vulnerability leading to credential theft of a vistor in a website.
Search URL Search Domain Scan URL
Title: Kunal Khubchandani (@iamkun4l)
Search URL Search Domain Scan URL
Title: Let’s know How I have explored the buried secrets in React Native application
Search URL Search Domain Scan URL
Title: ShazLocate! Abusing CVE-2019-8791 & CVE-2019-8792
Search URL Search Domain Scan URL
Title: Strange Admin Panel Bypass Story | | Bug Bounty
Search URL Search Domain Scan URL
Title: Ranjeet Kumar Singh (@geekboyranjeet)
Search URL Search Domain Scan URL
Title: My first and last crit of 2020 on Hackerone
Search URL Search Domain Scan URL
Title: Takester (@dhiraj_ramteke)
Search URL Search Domain Scan URL
Title: Finding 0day to hack Apple
Search URL Search Domain Scan URL
Title: Harsh Jaiswal (@rootxharsh)
Search URL Search Domain Scan URL
Title: Rahul Maini (@iamnoooob)
Search URL Search Domain Scan URL
Title: BitLocker Lockscreen bypass
Search URL Search Domain Scan URL
Title: Jonas L (@jonasLyk)
Search URL Search Domain Scan URL
Title: Attack of the clones 2: Git CLI remote code execution strikes back
Search URL Search Domain Scan URL
Title: Vitor Fernandes (@Rapt00rVF)
Search URL Search Domain Scan URL
Title: How I hijacked the top-level domain of a sovereign state
Search URL Search Domain Scan URL
Title: Fredrik N. Almroth (@Almroot)
Search URL Search Domain Scan URL
Title: Insertion Of Malicious Links For Execution In Profile Picture - Unvalidated User Input In MS Sharepoint 2019 (CVE-2020-1456)
Search URL Search Domain Scan URL
Title: David (@slashcrypto)
Search URL Search Domain Scan URL
Title: Irremovable Facebook group album photos and entire album under certain circumstances (Bounty: 1000 USD)
Search URL Search Domain Scan URL
Title: Shubham Bhamare (@theshubh77)
Search URL Search Domain Scan URL
Title: Tale of 2 TOOTB Bugs: Google and WhatsApp
Search URL Search Domain Scan URL
Title: Circle Ninja (@circleninja)
Search URL Search Domain Scan URL
Title: How I managed to trigger a Stored-XSS in an online store with the help of Cache Poisoning
Search URL Search Domain Scan URL
Title: Story of a really cool SSRF bug.
Search URL Search Domain Scan URL
Title: Making Clouds Rain :: Remote Code Execution in Microsoft Office 365
Search URL Search Domain Scan URL
Title: Steven Seeley (@steventseeley)
Search URL Search Domain Scan URL
Title: Stealing User Information Via XSS Via Parameter Pollution
Search URL Search Domain Scan URL
Title: Hamza Avvan (@hamzaavvan)
Search URL Search Domain Scan URL
Title: CSRF with IDOR - A Deadly Combo
Search URL Search Domain Scan URL
Title: Unrestricted File Upload
Search URL Search Domain Scan URL
Title: Guest Blog Post: Leaking silhouettes of cross-origin images
Search URL Search Domain Scan URL
Title: Aleksejs Popovs (@aleksejspopovs)
Search URL Search Domain Scan URL
Title: Stealing Your Private YouTube Videos, One Frame at a Time
Search URL Search Domain Scan URL
Title: Weblogic Remote Code Execution (Exploiting CVE-2019-2725)
Search URL Search Domain Scan URL
Title: Mahmoud Gamal (@Zombiehelp54)
Search URL Search Domain Scan URL
Title: Unauthorized Access to OData Entities + $2K Bounty From Microsoft
Search URL Search Domain Scan URL
Title: Borna Nematzadeh (@LogicalHunter)
Search URL Search Domain Scan URL
Title: How I was able to Regain access to account deleted by Admin leading to $$$
Search URL Search Domain Scan URL
Title: Rajesh Ranjan (@rajesh_ranjan)
Search URL Search Domain Scan URL
Title: A ‘Novel’ Way to Bypass Executable Signature Checks with Electron
Search URL Search Domain Scan URL
Title: Parsia Hackerman (@cryptogangsta)
Search URL Search Domain Scan URL
Title: Create post on any Facebook page
Search URL Search Domain Scan URL
Title: Pouya Darabi (@Pouyadarabi)
Search URL Search Domain Scan URL
Title: Exploiting Application-Level Profile Semantics (APLS)
Search URL Search Domain Scan URL
Title: Niemand (@niemand_sec)
Search URL Search Domain Scan URL
Title: Blind XSS in Google Analytics Admin Panel — $3133.70
Search URL Search Domain Scan URL
Title: Information Disclosure through Signup Endpoint
Search URL Search Domain Scan URL
Title: Facebook: Linkshim protection bypass using fb://webview
Search URL Search Domain Scan URL
Title: $10,000 for a vulnerability that doesn’t exist
Search URL Search Domain Scan URL
Title: Valeriy Shevchenko (@Krevetk0Valeriy)
Search URL Search Domain Scan URL
Title: Github Organization Takeover By Claiming Owner Invitation
Search URL Search Domain Scan URL
Title: Abss (@absshax)
Search URL Search Domain Scan URL
Title: Stored XSS on Product Description [HIGH] — $400
Search URL Search Domain Scan URL
Title: Subdomain Take Over Worth 100£
Search URL Search Domain Scan URL
Title: c0d3x27 (@c0d3x27)
Search URL Search Domain Scan URL
Title: Finding bugs on Chess.com
Search URL Search Domain Scan URL
Title: Seqrity (@seqrity9)
Search URL Search Domain Scan URL
Title: Nick’s infrequently updated blog
Search URL Search Domain Scan URL
Title: Achieving Remote Code Execution By Exploiting Variable Check Feature
Search URL Search Domain Scan URL
Title: Incident Response during Christmas
Search URL Search Domain Scan URL
Title: Each and every request make sense…
Search URL Search Domain Scan URL
Title: Privilege Escalation: From being a normal user to admin
Search URL Search Domain Scan URL
Title: Exploiting Max. Character Limitation
Search URL Search Domain Scan URL
Title: Patch. Bypass. Repeat: Story of a FaceBook Page Admin Disclosure bug worth $5000
Search URL Search Domain Scan URL
Title: Expose the email address of Workplace users
Search URL Search Domain Scan URL
Title: XSS on forums.oculusvr.com leads to Oculus and Facebook account takeovers
Search URL Search Domain Scan URL
Title: API based IDOR to leaking Private IP address of 6000 businesses
Search URL Search Domain Scan URL
Title: Rafi Ahamed (Leonidas D. Ace)
Search URL Search Domain Scan URL
Title: Bad regex used in Facebook Javascript SDK leads to account takeovers in websites that included it
Search URL Search Domain Scan URL
Title: Facebook bug bounty (500 USD) : A blocked fundraiser organizer would be unable to view or remove themselves from the fundraiser.
Search URL Search Domain Scan URL
Title: Vivek ps (@vivekps143)
Search URL Search Domain Scan URL
Title: Cross Domain Referrer Leakage
Search URL Search Domain Scan URL
Title: Replying Comments On Someone’s Livestream From Page Is Posted As Personal Identity
Search URL Search Domain Scan URL
Title: Group Admin Can’t Able To Moderate Comments When Posted Through Page : Facebook Bug Bounty 2020
Search URL Search Domain Scan URL
Title: Event Creator Is Not Able To Block The Attacker During Event Livestream
Search URL Search Domain Scan URL
Title: Cache-Key Normalization - What could go wrong?
Search URL Search Domain Scan URL
Title: Sensitive data leak using IDOR in integration service
Search URL Search Domain Scan URL
Title: Ronak Patel (@ronak_9889)
Search URL Search Domain Scan URL
Title: Facebook page admin disclosure by “Create doc” button (Bounty: 5000 USD)
Search URL Search Domain Scan URL
Title: How I Got My First Bounty & Hof From Google (CSRF Lead To Account Delete)
Search URL Search Domain Scan URL
Title: Bhupendra Rajbhar (@bhupendra1238)
Search URL Search Domain Scan URL
Title: [Google VRP] Hijacking Google Docs Screenshots
Search URL Search Domain Scan URL
Title: Sreeram KL (@kl_sree)
Search URL Search Domain Scan URL
Title: Regular expression injection, a code review low hanging fruit
Search URL Search Domain Scan URL
Title: Chaining CORS by Reflected xss to Account takeover #My first Blog
Search URL Search Domain Scan URL
Title: Facebook page admin disclosure by “Message Seller” button (Bounty: 1500 USD)
Search URL Search Domain Scan URL
Title: Full Address Bar Spoofing On Opera Mini Android
Search URL Search Domain Scan URL
Title: Piyush Raj ~ Rex (@0x48piraj)
Search URL Search Domain Scan URL
Title: EN | Account Takeover via Web Cache Poisoning based Reflected XSS
Search URL Search Domain Scan URL
Title: Lütfü Mert Ceylan (@lutfumertceylan)
Search URL Search Domain Scan URL
Title: Hiding from custom story privacy list is possible in FBlite making the victim unable to remove you from the list.
Search URL Search Domain Scan URL
Title: Supply Chain Pollution: Hunting a 16 Million Download/Week npm Package Vulnerability for a CTF Challenge
Search URL Search Domain Scan URL
Title: Cookie Tossing to RCE on Google Cloud JupyterLab
Search URL Search Domain Scan URL
Title: s1r1us (@S1r1u5_)
Search URL Search Domain Scan URL
Title: Hack crypto secrets from heap memory to exploit Android application
Search URL Search Domain Scan URL
Title: SSTI in Google Maps
Search URL Search Domain Scan URL
Title: This is how I was able to view anyone’s private email and birthday on Instagram
Search URL Search Domain Scan URL
Title: Saugat Pokharel (@saugatpk5)
Search URL Search Domain Scan URL
Title: Facebook bug Bounty -Finding the hidden members of the private events.
Search URL Search Domain Scan URL
Title: Worth $1,500 IDOR (Access Unauthorize Data)
Search URL Search Domain Scan URL
Title: Muhammad Asim Shahzad (@protector47)
Search URL Search Domain Scan URL
Title: Write Up: Google VRP N/A – Sandboxed Rce As Root On Apigee API Proxies
Search URL Search Domain Scan URL
Title: Broken Access Control on samsung.com subdomain leads to Mass Account Takeover of Samsung employees application accounts
Search URL Search Domain Scan URL
Title: Misconfigured s3 bucket leads to Sensitive Data exposure(No super controls )
Search URL Search Domain Scan URL
Title: My Bug Bounty Journey and My First Critical Bug — Time Based Blind SQL Injection
Search URL Search Domain Scan URL
Title: How I hacked IBM and got full access on many services?
Search URL Search Domain Scan URL
Title: JavaScript analysis leading to Admin portal access
Search URL Search Domain Scan URL
Title: NotRickyy (@RickyyNot)
Search URL Search Domain Scan URL
Title: TikTok Careers Portal Account Takeover
Search URL Search Domain Scan URL
Title: $2,373
Search URL Search Domain Scan URL
Title: Download Filename Manipulation due to improper rendering of RTLO characters
Search URL Search Domain Scan URL
Title: Disclosing the members of private Facebook Group as a non-member.
Search URL Search Domain Scan URL
Title: Confirm an email address belonging to a specific user
Search URL Search Domain Scan URL
Title: abdellah yaala (@yaalaab)
Search URL Search Domain Scan URL
Title: How I hacked Facebook: Part One
Search URL Search Domain Scan URL
Title: How i got my First Bug Bounty in Intersting Target (LFI to SXSS)
Search URL Search Domain Scan URL
Title: How I dumped PII information of customers in an ecommerce site?
Search URL Search Domain Scan URL
Title: Exploiting new-era of Request forgery on mobile applications
Search URL Search Domain Scan URL
Title: Hiding from a custom list is possible on who sees our post is possible making victim not remove them from the list.
Search URL Search Domain Scan URL
Title: Game On – Finding vulnerabilities in Valve’s “Steam Sockets”
Search URL Search Domain Scan URL
Title: Eyal Itkin (@EyalItkin)
Search URL Search Domain Scan URL
Title: Content-Security-Policy Bypass to perform XSS using MIME sniffing
Search URL Search Domain Scan URL
Title: Hacking — Tamper with the URL Parameters, especially if they modify the page
Search URL Search Domain Scan URL
Title: Facebook leak referrer data
Search URL Search Domain Scan URL
Title: Neilmark Ochea (@PhClownX)
Search URL Search Domain Scan URL
Title: How I Was Able To Take Over One Of Dell’s Subdomains
Search URL Search Domain Scan URL
Title: Taha Bıyıklı (@tahabykl)
Search URL Search Domain Scan URL
Title: Facebook push notification linkshim bypassed
Search URL Search Domain Scan URL
Title: “Important, Spoofing” - zero-click, wormable, cross-platform remote code execution in Microsoft Teams
Search URL Search Domain Scan URL
Title: Oskars Vegeris
Search URL Search Domain Scan URL
Title: Story of the best vulnerability I’ve found so far…
Search URL Search Domain Scan URL
Title: RCE via LFI Log Poisoning - The Death Potion
Search URL Search Domain Scan URL
Title: How Redirects work on Facebook? Technical breakdown
Search URL Search Domain Scan URL
Title: Opera Browser (XSS)
Search URL Search Domain Scan URL
Title: $10000 Facebook SSRF (Bug Bounty)
Search URL Search Domain Scan URL
Title: Leaking Credit card Activity in logs? Yes Sir!
Search URL Search Domain Scan URL
Title: Rody Shahnazarian (@Komradz86)
Search URL Search Domain Scan URL
Title: Cross Site Scripting (XSS) Reflected in one of the subdomains of “General Motors”(Bugbounty)
Search URL Search Domain Scan URL
Title: Site Wide CSRF On Glassdoor
Search URL Search Domain Scan URL
Title: Tabahi (@_tabahi)
Search URL Search Domain Scan URL
Title: Leaking Browser URL/Protocol Handlers
Search URL Search Domain Scan URL
Title: SSTI to Local File Read
Search URL Search Domain Scan URL
Title: Hacking — Always check out the Images
Search URL Search Domain Scan URL
Title: An iOS zero-click radio proximity exploit odyssey
Search URL Search Domain Scan URL
Title: Ian Beer (@i41nbeer)
Search URL Search Domain Scan URL
Title: Chaining vulnerabilities lead to account takeover
Search URL Search Domain Scan URL
Title: Ahmed (@ahzsec)
Search URL Search Domain Scan URL
Title: Exploiting Blind Postgresql Injection And Exfiltrating Data In Psycopg2
Search URL Search Domain Scan URL
Title: AliExpress Captcha Reuse
Search URL Search Domain Scan URL
Title: Chaining Multiple Requests to Achieve Rate Limiting Vulnerabilities
Search URL Search Domain Scan URL
Title: Bcrypt — Account TakeOver Due To Weak Encryption — #HR51KDB
Search URL Search Domain Scan URL
Title: DarkLotus (@darklotuskdb)
Search URL Search Domain Scan URL
Title: The Story of my first critical bug
Search URL Search Domain Scan URL
Title: Shellbr3ak (@0xShellbr3ak)
Search URL Search Domain Scan URL
Title: How i got easy $$$ for SQL Injection Bug
Search URL Search Domain Scan URL
Title: Pre-Account Takeover using OAuth Misconfiguration
Search URL Search Domain Scan URL
Title: the_unluck_guy (@7he_unlucky_guy)
Search URL Search Domain Scan URL
Title: How images on Github will leak your private information
Search URL Search Domain Scan URL
Title: fuomag9 (@fuomag9)
Search URL Search Domain Scan URL
Title: Reflected Cross Site Scripting on REDACTED Program (Bounty: 750$)
Search URL Search Domain Scan URL
Title: Fixing a Google Vulnerability
Search URL Search Domain Scan URL
Title: I (@InsecureNature)
Search URL Search Domain Scan URL
Title: Allison Donovan (@matter_of_cat)
Search URL Search Domain Scan URL
Title: Escalating XSS to Account Takeover
Search URL Search Domain Scan URL
Title: Weird (im)possible XSS on error page
Search URL Search Domain Scan URL
Title: 2 Reflected XSS In Razer
Search URL Search Domain Scan URL
Title: Turning Blind Error Based SQL Injection into Exploitable Boolean One
Search URL Search Domain Scan URL
Title: Ozgur Alp (@ozgur_bbh)
Search URL Search Domain Scan URL
Title: Exploiting dynamic rendering engines to take control of web apps
Search URL Search Domain Scan URL
Title: Vasilii Ermilov (@ermil0v)
Search URL Search Domain Scan URL
Title: Bypassing the Redirect filters with 7 ways
Search URL Search Domain Scan URL
Title: ElMahdi Mrhassel (@ElMrhassel)
Search URL Search Domain Scan URL
Title: Arbitrary File Write On Client By ADB Pull
Search URL Search Domain Scan URL
Title: Serafina (Sera) Tonin Brocious (@daeken)
Search URL Search Domain Scan URL
Title: Out of Band XXE in an E-commerce IOS app
Search URL Search Domain Scan URL
Title: Gaurang Bhatnagar (@0xgaurang)
Search URL Search Domain Scan URL
Title: GraphQL IDOR in Facebook streamer dashboard.
Search URL Search Domain Scan URL
Title: Server Side Misconfigurartion - A Funny Fix
Search URL Search Domain Scan URL
Title: Tale of 3 vulnerabilities to account takeover!
Search URL Search Domain Scan URL
Title: Firefox: How a website could steal all your cookies
Search URL Search Domain Scan URL
Title: Stealing User’s PII info by visiting API endpoint directly
Search URL Search Domain Scan URL
Title: Kunal pandey (@kunalp94)
Search URL Search Domain Scan URL
Title: RCE via Server-Side Template Injection
Search URL Search Domain Scan URL
Title: Gaurav Mishra (@gmishra010)
Search URL Search Domain Scan URL
Title: Optimizing Hunting Results in VDP for use in Bug Bounty Programs - From Sensitive Information Disclosure to Accessing Hidden APIs which can be used to Retrieve Customer Data
Search URL Search Domain Scan URL
Title: YoKo Kho (@YokoAcc)
Search URL Search Domain Scan URL
Title: Microsoft Bug Bounty Writeup – Stored XSS Vulnerability
Search URL Search Domain Scan URL
Title: Weak Cryptography to Account Takeover’s
Search URL Search Domain Scan URL
Title: letmeslidein (@VasuYadaav)
Search URL Search Domain Scan URL
Title: Exploiting API with AuthToken
Search URL Search Domain Scan URL
Title: Account takeover through password reset
Search URL Search Domain Scan URL
Title: Theoretically Possible To Practical Account Takeover
Search URL Search Domain Scan URL
Title: Mukul Lohar (@ironfisto)
Search URL Search Domain Scan URL
Title: Replying Comments On Someone’s LiveStream From Page is Posted as Personal Identity
Search URL Search Domain Scan URL
Title: Prakash Panta (@Prakashpanta268)
Search URL Search Domain Scan URL
Title: Smuggling an (Un)exploitable XSS
Search URL Search Domain Scan URL
Title: Julien Ahrens (@MrTuxracer)
Search URL Search Domain Scan URL
Title: How I Found The Facebook Messenger Leaking Access Token Of Million Users
Search URL Search Domain Scan URL
Title: Guhan Raja (@havocgwen)
Search URL Search Domain Scan URL
Title: Interesting case of SQLi
Search URL Search Domain Scan URL
Title: Commenting on a post by opening it via page’s news-feed goes from a wrong actor (i.e. admin’s personal account)
Search URL Search Domain Scan URL
Title: User’s private watched videos/saved videos exposed through a messenger call from a locked smartphone.
Search URL Search Domain Scan URL
Title: Evading Filters to perform the Arbitrary URL Redirection Attack
Search URL Search Domain Scan URL
Title: Harsh Bothra (@harshbothra_)
Search URL Search Domain Scan URL
Title: Bounty $1000 — Critical Business Logic Flaw leads to Account Takeover & Product Order Amount Manipulation
Search URL Search Domain Scan URL
Title: Evernote: Universal-XSS, theft of all cookies from all sites, and more
Search URL Search Domain Scan URL
Title: 31k$ SSRF in Google Cloud Monitoring led to metadata exposure
Search URL Search Domain Scan URL
Title: David Nechuta (@david_nechuta)
Search URL Search Domain Scan URL
Title: SSRF (Server Side Request Forgery) worth $4,913 | My Highest Bounty Ever !
Search URL Search Domain Scan URL
Title: Sayaan Alam (@ehsayaan)
Search URL Search Domain Scan URL
Title: Chaining password reset link poisoning, IDOR, and information leakage to achieve account takeover at api.redacted.com
Search URL Search Domain Scan URL
Title: Firefox for Android: LAN-Based Intent Triggering
Search URL Search Domain Scan URL
Title: initstring (@init_string)
Search URL Search Domain Scan URL
Title: Facebook iOS address bar spoofing
Search URL Search Domain Scan URL
Title: How i could take over any Account on a USA Department of Defense Website due to a simple IDOR
Search URL Search Domain Scan URL
Title: Facebook DOM Based XSS using postMessage
Search URL Search Domain Scan URL
Title: Attack of the clones: Git clients remote code execution
Search URL Search Domain Scan URL
Title: Story of a Pre-Account Takeover
Search URL Search Domain Scan URL
Title: Kushal Dhakal (@dhakal0kushal)
Search URL Search Domain Scan URL
Title: 1000$ for Open redirect via unknown technique [BugBounty writeup]
Search URL Search Domain Scan URL
Title: How I found a Tor vulnerability in Brave Browser, reported it, watched it get patched, got a CVE (CVE-2020-8276) and a small bounty, all in one working day
Search URL Search Domain Scan URL
Title: sickcodes (@sickcodes)
Search URL Search Domain Scan URL
Title: Delete Any Photos In Facebook
Search URL Search Domain Scan URL
Title: Lokesh Kumar (@lokeshdlk77)
Search URL Search Domain Scan URL
Title: From a 500 error to Django admin takeover
Search URL Search Domain Scan URL
Title: Shashank (@cyberboyIndia)
Search URL Search Domain Scan URL
Title: Forcing for a bounty$$
Search URL Search Domain Scan URL
Title: Reveal the page admin that uploaded a video on the page in comment section
Search URL Search Domain Scan URL
Title: CVE-2020-13294
Search URL Search Domain Scan URL
Title: Subdomain Takeover in Azure: making a PoC
Search URL Search Domain Scan URL
Title: Diego Bernal Adelantado (@secfaults)
Search URL Search Domain Scan URL
Title: Leaked .git folder leads to RCE
Search URL Search Domain Scan URL
Title: James Clee (@jtcsec)
Search URL Search Domain Scan URL
Title: An often overlooked Oauth misconfiguration.
Search URL Search Domain Scan URL
Title: Payload
Search URL Search Domain Scan URL
Title: VipItHunter (@VipItHunter1)
Search URL Search Domain Scan URL
Title: How i got 7000$ in Bug-Bounty for my Critical Finding.
Search URL Search Domain Scan URL
Title: Kishan Kumar / Noobie BoY (@hst_kishan)
Search URL Search Domain Scan URL
Title: Abusing ‘Report Abuse’
Search URL Search Domain Scan URL
Title: Beyond the wall: command injection still alive.
Search URL Search Domain Scan URL
Title: Ahmed Constant (@a_Constant_)
Search URL Search Domain Scan URL
Title: Hinge Hackerone Writeup
Search URL Search Domain Scan URL
Title: Tyler Butler (@tbutler0x90)
Search URL Search Domain Scan URL
Title: Ability To Backdoor Facebook For Android
Search URL Search Domain Scan URL
Title: Wormable remote code execution in Alien Swarm
Search URL Search Domain Scan URL
Title: Rate Limit Bypassing Allowing Identity Spoofing
Search URL Search Domain Scan URL
Title: Mohamed Talaat (@T4144t)
Search URL Search Domain Scan URL
Title: Manual broken link monitoring
Search URL Search Domain Scan URL
Title: Story of an interesting bug.
Search URL Search Domain Scan URL
Title: Error-Based SQL Injection on a WordPress website and extract more than 150k user details
Search URL Search Domain Scan URL
Title: Automating xss identification with Dalfox & Paramspider
Search URL Search Domain Scan URL
Title: Paras Arora (@parasarora06)
Search URL Search Domain Scan URL
Title: The YouTube bug that allowed unlisted uploads to any channel
Search URL Search Domain Scan URL
Title: How i got 250$ in 5 munites using my phone
Search URL Search Domain Scan URL
Title: TikTok fixes privacy issue discovered by Check Point Research
Search URL Search Domain Scan URL
Title: Link Previews: How a Simple Feature Can Have Privacy and Security Risks
Search URL Search Domain Scan URL
Title: Talal Haj Bakry (@parasarora06)
Search URL Search Domain Scan URL
Title: Tommy Mysk
Search URL Search Domain Scan URL
Title: Perform substring search for emails even if Workplace admin hides email profile field.
Search URL Search Domain Scan URL
Title: My first bug on Google
Search URL Search Domain Scan URL
Title: Accidental Observation to Critical IDOR
Search URL Search Domain Scan URL
Title: Samsung S20 - RCE via Samsung Galaxy Store App
Search URL Search Domain Scan URL
Title: 300$ P3 Easy Bug in 30 Seconds
Search URL Search Domain Scan URL
Title: Facebook Page Admin Disclosure
Search URL Search Domain Scan URL
Title: GitHub Pages - Multiple RCEs via insecure Kramdown configuration - $25,000 Bounty
Search URL Search Domain Scan URL
Title: Back to 2019: Disclosure Employers PII and Credentials
Search URL Search Domain Scan URL
Title: Saneklarek (@wh11tew0lf)
Search URL Search Domain Scan URL
Title: GitHub Gist - Account takeover via open redirect - $10,000 Bounty
Search URL Search Domain Scan URL
Title: GitHub - RCE via git option injection (almost) - $20,000 Bounty
Search URL Search Domain Scan URL
Title: Discord Desktop app RCE
Search URL Search Domain Scan URL
Title: Masato Kinugawa (@kinugawamasato)
Search URL Search Domain Scan URL
Title: Weaponizing XSS For Fun & Profit
Search URL Search Domain Scan URL
Title: Saad Ahmed (@XSaadAhmedX)
Search URL Search Domain Scan URL
Title: I had fun with this XSS
Search URL Search Domain Scan URL
Title: yappare (@yappare)
Search URL Search Domain Scan URL
Title: Blind SSRF - The Hide & Seek Game
Search URL Search Domain Scan URL
Title: How I find my first P1 level Bug. $$$
Search URL Search Domain Scan URL
Title: Disclose Emails, phone numbers, more For Facebook users who tried to add funds to their account
Search URL Search Domain Scan URL
Title: Mustafa Ahmed (@mustafa0x2021)
Search URL Search Domain Scan URL
Title: Guest Blog Post: Rollback Attack
Search URL Search Domain Scan URL
Title: Xiaoyin Liu (@general_nfs)
Search URL Search Domain Scan URL
Title: Unauthorized access to all the user’s account.
Search URL Search Domain Scan URL
Title: Leveraging XSS to Read Internal Files
Search URL Search Domain Scan URL
Title: Aditya Dixit (@zombie007o)
Search URL Search Domain Scan URL
Title: JS is l0ve ❤️.
Search URL Search Domain Scan URL
Title: Shivam Kamboj Dattana (@sechunt3r)
Search URL Search Domain Scan URL
Title: Weak Password Setting function on practo.com
Search URL Search Domain Scan URL
Title: CVE-2018–5230 | JIRA Cross Site Scripting
Search URL Search Domain Scan URL
Title: Exploiting Admin Panel Like a Boss
Search URL Search Domain Scan URL
Title: ATO via Host Header Poisoning
Search URL Search Domain Scan URL
Title: Kud I Enter Your Server? New Vulnerabilities in Microsoft Azure
Search URL Search Domain Scan URL
Title: SVE-2020-18025: Unauthorised access to Samsung secure folder files
Search URL Search Domain Scan URL
Title: Research: The mass CSRFing of .google.com/ products.
Search URL Search Domain Scan URL
Title: Missoum Said (@missoum1307)
Search URL Search Domain Scan URL
Title: 6k$ Worth Account Takeover via IDOR in Starbucks Singapore
Search URL Search Domain Scan URL
Title: Sensitive Info Leak in Curve App [Bug Bounty]
Search URL Search Domain Scan URL
Title: ΡRΛSΞUDΟ ® (@praseudo)
Search URL Search Domain Scan URL
Title: Our Experiences Participating in Microsoft’s Azure Sphere Bounty Program
Search URL Search Domain Scan URL
Title: 90 days, 16 bugs, and an Azure Sphere Challenge
Search URL Search Domain Scan URL
Title: Watch your requests! Open redirect to a complete account takeover
Search URL Search Domain Scan URL
Title: ninetynine (@ninetyn1ne_)
Search URL Search Domain Scan URL
Title: Easy wins : verbose error worth Facebook HOF
Search URL Search Domain Scan URL
Title: Leveraging LFI to RCE in a website with +20000 users
Search URL Search Domain Scan URL
Title: Spend more time doing recon, you’ll find more BUGS.
Search URL Search Domain Scan URL
Title: Exploiting Payment Gateways
Search URL Search Domain Scan URL
Title: Journey Of My First Bug Bounty (Nov 2018)
Search URL Search Domain Scan URL
Title: Harsh Tyagi (@harshtya9i)
Search URL Search Domain Scan URL
Title: Arbitrary code execution on Facebook for Android through download feature
Search URL Search Domain Scan URL
Title: The Powerful HTTP Request Smuggling 💪
Search URL Search Domain Scan URL
Title: Write Up – Google Bug Bounty: XSS To Cloud Shell Instance Takeover (Rce As Root) – $5,000 USD
Search URL Search Domain Scan URL
Title: Story of a weird vulnerability I found on Facebook
Search URL Search Domain Scan URL
Title: The Art of IDOR: 7 IDORs in Edm0d0
Search URL Search Domain Scan URL
Title: Public Bucket Allowed Access to Images on Upcoming Google Cloud Blog Posts
Search URL Search Domain Scan URL
Title: Thomas Orlita (@ThomasOrlita)
Search URL Search Domain Scan URL
Title: Taking down the SSO, Account Takeover in the Websites of Kolesa due to Insecure JSONP Call
Search URL Search Domain Scan URL
Title: 5 Ways to do Account Takeover in a Single Website
Search URL Search Domain Scan URL
Title: Chains on Chains: Chaining multiple low-level vulns into a Critical.
Search URL Search Domain Scan URL
Title: Daniel Marte (@Masonhck3571)
Search URL Search Domain Scan URL
Title: Hacking the Medium partner program
Search URL Search Domain Scan URL
Title: Parameter Tampering ₹→$
Search URL Search Domain Scan URL
Title: Advisory: security issues in AWS KMS and AWS Encryption SDKs
Search URL Search Domain Scan URL
Title: Thai Duong (@XorNinja)
Search URL Search Domain Scan URL
Title: PII Leakage via IDOR + Weak PasswordReset = Full Account Takeover
Search URL Search Domain Scan URL
Title: Pradeep Kumar (@Killer007p)
Search URL Search Domain Scan URL
Title: Dangling DNS: AWS EC2
Search URL Search Domain Scan URL
Title: VMware Workstation: Attack surface through Virtual Printer
Search URL Search Domain Scan URL
Title: Lê Hữu Quang Linh (@linhlhq)
Search URL Search Domain Scan URL
Title: #Bugbounty- “How I was able to see other users Payments in a travel application” — IDOR #800$
Search URL Search Domain Scan URL
Title: ganiganesh (@ganiganeshss79)
Search URL Search Domain Scan URL
Title: Fun with Header and Forget Password
Search URL Search Domain Scan URL
Title: suPHP - The vulnerable ghost in your shell🎯Business Logic Flaw in Google Acquisition! (Hall Of Fame)🎯
Search URL Search Domain Scan URL
Title: Ritesh Gohil (@RiteshG37659480)
Search URL Search Domain Scan URL
Title: suPHP - The vulnerable ghost in your shell
Search URL Search Domain Scan URL
Title: Maxime (@punkeel)
Search URL Search Domain Scan URL
Title: (@swapgs)
Search URL Search Domain Scan URL
Title: Unauthenticated File upload Vulnerability on Synology Sub-domain
Search URL Search Domain Scan URL
Title: How I earned $500 from Google - Flaw in Authentication
Search URL Search Domain Scan URL
Title: Hemant Patidar (@HemantSolo)
Search URL Search Domain Scan URL
Title: $25K Instagram Almost XSS Filter Link — Facebook Bug Bounty
Search URL Search Domain Scan URL
Title: Andres Alonso (@al0nnso)
Search URL Search Domain Scan URL
Title: How I By-pass the login page and 2FA authentication…..
Search URL Search Domain Scan URL
Title: Emoji error handling
Search URL Search Domain Scan URL
Title: shesha sai_c (@Cyb3r_4ss4s1n)
Search URL Search Domain Scan URL
Title: CVE-2020-9964 - An iOS infoleak
Search URL Search Domain Scan URL
Title: Muirey03 (@Muirey03)
Search URL Search Domain Scan URL
Title: Privilege Escalation via Account Takeover on NodeBB Forum Software — Bug Bounty (512$) — CVE-2020–15149
Search URL Search Domain Scan URL
Title: Muhammed Eren Uygun (@erenuyguun)
Search URL Search Domain Scan URL
Title: Reflected XSS via a hidden parameter on Dutch Gov. website
Search URL Search Domain Scan URL
Title: Supras (@LdrTom)
Search URL Search Domain Scan URL
Title: My First Bug Bounty From Bug Bounty Platform redstorm.io
Search URL Search Domain Scan URL
Title: Novan Aziz Ramadhan (@novan_rmd)
Search URL Search Domain Scan URL
Title: Dropbox Escalation of Privileges to SYSTEM on Windows
Search URL Search Domain Scan URL
Title: Res-block: Extension Resources Block Attack on Chrome’s Incognito Mode
Search URL Search Domain Scan URL
Title: Exploiting a “Useless” Cookie-Based XSS and Making it Useful
Search URL Search Domain Scan URL
Title: How I Accidentally Got My First Bounty From Facebook
Search URL Search Domain Scan URL
Title: Account takeover by OTP bypass
Search URL Search Domain Scan URL
Title: Business logic vulnerabilities — Low-level logic flaw
Search URL Search Domain Scan URL
Title: SQL Injection & Remote Code Execution - Double P1
Search URL Search Domain Scan URL
Title: How I hacked redbus [An online bus-ticketing application]
Search URL Search Domain Scan URL
Title: Sangeetha Rajesh S(@rajesh_sangi12)
Search URL Search Domain Scan URL
Title: How I Hacked Facebook Again! Unauthenticated RCE on MobileIron MDM
Search URL Search Domain Scan URL
Title: Orange Tsai (@orange_8361)
Search URL Search Domain Scan URL
Title: Universal XSS in Android WebView (CVE-2020-6506)
Search URL Search Domain Scan URL
Title: Alesandro Ortiz (@AlesandroOrtizR)
Search URL Search Domain Scan URL
Title: $15,560+
Search URL Search Domain Scan URL
Title: Unintended Behaviour of domain got me P4
Search URL Search Domain Scan URL
Title: How often do we overlook vulnerabilities?
Search URL Search Domain Scan URL
Title: How often do we overlook vulnerabilities?
Search URL Search Domain Scan URL
Title: CVE-2020-8150 – Remote Code Execution as SYSTEM/root via Backblaze
Search URL Search Domain Scan URL
Title: Jason Geffner (@JasonGeffner)
Search URL Search Domain Scan URL
Title: XSS->Fix->Bypass: 10000$ bounty in Google Maps
Search URL Search Domain Scan URL
Title: From Android Static Analysis to RCE on Prod
Search URL Search Domain Scan URL
Title: My first bug in google and how i got CSRF token for victim account rather than bypass it ($1337)!
Search URL Search Domain Scan URL
Title: Never Give Up, The Story Behind a Dupe-To-Triaged
Search URL Search Domain Scan URL
Title: Alan Brian (@soyelmago)
Search URL Search Domain Scan URL
Title: XSS that can pay your Bills :)
Search URL Search Domain Scan URL
Title: Smile Hacker (@smile_hacker)
Search URL Search Domain Scan URL
Title: How_i_was_able_to_pawned_website_via_escilating_webcache deception to rce
Search URL Search Domain Scan URL
Title: mohit (@mohit29295572)
Search URL Search Domain Scan URL
Title: Account Takeover via IDOR
Search URL Search Domain Scan URL
Title: Roma Ramazanoff (@r0hack)
Search URL Search Domain Scan URL
Title: Stop scratching the surface, and hack the dependencies
Search URL Search Domain Scan URL
Title: Rotem Reiss (@rotem_reiss)
Search URL Search Domain Scan URL
Title: Page shops with a hidden Product in “Featured product section” which could be controlled by attacker (Ex Editor).
Search URL Search Domain Scan URL
Title: Unhiding the hidden
Search URL Search Domain Scan URL
Title: The Importance of keeping up to date, or how I found an interesting bug thanks to a tweet
Search URL Search Domain Scan URL
Title: Oversecured automatically discovers persistent code execution in the Google Play Core Library
Search URL Search Domain Scan URL
Title: My Hacking Adventures With Safari Reader Mode
Search URL Search Domain Scan URL
Title: Nikhil Mittal (@c0d3G33k)
Search URL Search Domain Scan URL
Title: Accessing the website directly through its IP address, a case of a poorly hidden sql injection
Search URL Search Domain Scan URL
Title: Delete IDOR on a Fashion eCommerce Website
Search URL Search Domain Scan URL
Title: Amey Anekar (@ameyanekar)
Search URL Search Domain Scan URL
Title: Auth bypass: Leaking Google Cloud service accounts and projects
Search URL Search Domain Scan URL
Title: Ezequiel Pereira (@epereiralopez)
Search URL Search Domain Scan URL
Title: Bug Bounty Failsx101[4]
Search URL Search Domain Scan URL
Title: ArcherL (@realArcherL)
Search URL Search Domain Scan URL
Title: Waze: How I Tracked Your Mother
Search URL Search Domain Scan URL
Title: Peter Gasper (@malgregator)
Search URL Search Domain Scan URL
Title: Stealing local files using Safari Web Share API
Search URL Search Domain Scan URL
Title: Pawel Wylecial (@h0wlu)
Search URL Search Domain Scan URL
Title: Account Takeover For The Win 🏆
Search URL Search Domain Scan URL
Title: $$ Bounties for Unauthenticated file read in Cisco ASA CVE-2020–3452
Search URL Search Domain Scan URL
Title: Supun Halangoda (@halangoda_supun)
Search URL Search Domain Scan URL
Title: How I was able to find easy P1 just by doing Recon
Search URL Search Domain Scan URL
Title: Kirtan Patel (@kirtanpatel9111)
Search URL Search Domain Scan URL
Title: The Short tale of two bugs on Google Cloud Product— Google VRP [Resolved]
Search URL Search Domain Scan URL
Title: Upload to the future
Search URL Search Domain Scan URL
Title: How I Found My First Bug Stored Xss and Earned My First Bounty 1000$
Search URL Search Domain Scan URL
Title: Nazmul Haque (@0xnazmul)
Search URL Search Domain Scan URL
Title: (Shopify.com) Blind Stored XSS Via Staff Name \(\)
Search URL Search Domain Scan URL
Title: $0 (Out of scope)
Search URL Search Domain Scan URL
Title: The Confused Mailman: Sending SPF and DMARC passing mail as any Gmail or G Suite customer
Search URL Search Domain Scan URL
Title: Allison Husain (@ezhes_)
Search URL Search Domain Scan URL
Title: A perfect duplicate or how to send an email with a spoofed invoice’s content
Search URL Search Domain Scan URL
Title: Mateusz Olejarka (@molejarka)
Search URL Search Domain Scan URL
Title: Django debug mode to RCE in Microsoft acquisition
Search URL Search Domain Scan URL
Title: Syed Abuthahir (@writerabu)
Search URL Search Domain Scan URL
Title: Escalating a GitHub leak to takeover entire organization
Search URL Search Domain Scan URL
Title: Fun with header and forget password, with a twist:
Search URL Search Domain Scan URL
Title: How to contact Google SRE: Dropping a shell in cloud SQL
Search URL Search Domain Scan URL
Title: wtm@offensi.com (@wtm_offensi)
Search URL Search Domain Scan URL
Title: How could I Tag Photo to any user’s Scrapbook on Facebook
Search URL Search Domain Scan URL
Title: Raja Sudhakar (@Rajasudhakar)
Search URL Search Domain Scan URL
Title: From SQL Injection to Hall Of Fame
Search URL Search Domain Scan URL
Title: Windows AppX Deployment Service Local Privilege Escalation (CVE-2020-1488
Search URL Search Domain Scan URL
Title: Firebase Cloud Messaging Service Takeover: A small research that led to 30k$+ in bounties
Search URL Search Domain Scan URL
Title: Account Takeover Using Re-Register [ Bug Bounty ]
Search URL Search Domain Scan URL
Title: Myo Min Thu (@myominthu1337)
Search URL Search Domain Scan URL
Title: Stealing your data using XSS
Search URL Search Domain Scan URL
Title: Viren Pawar (@VirenPawar_)
Search URL Search Domain Scan URL
Title: Witnet Network Bug Bounty: DOS Bug from Harsh Jain
Search URL Search Domain Scan URL
Title: InfluxDB Access at redact.8x8.com
Search URL Search Domain Scan URL
Title: How I got 450$ just in one Google search (SQLi + RXSS)?
Search URL Search Domain Scan URL
Title: Disclosing wifi password via content provider injection in Xiaomi
Search URL Search Domain Scan URL
Title: Vishwaraj Bhattrai (@vishwaraj101)
Search URL Search Domain Scan URL
Title: How I was able to send Authentic Emails as others — Google VRP [Resolved]
Search URL Search Domain Scan URL
Title: How recon helped me to find an interesting bug…
Search URL Search Domain Scan URL
Title: Open Sesame: Escalating Open Redirect to RCE with Electron Code Review
Search URL Search Domain Scan URL
Title: Crowdsource Success Story: From an Out-of-Scope Open Redirect to CVE-2020-1323
Search URL Search Domain Scan URL
Title: Deleted data stored permanently on Instagram? Facebook Bug Bounty 2020
Search URL Search Domain Scan URL
Title: Improper Implementation of My Status video time limit in WhatsApp
Search URL Search Domain Scan URL
Title: False2True, Match and Replace bug hunting — A cautionary tale
Search URL Search Domain Scan URL
Title: From Copy&Paste XSS To Full Account Takeover!
Search URL Search Domain Scan URL
Title: be1807v (@BE1807V)
Search URL Search Domain Scan URL
Title: Leaking AWS Metadata - The Unusual Way
Search URL Search Domain Scan URL
Title: Shubham Garg (@nullb0t)
Search URL Search Domain Scan URL
Title: Journey to my First Bug Hunt\(\)
Search URL Search Domain Scan URL
Title: Bala Praneeth (@Begin_hunt)
Search URL Search Domain Scan URL
Title: Blind OS Command Injection
Search URL Search Domain Scan URL
Title: Cache poisoning of wget
Search URL Search Domain Scan URL
Title: Cracking the 2FA
Search URL Search Domain Scan URL
Title: Rushikesh Gaikwad (@rsg_1212)
Search URL Search Domain Scan URL
Title: How I made $2000 with URL REDIRECTION?
Search URL Search Domain Scan URL
Title: CVE-2020-1337 – PrintDemon is dead, long live PrintDemon!
Search URL Search Domain Scan URL
Title: Paolo Stagno (@Void_Sec)
Search URL Search Domain Scan URL
Title: How I was able to find page/personal account disclosure on Instagram
Search URL Search Domain Scan URL
Title: Ajay Gautam (@evilboyajay)
Search URL Search Domain Scan URL
Title: Group Admin Can’t Able to Moderate Comments When Posted Through Page : Facebook Bug Bounty 2020
Search URL Search Domain Scan URL
Title: CVE-2020-11518: how I bruteforced my way into your Active Directory
Search URL Search Domain Scan URL
Title: Pieter Hiele (@honoki)
Search URL Search Domain Scan URL
Title: CSP Bypass Vulnerability in Google Chrome Discovered - Almost Every Website In The World Was At Risk
Search URL Search Domain Scan URL
Title: Gal Weizman (@WeizmanGal)
Search URL Search Domain Scan URL
Title: My 2nd 4digit Bug Bounty From Facebook
Search URL Search Domain Scan URL
Title: Bypassing 403
Search URL Search Domain Scan URL
Title: Michael Hyndman (@michaelhyndman)
Search URL Search Domain Scan URL
Title: Hacking Zoom: Uncovering Tales of Security Vulnerabilities in Zoom
Search URL Search Domain Scan URL
Title: Mazin Ahmed (@mazen160)
Search URL Search Domain Scan URL
Title: Bypassing Google Maps API Key Restrictions
Search URL Search Domain Scan URL
Title: Bug Hunting with Param Miner: Cache poisoning with XSS, a peculiar case
Search URL Search Domain Scan URL
Title: Reflected XSS in Facebook’s mirror websites
Search URL Search Domain Scan URL
Title: The feature works as intended, but what’s in the source?
Search URL Search Domain Scan URL
Title: Zseano (@zseano)
Search URL Search Domain Scan URL
Title: How Our Co-Founder Earned $10.6K in just 10 Hours
Search URL Search Domain Scan URL
Title: Exploiting JWT - Lack of Signature Verification
Search URL Search Domain Scan URL
Title: Smear phishing: a new Android vulnerability
Search URL Search Domain Scan URL
Title: Jim Fisher (@MrJamesFisher)
Search URL Search Domain Scan URL
Title: Reflected XSS at fotoservice.hema.nl
Search URL Search Domain Scan URL
Title: Jonathan Bouman (@JonathanBouman)
Search URL Search Domain Scan URL
Title: Blind SQL Injection at fasteditor.hema.com
Search URL Search Domain Scan URL
Title: Stored XSS on Slack, Bug Bounty
Search URL Search Domain Scan URL
Title: Apache Example Servlet leads to \(\)
Search URL Search Domain Scan URL
Title: Debangshu Kundu (@debangshu_kundu)
Search URL Search Domain Scan URL
Title: CSRF PoC mistake that broke crucial functions for the end user/victim
Search URL Search Domain Scan URL
Title: I want all these features
Search URL Search Domain Scan URL
Title: How I was able to do Mass Account Takeover[Bug Bounty]
Search URL Search Domain Scan URL
Title: Vulnerability in new TouchID feature put iCloud accounts at risk of being breached
Search URL Search Domain Scan URL
Title: Thijs Alkemade (@xnyhps)
Search URL Search Domain Scan URL
Title: Rare Race Condition — P3
Search URL Search Domain Scan URL
Title: Mohammed Ehssan (@alone_Wwolf)
Search URL Search Domain Scan URL
Title: Account takeover in cups.mail.ru
Search URL Search Domain Scan URL
Title: kminthein / weev3 (@kyawminthein99)
Search URL Search Domain Scan URL
Title: Banning users Race condition
Search URL Search Domain Scan URL
Title: Multi-factor Auth Bypass with Password Reset Function
Search URL Search Domain Scan URL
Title: Vaibhav Joshi (@vj0shii)
Search URL Search Domain Scan URL
Title: Refocusing in bug hunting, Bonus: An interestingly simple to test CSRF bypass
Search URL Search Domain Scan URL
Title: CVE-2020-13379 Unauthenticated Full-Read SSRF in Grafana
Search URL Search Domain Scan URL
Title: Justin Gardner (@Rhynorater)
Search URL Search Domain Scan URL
Title: CVE-2020–9854: “Unauthd” - (three) logic bugs ftw!
Search URL Search Domain Scan URL
Title: Ilias Morad (@A2nkF_)
Search URL Search Domain Scan URL
Title: Unauthd - Logic bugs FTW
Search URL Search Domain Scan URL
Title: Bypassing OTP via reset password
Search URL Search Domain Scan URL
Title: Ahmed Cj (@0x0Cj)
Search URL Search Domain Scan URL
Title: Using XAMPP and Burp Intruder when scanning for subdomains to look for interesting behaviour & code
Search URL Search Domain Scan URL
Title: New features means new bugs
Search URL Search Domain Scan URL
Title: Weird Behavior of Facebook Page FAQ Leading to Bounty from Facebook
Search URL Search Domain Scan URL
Title: Ashok Chapagai (@ashokcpg)
Search URL Search Domain Scan URL
Title: Exploiting Business Logic — Wallet Money
Search URL Search Domain Scan URL
Title: Keshav Malik (@g0t_rOoT_)
Search URL Search Domain Scan URL
Title: One Click to Compromise – Fun With ClickOnce Deployment Manifests
Search URL Search Domain Scan URL
Title: Dave Cossa (@G0ldenGunSec)
Search URL Search Domain Scan URL
Title: Zoom Security Exploit – Cracking private meeting passwords
Search URL Search Domain Scan URL
Title: Tom Anthony (@TomAnthonySEO)
Search URL Search Domain Scan URL
Title: THE NOOB WAY OF TAKING OVER ACCOUNTS
Search URL Search Domain Scan URL
Title: Stealing your Paytm information using XSS
Search URL Search Domain Scan URL
Title: XSS, RCE & HTML File Upload in same endpoint
Search URL Search Domain Scan URL
Title: TariKul IsLam (@sa1tama0)
Search URL Search Domain Scan URL
Title: FFUF and my first bounty
Search URL Search Domain Scan URL
Title: Authorization bypass in Google’s ticketing system (Google-GUTS)
Search URL Search Domain Scan URL
Title: Authentication_token_bypass Leads Too_idor
Search URL Search Domain Scan URL
Title: Pre-Access to Victim’s Account via Facebook Signup
Search URL Search Domain Scan URL
Title: Akshansh Jaiswal (@Akshanshjaiswl)
Search URL Search Domain Scan URL
Title: Bug HTML Injection On Tokopedia !
Search URL Search Domain Scan URL
Title: CSRF + Open Redirect To Account Takeover
Search URL Search Domain Scan URL
Title: CVE-2020–9934: Bypassing the macOS Transparency, Consent, and Control (TCC) Framework for unauthorized access to sensitive user data
Search URL Search Domain Scan URL
Title: Matt Shockley(@mattshockl)
Search URL Search Domain Scan URL
Title: Exploiting popular macOS apps with a single “.terminal” file.
Search URL Search Domain Scan URL
Title: Vladimir Metnew (@vladimir_metnew)
Search URL Search Domain Scan URL
Title: An unreproducable bug due to the load balancer, an unusual Open Redirect bug
Search URL Search Domain Scan URL
Title: tololovejoi (@tolo7010)
Search URL Search Domain Scan URL
Title: How I bypassed 2fa in a 3 years old private program!
Search URL Search Domain Scan URL
Title: Shivangx01b (@shivangx01b)
Search URL Search Domain Scan URL
Title: Obtained a bunch of sensitive data in just few steps — Hacking
Search URL Search Domain Scan URL
Title: A Simple IDOR which should not be missed on dating site ;)
Search URL Search Domain Scan URL
Title: DNS Rebinding, The treacherous attack it can be
Search URL Search Domain Scan URL
Title: A $5000 Account Takeover
Search URL Search Domain Scan URL
Title: Hunting Android Application Bugs Using Android Studio.
Search URL Search Domain Scan URL
Title: Tarek Mohammed (@Conan0x3)
Search URL Search Domain Scan URL
Title: HTTP Parameter Pollution - It’s Contaminated
Search URL Search Domain Scan URL
Title: Disclose content of internal Facebook javascript modules ( Revisited )
Search URL Search Domain Scan URL
Title: Hack Till Your Last Breath
Search URL Search Domain Scan URL
Title: mechboy / m.u.h.e (@Muhe76355002)
Search URL Search Domain Scan URL
Title: Increasing reward points N number of time
Search URL Search Domain Scan URL
Title: Denial of Service(DoS) By Regex
Search URL Search Domain Scan URL
Title: The $1,000 worth cookie
Search URL Search Domain Scan URL
Title: DOS over wep application
Search URL Search Domain Scan URL
Title: Chaining rate limiting for account lockout
Search URL Search Domain Scan URL
Title: bypass user-restriction registration
Search URL Search Domain Scan URL
Title: How I landed on my first bounty : No SPF / DMARC Record Found leading to Social Engineering Attack
Search URL Search Domain Scan URL
Title: Unique Case for Price Manipulation | BugBounty | VAPT
Search URL Search Domain Scan URL
Title: Harshit Sengar (@sengarharshit1)
Search URL Search Domain Scan URL
Title: Creative Android pin bypass with Race conditon
Search URL Search Domain Scan URL
Title: Baluz (@t3chman)
Search URL Search Domain Scan URL
Title: Android pin bypass with rate limiting
Search URL Search Domain Scan URL
Title: Idor in google product
Search URL Search Domain Scan URL
Title: How I lost my followers on Medium
Search URL Search Domain Scan URL
Title: Florian (@fh4ntke)
Search URL Search Domain Scan URL
Title: The Story of My first 4 digit bounty from Facebook
Search URL Search Domain Scan URL
Title: I am able to see user’s sensitive data through JSON file.
Search URL Search Domain Scan URL
Title: Saurabh siddharam sanmane (@saurabhsanmane2)
Search URL Search Domain Scan URL
Title: The 3 Day Account Takeover
Search URL Search Domain Scan URL
Title: Mr. Beast (@mr_beast)
Search URL Search Domain Scan URL
Title: Exploiting Imported Libraries to Bypass WAF
Search URL Search Domain Scan URL
Title: SSRF in import file function
Search URL Search Domain Scan URL
Title: How An API Misconfiguration Can Lead To Your Internal Company Data
Search URL Search Domain Scan URL
Title: Me9187 (@Me9187)
Search URL Search Domain Scan URL
Title: Self stored xss to full account takeover
Search URL Search Domain Scan URL
Title: Bug Bounty Experience: Unvalidated Redirection Vulnerability
Search URL Search Domain Scan URL
Title: How I was able to change victim’s password using IDN Homograph Attack
Search URL Search Domain Scan URL
Title: Abhishek Karle (@AbhishekKarle3)
Search URL Search Domain Scan URL
Title: A tale of critical account take over
Search URL Search Domain Scan URL
Title: Shivam Pandey (@shivam31200)
Search URL Search Domain Scan URL
Title: Phone number validation bypass through url path manipulation .
Search URL Search Domain Scan URL
Title: ben aymen (@ben_aymen_182)
Search URL Search Domain Scan URL
Title: Don’t stop at one bug \(\)
Search URL Search Domain Scan URL
Title: Dheeraj Madhukar (@Dheerajmadhukar)
Search URL Search Domain Scan URL
Title: See whether a Hackercup Facebook participant allows recruitment contact
Search URL Search Domain Scan URL
Title: Remote Denial-of-Service with Chrome
Search URL Search Domain Scan URL
Title: Exploiting Application Logic to Referral Code Disclosure
Search URL Search Domain Scan URL
Title: Global grant uri in Android 8.0-9.0 (2018 year)
Search URL Search Domain Scan URL
Title: From N/A to Resolved For BackBlaze Android App[Hackerone Platform] Bucket Takeover
Search URL Search Domain Scan URL
Title: Sahil Tikoo (@viperbluff)
Search URL Search Domain Scan URL
Title: Journey from low to critical bug $$$
Search URL Search Domain Scan URL
Title: From . in regex to SSRF — part 3
Search URL Search Domain Scan URL
Title: Niemiec Marcin (@xvnpw)
Search URL Search Domain Scan URL
Title: How I found 10 Remote Code Execution in 10 minutes CVE-2020–5902
Search URL Search Domain Scan URL
Title: Saransh Srivastav (@malfuncti0n_)
Search URL Search Domain Scan URL
Title: XSS in Zoom.us Signup Flow
Search URL Search Domain Scan URL
Title: Eduardo Vela (@sirdarckcat)
Search URL Search Domain Scan URL
Title: Free blockchain storage – Tale of a bug in Substrate’s FRAME runtime
Search URL Search Domain Scan URL
Title: Mudit Gupta (@Mudit__Gupta)
Search URL Search Domain Scan URL
Title: How i was able to bypass Email Confirm — P4
Search URL Search Domain Scan URL
Title: Issue 1040755: Security: Another “universal” XSS via copy&paste
Search URL Search Domain Scan URL
Title: Michał Bentkowski (@SecurityMB)
Search URL Search Domain Scan URL
Title: My First Bug: Blind SSRF Through Profile Picture Upload
Search URL Search Domain Scan URL
Title: swaysthinking (@swaysThinking)
Search URL Search Domain Scan URL
Title: RCE via image upload functionality
Search URL Search Domain Scan URL
Title: Case Study I - Browser Anomaly with Facebook Apps -1500$
Search URL Search Domain Scan URL
Title: easySIEM (@easySIEM)
Search URL Search Domain Scan URL
Title: Taking Over Files in a chat —IDOR in Microsoft Teams
Search URL Search Domain Scan URL
Title: Aly Anwar (@alyanwarr)
Search URL Search Domain Scan URL
Title: From Host Header injection to SQL injection
Search URL Search Domain Scan URL
Title: Daoud Youssef / smacker dodi (@daoud_youssef)
Search URL Search Domain Scan URL
Title: Why I paid 3.5K to become a TLD registrar reseller when doing bug bounty
Search URL Search Domain Scan URL
Title: hg_real (@hgreal1)
Search URL Search Domain Scan URL
Title: BBC Bug Bounty Write-up | XSS Vulnerability
Search URL Search Domain Scan URL
Title: EN | Account Takeover and Sensitive Data Leakage via CORS Misconfiguration
Search URL Search Domain Scan URL
Title: CSRF Attack!!!
Search URL Search Domain Scan URL
Title: Bug bounty write-up: From SSRF to $4000
Search URL Search Domain Scan URL
Title: Video
Search URL Search Domain Scan URL
Title: thehackerish (@thehackerish)
Search URL Search Domain Scan URL
Title: [Writeup][Bug Bounty][Tokopedia] Manipulate Other User’s Cart and Wishlist on Tokopedia [EN]
Search URL Search Domain Scan URL
Title: Muhammad Thomas Fadhila Yahya (@fadhilthomas)
Search URL Search Domain Scan URL
Title: Breaking Business Logic via Coupons — The Story of my 1st Valid Bug Bounty
Search URL Search Domain Scan URL
Title: Dominic Ifediri (@Edi4all)
Search URL Search Domain Scan URL
Title: How i got 200$ with an out of the box open redirect vulnerability
Search URL Search Domain Scan URL
Title: Price Tampering due to Improper checks on applying Coupon
Search URL Search Domain Scan URL
Title: Admin disclosure of Facebook verified pages/ Disclose Facebook employee assigned to help a verified page.
Search URL Search Domain Scan URL
Title: Story of a 2.5k Bounty — SSRF on Zimbra Led to Dump All Credentials in Clear Text
Search URL Search Domain Scan URL
Title: How I made $1500 dollars using base64 decoder :)
Search URL Search Domain Scan URL
Title: Dilip (@dilip_spartn)
Search URL Search Domain Scan URL
Title: Misconfigured S3 Bucket Access Controls to Critical Vulnerability
Search URL Search Domain Scan URL
Title: Blast from the past: Cross Site Scripting on the AWS Console
Search URL Search Domain Scan URL
Title: Johann Rehberger (wunderwuzzi23)
Search URL Search Domain Scan URL
Title: Art of bug bounty: a way from JS file analysis to XSS
Search URL Search Domain Scan URL
Title: Jakub Żoczek (@zoczus)
Search URL Search Domain Scan URL
Title: ZombieVPN, Breaking That Internet Security
Search URL Search Domain Scan URL
Title: 0xSha (@0xsha)
Search URL Search Domain Scan URL
Title: Stored XSS with Password Recovery Page
Search URL Search Domain Scan URL
Title: Vulnerability in Electron-based Application: Unintentionally Giving Malicious Code Room to Run
Search URL Search Domain Scan URL
Title: CertiK (@certik_io)
Search URL Search Domain Scan URL
Title: Story of stealing mail conversation, contacts in mail.ru and myMail iOS applications via XSS
Search URL Search Domain Scan URL
Title: Using Inspect Element to Bypass Security restrictions | Bug Bounty POC
Search URL Search Domain Scan URL
Title: Muhammad Khizer Javed (@khizer_javed47)
Search URL Search Domain Scan URL
Title: Patched Zoom Exploit: Altering Camera Settings via Remote SQL Injection
Search URL Search Domain Scan URL
Title: Keegan Ryan (@inf_0_)
Search URL Search Domain Scan URL
Title: API Endpoint leads to Account Takeover In Android Application
Search URL Search Domain Scan URL
Title: Adesh Nandkishor kolte (@AdeshKolte)
Search URL Search Domain Scan URL
Title: Taking over Azure DevOps Accounts with 1 Click
Search URL Search Domain Scan URL
Title: How I hacked a bank their application using it for hacking another bank company — 10K XSS
Search URL Search Domain Scan URL
Title: How I was able to take over any account via the Password Reset Functionality.
Search URL Search Domain Scan URL
Title: Firas Fatnassi (@Fatnass1F1ras)
Search URL Search Domain Scan URL
Title: How I Bypassed open redirect and i have get reward from yandex
Search URL Search Domain Scan URL
Title: Mino Metidji (@minometidjii)
Search URL Search Domain Scan URL
Title: How i hacked worldwide ZOOM users
Search URL Search Domain Scan URL
Title: s3c (@s3c_krd)
Search URL Search Domain Scan URL
Title: Create hidden comment by blocking an Admin: Facebook Bug Bounty 2020
Search URL Search Domain Scan URL
Title: Bug Bounty in Lockdown (SQLi and Business Logic)
Search URL Search Domain Scan URL
Title: Abhishek Yadav (@abhishake100)
Search URL Search Domain Scan URL
Title: All About Getting First Bounty with IDOR
Search URL Search Domain Scan URL
Title: Mukul Trivedi (@M0hn1sh)
Search URL Search Domain Scan URL
Title: Exploiting Bitdefender Antivirus: RCE from any website
Search URL Search Domain Scan URL
Title: Wladimir Palant (@WPalant)
Search URL Search Domain Scan URL
Title: A tale of my first ever full SSRF bug
Search URL Search Domain Scan URL
Title: Leveraging an SSRF to leak a secret API key
Search URL Search Domain Scan URL
Title: Julien Cretel (@jub0bs)
Search URL Search Domain Scan URL
Title: API Token Hijacking Through Clickjacking
Search URL Search Domain Scan URL
Title: How i was able to chain bugs and gain access to internal okta instance
Search URL Search Domain Scan URL
Title: Mmohammed Eldeeb (@malcolmx0x)
Search URL Search Domain Scan URL
Title: It took me only 5 minutes to find an RCE on Bentley
Search URL Search Domain Scan URL
Title: Simple story of some complicated XSS on Facebook
Search URL Search Domain Scan URL
Title: Bipin Jitiya (@win3zz)
Search URL Search Domain Scan URL
Title: Bypass 2FA like a Boss
Search URL Search Domain Scan URL
Title: Seqrity (@seQrity)
Search URL Search Domain Scan URL
Title: How did i find information Disclosure on Facebook-Writeup
Search URL Search Domain Scan URL
Title: Alaa Abdulridha (@Madrid89001310)
Search URL Search Domain Scan URL
Title: Hacking Starbucks and Accessing Nearly 100 Million Customer Records
Search URL Search Domain Scan URL
Title: From Recon to Bypassing MFA Implementation in OWA by Using EWS Misconfiguration
Search URL Search Domain Scan URL
Title: One Token to leak them all : The story of a $8000 NPM_TOKEN
Search URL Search Domain Scan URL
Title: Replying on LiveStream leading to Page Admin Disclosure: Facebook Bug Bounty
Search URL Search Domain Scan URL
Title: Hackerone Bug Bounty Report: Hinge
Search URL Search Domain Scan URL
Title: A subtle stored-XSS in WordPress core
Search URL Search Domain Scan URL
Title: Sam Thomas (@_s_n_t)
Search URL Search Domain Scan URL
Title: Bug bounty bout report 0x01 - WebRTC edition
Search URL Search Domain Scan URL
Title: Enable Security (@enablesecurity)
Search URL Search Domain Scan URL
Title: How I made more than $30K with Jolokia CVEs
Search URL Search Domain Scan URL
Title: Patrik Fehrenbach (@ITSecurityguard)
Search URL Search Domain Scan URL
Title: How I managed to Escalate privilege as admin
Search URL Search Domain Scan URL
Title: Abisheik Magesh (@AbisheikMagesh)
Search URL Search Domain Scan URL
Title: How I was able to buy t-shirt for €1 — Payment Price Manipulation
Search URL Search Domain Scan URL
Title: Muztahidul Tanim (@TheMuztahidul)
Search URL Search Domain Scan URL
Title: All *.intercom.help subdomains vulnerable to Subdomain Takeover from intercom Service
Search URL Search Domain Scan URL
Title: Mohamed Haron (@m7mdharon)
Search URL Search Domain Scan URL
Title: Tail of IDOR
Search URL Search Domain Scan URL
Title: SMTP Injection in Gsuite
Search URL Search Domain Scan URL
Title: Reflected User Input == XSS!
Search URL Search Domain Scan URL
Title: Silent Bronco (@silentbronco)
Search URL Search Domain Scan URL
Title: Business logic flaw in the invitation system allows to Takeover any account at a private company
Search URL Search Domain Scan URL
Title: Daniel V. (@d4niel_v)
Search URL Search Domain Scan URL
Title: Another “Fappening” on the Horizon?
Search URL Search Domain Scan URL
Title: How to Secure AWS ServerLess Lambda from ReDoS(Regular Expression Denial-of-Service) & Resultant Financial Impact
Search URL Search Domain Scan URL
Title: Ddigvijay (@itsdig)
Search URL Search Domain Scan URL
Title: Privilege escalation in Partners Portal to Admin access
Search URL Search Domain Scan URL
Title: Disclose internal files related to testing of some Facebook tools
Search URL Search Domain Scan URL
Title: Disclose the Instagram account linked to a Facebook user account or page
Search URL Search Domain Scan URL
Title: Internal directories enumeration in www
Search URL Search Domain Scan URL
Title: From . in regex to SSRF — part 1
Search URL Search Domain Scan URL
Title: From . in regex to SSRF — part 2
Search URL Search Domain Scan URL
Title: RACE Condition vulnerability found in bug-bounty program
Search URL Search Domain Scan URL
Title: Account Takeover via OTP Bruteforce (Apigee API)
Search URL Search Domain Scan URL
Title: DoS and BugBounties :A series of DoS attacks on HackerOne
Search URL Search Domain Scan URL
Title: Ninad Mishra (@iamr000t)
Search URL Search Domain Scan URL
Title: Let’s Bypass CSRF Protection & Password Confirmation to Takeover Victim Accounts :D
Search URL Search Domain Scan URL
Title: Race Conditions - Exploring the Possibilities
Search URL Search Domain Scan URL
Title: Milind Purswani (@MilindPurswani)
Search URL Search Domain Scan URL
Title: HUNT for SQL Injection- The Smart Way!
Search URL Search Domain Scan URL
Title: The Frustrating XSS
Search URL Search Domain Scan URL
Title: Guest Blog: From File Upload to RCE
Search URL Search Domain Scan URL
Title: Lukasz Wierzbicki (@v13rs8a)
Search URL Search Domain Scan URL
Title: Privilege Escalation by Changing HTTP Response (Admin Access)
Search URL Search Domain Scan URL
Title: Bachrudin Ashari Pujakusuma (@Bachrudinashari)
Search URL Search Domain Scan URL
Title: Utilizing Lockdown: Blind Sqli leads to Account Takeover & Data Extraction
Search URL Search Domain Scan URL
Title: The “P5” Link Injection Story
Search URL Search Domain Scan URL
Title: Abusing Microsoft Teams rate limiting for DDoS
Search URL Search Domain Scan URL
Title: Omayr Zanata (@omayrzanata)
Search URL Search Domain Scan URL
Title: The Accidental RCE
Search URL Search Domain Scan URL
Title: This is fine 🐶
Search URL Search Domain Scan URL
Title: How i earned $500 from google by change one character .
Search URL Search Domain Scan URL
Title: XSS to Database Credential Leakage & Database Access — Story of total luck!
Search URL Search Domain Scan URL
Title: From 3,99 to 1,650 USD (Part I) – Simple Vertical Privilege Escalation by Changing HTTP Response
Search URL Search Domain Scan URL
Title: Multiple Information exposed due to misconfigured Service-now ITSM instances
Search URL Search Domain Scan URL
Title: Th3G3nt3lman
Search URL Search Domain Scan URL
Title: Account takeover via postMessage
Search URL Search Domain Scan URL
Title: socket (@yxw21)
Search URL Search Domain Scan URL
Title: Local file read via XSS using PDF generate functionality
Search URL Search Domain Scan URL
Title: Sanjay Singh Jhala (@lordjerry0x01)
Search URL Search Domain Scan URL
Title: Story of Blind SQL with a typo error.
Search URL Search Domain Scan URL
Title: Amyrahm (@Amyrahm11)
Search URL Search Domain Scan URL
Title: [IDOR] Delete saved credit cards from any Business Manager Account — Facebook Bug Bounty
Search URL Search Domain Scan URL
Title: Another image removal vulnerability on Facebook
Search URL Search Domain Scan URL
Title: Privilege Escalation in Google Cloud Platform’s OS Login
Search URL Search Domain Scan URL
Title: How I got my first big bounty payout with Tesla
Search URL Search Domain Scan URL
Title: CJ Fairhead (@xyantix)
Search URL Search Domain Scan URL
Title: From CRLF to Account Takeover
Search URL Search Domain Scan URL
Title: The Curious Case of Copy & Paste – on risks of pasting arbitrary content in browsers
Search URL Search Domain Scan URL
Title: Michał Bentkowski (@securitymb)
Search URL Search Domain Scan URL
Title: Double URL-encoded XSS
Search URL Search Domain Scan URL
Title: When it’s not only about a Kubernetes CVE…
Search URL Search Domain Scan URL
Title: Reever Zax (@ReeverZax)
Search URL Search Domain Scan URL
Title: Hach (@_hach)
Search URL Search Domain Scan URL
Title: +$40,000
Search URL Search Domain Scan URL
Title: Information disclosure and reflected XSS on Tokopedia
Search URL Search Domain Scan URL
Title: How I leveraged an interesting CSRF vulnerability to turn self XSS into a persistent attack?
Search URL Search Domain Scan URL
Title: How I made $31500 by submitting a bug to Facebook
Search URL Search Domain Scan URL
Title: h1{Error based XXE - bug bounty writeup}
Search URL Search Domain Scan URL
Title: f4d3 (@f4d3_cl)
Search URL Search Domain Scan URL
Title: Hunting on ASPX Application For P1’s [Unauthenticated SOAP,RCE, Info Disclosure]
Search URL Search Domain Scan URL
Title: Weird “Subdomain Take Over” pattern of Amazon S3
Search URL Search Domain Scan URL
Title: Simgamsetti Manikanta (@zaheckmania)
Search URL Search Domain Scan URL
Title: The story of My First $xxx Bug Bounty From Facebook
Search URL Search Domain Scan URL
Title: Cross-site scripting: The power of the hidden parameters.
Search URL Search Domain Scan URL
Title: Kassih Mouhssine (@KassihMouhssine)
Search URL Search Domain Scan URL
Title: Zero-day in Sign in with Apple
Search URL Search Domain Scan URL
Title: Bhavuk Jain (@bhavukjain1)
Search URL Search Domain Scan URL
Title: Microsoft’s first bug
Search URL Search Domain Scan URL
Title: Weak Cryptography Leads To Open Redirect
Search URL Search Domain Scan URL
Title: Analysis of CVE-2020-13693
Search URL Search Domain Scan URL
Title: Raphael Karger (@aptNum)
Search URL Search Domain Scan URL
Title: My Expense Report resulted in a Server-Side Request Forgery (SSRF) on Lyft
Search URL Search Domain Scan URL
Title: Ben Sadeghipour (@nahamsec)
Search URL Search Domain Scan URL
Title: IDOR in session cookie leading to Mass Account Takeover
Search URL Search Domain Scan URL
Title: XSS Stored On Messages In [ Outlook Web — Outlook Android App ]
Search URL Search Domain Scan URL
Title: Bypassing WAF to perform XSS
Search URL Search Domain Scan URL
Title: How I was able to see Private Video Uploader Via Facebook Rights Manager.[Responsible Disclosure]
Search URL Search Domain Scan URL
Title: Kishore TK (@kishoretk_off)
Search URL Search Domain Scan URL
Title: A Long Overdue Write-up: How I got into the Oppo Hall of Fame
Search URL Search Domain Scan URL
Title: Shibin B. Shaji (@shibinbshaji06)
Search URL Search Domain Scan URL
Title: Clickjacking to Account Takeover
Search URL Search Domain Scan URL
Title: iOS Outlook Stored XSS Write-Up($3000)
Search URL Search Domain Scan URL
Title: Stored XSS in Microsoft outlook
Search URL Search Domain Scan URL
Title: Stored XSS in Yahoo mail IOS app($3500)
Search URL Search Domain Scan URL
Title: Android : SOP Bypass to steal system files.
Search URL Search Domain Scan URL
Title: Bug Hunting Stories: Schneider Electric & The Andover Continuum Web.Client
Search URL Search Domain Scan URL
Title: Niv Levy (@restr1ct3d)
Search URL Search Domain Scan URL
Title: No-Rate and Input limitations on password reset page chained into Denial Of Service attack on one of US Dept of Defense website.
Search URL Search Domain Scan URL
Title: Chaining an IDOR with a business-logic error to achieve critical impact
Search URL Search Domain Scan URL
Title: How dangerous is Request Splitting, a vulnerability in Golang or how we found the RCE in Portainer and hacked Uber
Search URL Search Domain Scan URL
Title: Andrey Abakumov (@andrewaeva)
Search URL Search Domain Scan URL
Title: Story About OTP Bypass To Stored XSS
Search URL Search Domain Scan URL
Title: PJ Borah (@PJBorah1)
Search URL Search Domain Scan URL
Title: Using P3 Bug to escalate other P4 to P3
Search URL Search Domain Scan URL
Title: How Source code reading helped me find an IDOR
Search URL Search Domain Scan URL
Title: Sanjay Verdu (@codersanjay)
Search URL Search Domain Scan URL
Title: My First Bug Bounty — 2 Factor Authentication Bypass
Search URL Search Domain Scan URL
Title: Parsing the DOM elements of Other pages via XSS: A Bug Bounty Story
Search URL Search Domain Scan URL
Title: Mandeep Jadon (@1337tr0lls)
Search URL Search Domain Scan URL
Title: RCE in Google Cloud Deployment Manager
Search URL Search Domain Scan URL
Title: Bypassing Message Request inbox
Search URL Search Domain Scan URL
Title: Change any link at https://fbwat.ch/
Search URL Search Domain Scan URL
Title: Become member of close & public group
Search URL Search Domain Scan URL
Title: Easy bounties with subdomain discovery - Using Project Sonar for bug bounty
Search URL Search Domain Scan URL
Title: Torben Capiau (@TorbenCapiau)
Search URL Search Domain Scan URL
Title: How I got 200$ in 5 minutes – Sensitive data leak
Search URL Search Domain Scan URL
Title: How I was Able To Bypass Email Verification
Search URL Search Domain Scan URL
Title: Teradici and CVE-2020-10965: An issue of routing.
Search URL Search Domain Scan URL
Title: Benjamin Heald (@heald_ben)
Search URL Search Domain Scan URL
Title: FB & Messenger for iOS : Address Bar spoofing using data uri
Search URL Search Domain Scan URL
Title: CVE-2020–1088 — Yet another arbitrary delete EoP
Search URL Search Domain Scan URL
Title: Søren Fritzbøger (@fritzboger)
Search URL Search Domain Scan URL
Title: Multiple flaws leads to Account Takeover within an Application
Search URL Search Domain Scan URL
Title: My first 10k bdt bounty from an e-commerce site
Search URL Search Domain Scan URL
Title: Tale of Account Takeovers (Part-2)
Search URL Search Domain Scan URL
Title: Vijaysimha Reddy Bathini (@fatratfatrat)
Search URL Search Domain Scan URL
Title: Stored XSS Leads to Plaintext Password Disclosure
Search URL Search Domain Scan URL
Title: bad5ect0r (@bad5ect0r)
Search URL Search Domain Scan URL
Title: One Param => $10k
Search URL Search Domain Scan URL
Title: Bilal Khan (@bilalmerokhel)
Search URL Search Domain Scan URL
Title: Account takeover CSRF Misconfiguration
Search URL Search Domain Scan URL
Title: Logical Bug which let me stop Users from Creating Ads at a Website
Search URL Search Domain Scan URL
Title: Merbin Russel (e_23_e)
Search URL Search Domain Scan URL
Title: Vulnerability – Account takeover using OAuth Misconfiguration
Search URL Search Domain Scan URL
Title: How I was able to make users loss of money on Google Pay
Search URL Search Domain Scan URL
Title: Chained Bugs [ Account TakeOver ]
Search URL Search Domain Scan URL
Title: Password Reset Poisoning leading to Account Takeover
Search URL Search Domain Scan URL
Title: Swapnil Maurya (@swapmaurya20)
Search URL Search Domain Scan URL
Title: How I got my first swag on Edmodo with a simple XSS.
Search URL Search Domain Scan URL
Title: Weak Cryptography in Password Reset to Full Account Takeover
Search URL Search Domain Scan URL
Title: Bug Bounty — Advanced Manual Penetration Testing Leading to Price Manipulation Vulnerability
Search URL Search Domain Scan URL
Title: $3000 Bug Bounty Award from Mozilla for a successful targeted Credential Hunt
Search URL Search Domain Scan URL
Title: Lucky Bug Which Let Me Change Name of Every Accounts at a Single Click
Search URL Search Domain Scan URL
Title: Change the profanity filter for any Facebook page
Search URL Search Domain Scan URL
Title: Magic of the Back Slash
Search URL Search Domain Scan URL
Title: Anil Tom (mr_4nk)
Search URL Search Domain Scan URL
Title: How I made $10K in bug bounties from GitHub secret leaks
Search URL Search Domain Scan URL
Title: Tillson Galloway (tillson_)
Search URL Search Domain Scan URL
Title: Bypass XSS filter using HTML Escape
Search URL Search Domain Scan URL
Title: Syahri Ramadan (@adonkidz7)
Search URL Search Domain Scan URL
Title: $20000 Facebook DOM XSS
Search URL Search Domain Scan URL
Title: Vinoth Kumar (@vinodsparrow)
Search URL Search Domain Scan URL
Title: I Found XSS Security Flaws in Rails – Here’s What Happened.
Search URL Search Domain Scan URL
Title: DOM-Based XSS at accounts.google.com by Google Voice Extension.
Search URL Search Domain Scan URL
Title: How we Hijacked 26+ Subdomains
Search URL Search Domain Scan URL
Title: Aishwarya Kendle (@aish_kendle)
Search URL Search Domain Scan URL
Title: DOM XSS Walkthrough
Search URL Search Domain Scan URL
Title: Youssef Lahouifi (@YLahouifi)
Search URL Search Domain Scan URL
Title: Google Acquisition XSS (Apigee)
Search URL Search Domain Scan URL
Title: TnMch (@TnMch_)
Search URL Search Domain Scan URL
Title: A tale of verbose error message and a JWT token
Search URL Search Domain Scan URL
Title: Marek Geleta (@marek_geleta)
Search URL Search Domain Scan URL
Title: Cool paste jacking attack earned me $$$
Search URL Search Domain Scan URL
Title: Aman Rawat (@theamanrawat)
Search URL Search Domain Scan URL
Title: DOM XSS in Gmail with a little help from Chrome
Search URL Search Domain Scan URL
Title: Enguerran Gillier (@opnsec)
Search URL Search Domain Scan URL
Title: $5,000
Search URL Search Domain Scan URL
Title: #BugBounty — Adding Money Using Response Modification
Search URL Search Domain Scan URL
Title: Private Dashboards were accessible by other Admins in Analytics Dashboard
Search URL Search Domain Scan URL
Title: Reflected XSS on Microsoft.com via Angular Js template injection
Search URL Search Domain Scan URL
Title: Pratik Dabhi (@impratikdabhi)
Search URL Search Domain Scan URL
Title: Blind SSRF on coda.io
Search URL Search Domain Scan URL
Title: Exposure of Facebook object type by knowing the object ID
Search URL Search Domain Scan URL
Title: Add draft subtitles to any Facebook video and Full Path Disclosure
Search URL Search Domain Scan URL
Title: Ok Google! bypass ‘flag_secure’
Search URL Search Domain Scan URL
Title: Pankaj Upadhyay (@_pupadhyay)
Search URL Search Domain Scan URL
Title: The Story of Blind SSRF leads to internal Host discovery.
Search URL Search Domain Scan URL
Title: kaustubh padwad (@s3curityb3ast)
Search URL Search Domain Scan URL
Title: Hacking Razer Pay Ewallet App
Search URL Search Domain Scan URL
Title: Richard Tan (@sambal0x)
Search URL Search Domain Scan URL
Title: Researching Polymorphic Images for XSS on Google Scholar
Search URL Search Domain Scan URL
Title: Lorenzo Stella (@lorenzostella)
Search URL Search Domain Scan URL
Title: [Bug Bounty Writeups] Exploiting SQL Injection Vulnerability
Search URL Search Domain Scan URL
Title: Account taken over in style !!!
Search URL Search Domain Scan URL
Title: kishore hariram (@kishorehariram)
Search URL Search Domain Scan URL
Title: Stealing the Trello token by abusing a cross-iframe XSS on the Butler Plugin
Search URL Search Domain Scan URL
Title: Florian Courtial (@theflofly)
Search URL Search Domain Scan URL
Title: Indirect UXSS issue on a private Android target app
Search URL Search Domain Scan URL
Title: Recon to Sensitive Information Disclosure in Minutes
Search URL Search Domain Scan URL
Title: Private giant chat app – Send message to victim while sender blocked
Search URL Search Domain Scan URL
Title: Piercing the Veal: Short Stories to Read with Friends
Search URL Search Domain Scan URL
Title: d0nut
Search URL Search Domain Scan URL
Title: Beware of the GIF: Account Takeover Vulnerability in Microsoft Teams
Search URL Search Domain Scan URL
Title: Omer Tsarfati (@OmerTsarfati)
Search URL Search Domain Scan URL
Title: Bitrix WAF bypass
Search URL Search Domain Scan URL
Title: $300
Search URL Search Domain Scan URL
Title: 1-click RCE on Keybase
Search URL Search Domain Scan URL
Title: smaury (@smaury92)
Search URL Search Domain Scan URL
Title: Fun With CORS Misconfiguration — II
Search URL Search Domain Scan URL
Title: Aman Gupta (@gupt4j1)
Search URL Search Domain Scan URL
Title: Web Cache Poisoning in Postmates [$1500]
Search URL Search Domain Scan URL
Title: Aung Pyae Ko Ko (@BlcKVRtuL1)
Search URL Search Domain Scan URL
Title: From Recon to P1 (Critical) — An Easy Win
Search URL Search Domain Scan URL
Title: Two Factor Authentication Bypass [ $50 ]
Search URL Search Domain Scan URL
Title: Messenger Rooms Bug Bounty Write-up
Search URL Search Domain Scan URL
Title: Jane Manchun Wong (@wongmjane)
Search URL Search Domain Scan URL
Title: Hiding ourself in close friend’s list and avoiding victim to remove us from his close friend’s list.
Search URL Search Domain Scan URL
Title: Misconfigured WordPress takeover to Remote Code Execution
Search URL Search Domain Scan URL
Title: From P5 to P2, from nothing to 1000+$
Search URL Search Domain Scan URL
Title: Mohamed Daher (@DaherMohamed4)
Search URL Search Domain Scan URL
Title: The Secret sauce of bug bounty
Search URL Search Domain Scan URL
Title: Mohamed Slamat (@oxxy37)
Search URL Search Domain Scan URL
Title: Exploiting a Race Condition Vulnerability
Search URL Search Domain Scan URL
Title: Vivek Kumar Singh (@v7nc3nz)
Search URL Search Domain Scan URL
Title: CORS bug on GOOGLE’s 404 page REWARDED!!!
Search URL Search Domain Scan URL
Title: DOM based open redirect to the leak of a JWT token
Search URL Search Domain Scan URL
Title: Google Maps API (Not the Key) Bugs That I Found Over the Years
Search URL Search Domain Scan URL
Title: Abusing HTTP Path Normalization and Cache Poisoning to steal Rocket League accounts
Search URL Search Domain Scan URL
Title: How was i able to find privilege escalation.
Search URL Search Domain Scan URL
Title: Akshar Tank (@Akshar__tank)
Search URL Search Domain Scan URL
Title: Here is the Non Technical write-up on Technical Bug for My Second Bounty of $xxxx From Facebook
Search URL Search Domain Scan URL
Title: Strange Redirect (Fixed but no bounty)
Search URL Search Domain Scan URL
Title: OTP Verification Bypass
Search URL Search Domain Scan URL
Title: [Writeup][Bug Bounty][Instagram] Instagram Still Send New DMs and Video Calls to Device After Logout [ID][EN]
Search URL Search Domain Scan URL
Title: Tricky Oracle SQL Injection Situation
Search URL Search Domain Scan URL
Title: Netflix Party — XSS Vulnerabilities
Search URL Search Domain Scan URL
Title: kr-b (@pirxcy)
Search URL Search Domain Scan URL
Title: $55,000 Facebook token leak vs Funny Airline token leak.
Search URL Search Domain Scan URL
Title: Business Logic Errors - A New Look
Search URL Search Domain Scan URL
Title: Bounty Tip !! Easiest way to bypass API’s Rate Limit.
Search URL Search Domain Scan URL
Title: Hacking a Telecommunication company(MTN)
Search URL Search Domain Scan URL
Title: How i Unlocked the blocked accounts?
Search URL Search Domain Scan URL
Title: The story of a fuzzing integration reward
Search URL Search Domain Scan URL
Title: Andrea Brancaleoni (@nJoyneer)
Search URL Search Domain Scan URL
Title: Listing all registered email addresses on Google’s Crisis Map thanks to IDOR and incremental IDs
Search URL Search Domain Scan URL
Title: Unrestricted CV File Upload
Search URL Search Domain Scan URL
Title: Stored XSS in Google Nest
Search URL Search Domain Scan URL
Title: Harikrishnan Chandraganesan (@hari_cybex)
Search URL Search Domain Scan URL
Title: $3K Bounty For Elastic-Search Takeover
Search URL Search Domain Scan URL
Title: Ashish Kunwar (@D0rkerDevil)
Search URL Search Domain Scan URL
Title: How we abused Slack’s TURN servers to gain access to internal services
Search URL Search Domain Scan URL
Title: Sandro Gauci (@sandrogauci)
Search URL Search Domain Scan URL
Title: How a Simple CSRF Attack Turned into a P1 Level Bug
Search URL Search Domain Scan URL
Title: Lady Secspeare (@bejuveria_)
Search URL Search Domain Scan URL
Title: Page Admin Disclosure: Facebook Bug Bounty 2020
Search URL Search Domain Scan URL
Title: Cannot Delete Post on Facebook Group: Facebook Bug Bounty
Search URL Search Domain Scan URL
Title: Playing with JSON Web Tokens for Fun and Profit
Search URL Search Domain Scan URL
Title: Muhammad Qasim Munir (@MeetAn0nym0us)
Search URL Search Domain Scan URL
Title: Touch ID Authentication Bypass on Evernote and Dropbox IOS Apps
Search URL Search Domain Scan URL
Title: iPhone Camera Hack
Search URL Search Domain Scan URL
Title: Ryan Pickren
Search URL Search Domain Scan URL
Title: Hundreds of internal servicedesks exposed due to COVID-19
Search URL Search Domain Scan URL
Title: Inti De Ceukelaire (@securinti)
Search URL Search Domain Scan URL
Title: Always escalate! From Self-XSS to Persistent XSS on Login Portal
Search URL Search Domain Scan URL
Title: Phuriphat Boontanon (@zanezenzane)
Search URL Search Domain Scan URL
Title: Account Take Over without user Interaction
Search URL Search Domain Scan URL
Title: Privilege Escalation - Hello Admin
Search URL Search Domain Scan URL
Title: The story of my first ever, 1500$, bounty from Facebook.
Search URL Search Domain Scan URL
Title: $3133.7 Google Bug Bounty Writeup- XSS Vulnerability!
Search URL Search Domain Scan URL
Title: Microsoft Apache Solr RCE Velocity Template | Bug Bounty POC
Search URL Search Domain Scan URL
Title: $0
Search URL Search Domain Scan URL
Title: Akamai Web Application Firewall Bypass Journey: Exploiting “Google BigQuery” SQL Injection Vulnerability
Search URL Search Domain Scan URL
Title: Duc Nguyen (@ducnt_)
Search URL Search Domain Scan URL
Title: Hacking makes me forget my pain
Search URL Search Domain Scan URL
Title: Limited freemarker ssti to arbitrary liql query and manage lithium cms
Search URL Search Domain Scan URL
Title: Mert (@mertistaken)
Search URL Search Domain Scan URL
Title: F. Celal Erdik (@celalerdik)
Search URL Search Domain Scan URL
Title: Restriction is not a promise : Privilege escalation on Google.
Search URL Search Domain Scan URL
Title: Hariharan.s (@DJHARIZ1)
Search URL Search Domain Scan URL
Title: CVE-2019-17004—Semi Universal XSS affecting Firefox for iOS
Search URL Search Domain Scan URL
Title: cliqz (@cliqz)
Search URL Search Domain Scan URL
Title: OTP Bruteforce- Account Takeover
Search URL Search Domain Scan URL
Title: Attacking HelpDesks Part 1: RCE Chain on DeskPro, with Bitdefender as a Case Study
Search URL Search Domain Scan URL
Title: Abdulrahman Nour (@aboodnour)
Search URL Search Domain Scan URL
Title: Executing scripts in Safari Reader Mode to CSP Bypass
Search URL Search Domain Scan URL
Title: I Want that Cookie !!!
Search URL Search Domain Scan URL
Title: Adnan Malik (@infoadnanmalik)
Search URL Search Domain Scan URL
Title: Exploiting magic links, critical bugs are one line away
Search URL Search Domain Scan URL
Title: 1st Bug Bounty Write-Up — Open Redirect Vulnerability on Login Page
Search URL Search Domain Scan URL
Title: Getting lucky in bug bounty — shamelessly profiting off of other’s work
Search URL Search Domain Scan URL
Title: Account Takeover Flow In Mail.ru ‘s Ext.A Domain [ $150 ]
Search URL Search Domain Scan URL
Title: Exploitation of the CVE-2018-15961 – Unrestricted File Upload in Adobe ColdFusion
Search URL Search Domain Scan URL
Title: Stealing Videos From VLC
Search URL Search Domain Scan URL
Title: XSS WAF & Character limitation bypass like a boss
Search URL Search Domain Scan URL
Title: Self XSS to Account Takeover
Search URL Search Domain Scan URL
Title: Remote Image Upload Leads to RCE (Inject Malicious Code to PHP-GD Image)
Search URL Search Domain Scan URL
Title: API DOCS takeover on Readme.io
Search URL Search Domain Scan URL
Title: Oktavandi (@0ktavandi)
Search URL Search Domain Scan URL
Title: EN | Administrator level Privilege Escalation story
Search URL Search Domain Scan URL
Title: Samet Sahin (@sametsahinnet)
Search URL Search Domain Scan URL
Title: Reflected XSS on microsoft.com subdomains
Search URL Search Domain Scan URL
Title: Raimonds Liepins (@lv_linkers)
Search URL Search Domain Scan URL
Title: Hacking — Always Check the Cross-domain Policy
Search URL Search Domain Scan URL
Title: XXE-scape through the front door: circumventing the firewall with HTTP request smuggling
Search URL Search Domain Scan URL
Title: Where is my Train : Tracking to Hacking !
Search URL Search Domain Scan URL
Title: How I was able to verify any contact number for my account?
Search URL Search Domain Scan URL
Title: Razer mobile PIN verification bypass $1k Bug
Search URL Search Domain Scan URL
Title: Sourav Sahana (@kernel_rider)
Search URL Search Domain Scan URL
Title: How I Earned $1750 at Shopify Bug Bounty Program
Search URL Search Domain Scan URL
Title: Weak session validation bug let you login even after changing the session IDs and logging out from the accounts
Search URL Search Domain Scan URL
Title: Manasjha (@manas_hunter)
Search URL Search Domain Scan URL
Title: Using Vulnerability Analytics Feature Like a Boss
Search URL Search Domain Scan URL
Title: How I earned $800 for Host Header Injection Vulnerability
Search URL Search Domain Scan URL
Title: My Weirdest Bug Bounty — Getting PII from O365.
Search URL Search Domain Scan URL
Title: Omaid Faizyar (@rulesofthetrade)
Search URL Search Domain Scan URL
Title: Blocked User Can Send Notification Due to Logical Bug in Instagram | First Instagram Bug
Search URL Search Domain Scan URL
Title: What is your GCP infra worth?…about ~$700 [Bugbounty]
Search URL Search Domain Scan URL
Title: Chris Gates (@carnal0wnage)
Search URL Search Domain Scan URL
Title: User’s email disclosure via invalid password reset link [$250]
Search URL Search Domain Scan URL
Title: API secret key Leakage leads to disclosure of Employee’s Information
Search URL Search Domain Scan URL
Title: Ace Candelario (@phspades)
Search URL Search Domain Scan URL
Title: Generate valid signatures for FBCDN urls
Search URL Search Domain Scan URL
Title: How I got access to critical data of a Company in no time ?
Search URL Search Domain Scan URL
Title: [Bug Bounty] Email Content Injection
Search URL Search Domain Scan URL
Title: Navneet (@na5n33t)
Search URL Search Domain Scan URL
Title: How I Reported a DoS Vulnerability to AWS
Search URL Search Domain Scan URL
Title: Generate valid signatures for files hosted in Facebook CDNs
Search URL Search Domain Scan URL
Title: Ability to bruteforce Instagram account’s password due to lack of rate limitation protection
Search URL Search Domain Scan URL
Title: $3,000
Search URL Search Domain Scan URL
Title: How I was able to bypass the current password?
Search URL Search Domain Scan URL
Title: Ninad Mathpati (@ninad_mathpati)
Search URL Search Domain Scan URL
Title: OTP Bypass - Developer’s Check
Search URL Search Domain Scan URL
Title: Finding a P1 in one minute with Shodan.io (RCE)
Search URL Search Domain Scan URL
Title: sw33tLie (@sw33tLie)
Search URL Search Domain Scan URL
Title: Got Easiest Bounty with HTML injection via email confirmation!
Search URL Search Domain Scan URL
Title: Vulnerable design leads to personal data leakage- yet another case of an inter-application vulnerability…
Search URL Search Domain Scan URL
Title: Marcin Szydlowski (@SecurityKsl)
Search URL Search Domain Scan URL
Title: Broke limited scope with a chain of bugs (tips for every rider CORS)
Search URL Search Domain Scan URL
Title: The unexpected Google wide domain check bypass
Search URL Search Domain Scan URL
Title: Breaking the Competition (Bug Bounty Write-up)
Search URL Search Domain Scan URL
Title: George O (@georgeomnet)
Search URL Search Domain Scan URL
Title: $5,005 worth vulnerability Duplicated, How I loose $5,005 in a day? Denial of Service - Billion LAUGH Attack (XXE)
Search URL Search Domain Scan URL
Title: Google Ads Self-XSS & Html Injection $5000
Search URL Search Domain Scan URL
Title: How I exploit the JSON CSRF with method override technique
Search URL Search Domain Scan URL
Title: Google Bug Bounty: Clickjacking on Google Payment (1337$)
Search URL Search Domain Scan URL
Title: Got Bounty with Account takeover (ATO ) Unicode-Case Mapping Collision !
Search URL Search Domain Scan URL
Title: Bug Bounty catches part -1
Search URL Search Domain Scan URL
Title: Bijan Murmu (@0xBijan)
Search URL Search Domain Scan URL
Title: Abusing Slack for Offensive Operations
Search URL Search Domain Scan URL
Title: Cody Thomas (@its_a_feature_)
Search URL Search Domain Scan URL
Title: SOP Bypass
Search URL Search Domain Scan URL
Title: Kenan (@kenanistaken)
Search URL Search Domain Scan URL
Title: Exploiting an SSRF: Trials and Tribulations
Search URL Search Domain Scan URL
Title: A Bug’z Life (@abugzlife1)
Search URL Search Domain Scan URL
Title: ManageEngine ServiceDesk Plus: Arbitrary File Upload
Search URL Search Domain Scan URL
Title: How I CSRF’d My First Bounty!
Search URL Search Domain Scan URL
Title: Rajesh Ranjan (@rajesh_ranjan4)
Search URL Search Domain Scan URL
Title: SQL Injection Via Stopping the redirection to a login page
Search URL Search Domain Scan URL
Title: Abde Ouabala (@4mgh0z)
Search URL Search Domain Scan URL
Title: SSRF on PDF generator.
Search URL Search Domain Scan URL
Title: John Michael (@michan2514)
Search URL Search Domain Scan URL
Title: Discord embed spoofing
Search URL Search Domain Scan URL
Title: Facebook OAuth Framework Vulnerability
Search URL Search Domain Scan URL
Title: Amol Baikar (@AmolBaikar)
Search URL Search Domain Scan URL
Title: A mysterious bug in the firmware of Google’s Titan M chip (CVE-2019-9465)
Search URL Search Domain Scan URL
Title: Account Hijack using Authorization bypass \(\)
Search URL Search Domain Scan URL
Title: Bhavesh Thakur (@Bhavesh_Thakur_)
Search URL Search Domain Scan URL
Title: Page Admin Disclosure via an Upgraded Page Post
Search URL Search Domain Scan URL
Title: Dan Fabro (@0x61_)
Search URL Search Domain Scan URL
Title: The Tricky XSS
Search URL Search Domain Scan URL
Title: Facebook CSRF bug which lead to Instagram Partial account takeover.
Search URL Search Domain Scan URL
Title: RCE via Apache Struts2 - Still out there.
Search URL Search Domain Scan URL
Title: Write-up: AWS Document Signing Security Control Bypass
Search URL Search Domain Scan URL
Title: Long String DoS
Search URL Search Domain Scan URL
Title: How I Get my first P1 (Sensitive Information Disclosure) using WPScan
Search URL Search Domain Scan URL
Title: Harrmahar (@harrmahar)
Search URL Search Domain Scan URL
Title: How i found 3 SSRF in one day on different bug bounty targets
Search URL Search Domain Scan URL
Title: Damanpreet Singh (@MrDamanSingh)
Search URL Search Domain Scan URL
Title: Mail.Ru Ext.B Scope Account Takeover [ $1500 ]
Search URL Search Domain Scan URL
Title: Stored-XSS-on-groups-google-com
Search URL Search Domain Scan URL
Title: Alessandro Rumampuk (@Rando02355205)
Search URL Search Domain Scan URL
Title: Discord DoS with a single message
Search URL Search Domain Scan URL
Title: Reflected XSS In AT&T
Search URL Search Domain Scan URL
Title: Tale of Account Takeovers (Part-1)
Search URL Search Domain Scan URL
Title: Hunting Tesla Model Y Secrets in the Parts Catalog
Search URL Search Domain Scan URL
Title: Evan Connelly (@Evan_Connelly)
Search URL Search Domain Scan URL
Title: Exploiting Jira for Host Discovery
Search URL Search Domain Scan URL
Title: Hacking SMS API Service Provider of a Company |Android App Static Security Analysis | Bug Bounty POC
Search URL Search Domain Scan URL
Title: A Tale of Two Formats: Exploiting Insecure XML and ZIP File Parsers to Create a Web Shell
Search URL Search Domain Scan URL
Title: From Recon to Optimizing RCE Results – Simple Story with One of the Biggest ICT Company in the World
Search URL Search Domain Scan URL
Title: My First Bounty From Google.
Search URL Search Domain Scan URL
Title: How We Found Another XSS in Google with Acunetix
Search URL Search Domain Scan URL
Title: Andrey Leonov (@4lemon)
Search URL Search Domain Scan URL
Title: Plan Change Logic in Google Fiber (Webpass)
Search URL Search Domain Scan URL
Title: Craig Arendt (@signalchaos)
Search URL Search Domain Scan URL
Title: Exploiting WebSocket [Application Wide XSS / CSRF]
Search URL Search Domain Scan URL
Title: Osama Avvan (@osamaavvan)
Search URL Search Domain Scan URL
Title: How I Gain Unrestricted File Upload Remote Code Execution Bug Bounty
Search URL Search Domain Scan URL
Title: Shay Grant (@kidshay)
Search URL Search Domain Scan URL
Title: Uploading Backdoor For Fun And Profit.
Search URL Search Domain Scan URL
Title: Mohammed Abdul Raheem (@mohdaltaf163)
Search URL Search Domain Scan URL
Title: How to hack a company by circumventing its WAF through the abuse of a different security appliance and win bug bounties
Search URL Search Domain Scan URL
Title: Open-redirect Vulnerability on Facebook
Search URL Search Domain Scan URL
Title: Blind IDOR in LinkedIn iOS application
Search URL Search Domain Scan URL
Title: Hailstorm (@hailstorm1422)
Search URL Search Domain Scan URL
Title: A Simple IDOR to Account Takeover
Search URL Search Domain Scan URL
Title: Weird Vulnerabilities Happening on Load Balancers, Shallow Copies and Caches
Search URL Search Domain Scan URL
Title: How I discovered an SSRF leading to AWS Metadata Leakage
Search URL Search Domain Scan URL
Title: A step-by-step walk-through of an Invalid Endpoint
Search URL Search Domain Scan URL
Title: Mohammed Israil (@mdisrail2468)
Search URL Search Domain Scan URL
Title: External XML Entity via File Upload (SVG)
Search URL Search Domain Scan URL
Title: Atul (@0xatul)
Search URL Search Domain Scan URL
Title: Determine users with detailed role model on behalf of any Facebook Application
Search URL Search Domain Scan URL
Title: IDOR leads to Data leakage and Profile Update
Search URL Search Domain Scan URL
Title: How Inspect Element Got me a Bounty
Search URL Search Domain Scan URL
Title: Aditya Soni (@hetroublemakr)
Search URL Search Domain Scan URL
Title: Simple Remote Code Execution Vulnerability Examples for Beginners
Search URL Search Domain Scan URL
Title: Google APIS ClickJacking ( $1337)
Search URL Search Domain Scan URL
Title: Site wide CSRF on a popular program
Search URL Search Domain Scan URL
Title: Ajinkya Pathare (@fellchase)
Search URL Search Domain Scan URL
Title: How I Made $600 in Bug Bounty in 15 Minutes with Contrast CE – CVE- 2019-8442
Search URL Search Domain Scan URL
Title: David Lindner (@golfhackerdave)
Search URL Search Domain Scan URL
Title: Using CSRF I Got Weird Account Takeover
Search URL Search Domain Scan URL
Title: Mohamed Sayed (@FlEx0Geek)
Search URL Search Domain Scan URL
Title: An Unexpected Bounty — Email Bounce Issues
Search URL Search Domain Scan URL
Title: Hijacking shared report links in Google Data Studio
Search URL Search Domain Scan URL
Title: sushiwushi (@sushiwushi2)
Search URL Search Domain Scan URL
Title: How, I dumped crypto data by chaining directory listing to open S3 Bucket
Search URL Search Domain Scan URL
Title: Arbitary File Upload too Stored XSS - Bug Bounty
Search URL Search Domain Scan URL
Title: m0chan (@m0chan98)
Search URL Search Domain Scan URL
Title: Critical Security Flaw Found in WhatsApp Desktop Platform Allowing Cybercriminals Read From The File System Access
Search URL Search Domain Scan URL
Title: Responsible Disclosure: Breaking out of a Sandboxed Editor to perform RCE
Search URL Search Domain Scan URL
Title: Jatin Dhankhar (@jatindhankhar_)
Search URL Search Domain Scan URL
Title: Exploiting Insecure Firebase Database!
Search URL Search Domain Scan URL
Title: Easily leaking passenger information on an Airline
Search URL Search Domain Scan URL
Title: CSRF CSRF CSRF…
Search URL Search Domain Scan URL
Title: Tumblr Bug Bounty ( $200)
Search URL Search Domain Scan URL
Title: Disclose Full Admin List of any Facebook Applications
Search URL Search Domain Scan URL
Title: OK Google: bypass the authentication!
Search URL Search Domain Scan URL
Title: 2FA Bypass via Logical Rate Limiting Bypass
Search URL Search Domain Scan URL
Title: How I was able to takeover the company’s LinkedIn Page
Search URL Search Domain Scan URL
Title: How I get my first SWAG from SIDN (Sensitive Data Expose)
Search URL Search Domain Scan URL
Title: Mehedi Hasan Remon (@mehedi1194)
Search URL Search Domain Scan URL
Title: Vimeo Livestream Bug Bounty WriteUp
Search URL Search Domain Scan URL
Title: Hyperlink Injection - Easy Money (sometimes)
Search URL Search Domain Scan URL
Title: Tale of a Misconfiguration in Password Reset
Search URL Search Domain Scan URL
Title: Escalating reflected XSS with HTTP Smuggling
Search URL Search Domain Scan URL
Title: Hazana (@HazanaSec)
Search URL Search Domain Scan URL
Title: XSS on Facebook-Instagram CDN Server bypassing signature protection
Search URL Search Domain Scan URL
Title: Disclose Facebook Business Account ID
Search URL Search Domain Scan URL
Title: XSS on Facebook’s acquisition Oculus CDN Server
Search URL Search Domain Scan URL
Title: Improper Input Validation | Add Custom Text and URLs In SMS send by Snapchat | Bug Bounty POC
Search URL Search Domain Scan URL
Title: $1,000
Search URL Search Domain Scan URL
Title: Accidental IDOR that Deleted Admin Account.
Search URL Search Domain Scan URL
Title: The unexpected bounty: A story of Zendesk takeover on REDACTED.com
Search URL Search Domain Scan URL
Title: Cross-Site Websocket Hijacking bug in Facebook that leads to account takeover
Search URL Search Domain Scan URL
Title: How I was able to take over any users account with host header injection
Search URL Search Domain Scan URL
Title: CORS Misconfiguration leading to Private Information Disclosure
Search URL Search Domain Scan URL
Title: Virus0X01 (@Virus0X01)
Search URL Search Domain Scan URL
Title: A Less Known Attack Vector, Second Order IDOR Attacks
Search URL Search Domain Scan URL
Title: Password Reset Token Leak Via Referrer
Search URL Search Domain Scan URL
Title: Facebook Vulnerability: Hidden “Community Manager” in Pages due to “Invitation Accept” logic
Search URL Search Domain Scan URL
Title: User Account Takeover via Signup Feature | Bug Bounty POC
Search URL Search Domain Scan URL
Title: Muzammil Kayani (@muzammilabbas2)
Search URL Search Domain Scan URL
Title: Google Bug Bounty: CSRF in learndigital.withgoogle.com
Search URL Search Domain Scan URL
Title: Cross Site Request Forgery vulnerability Leads to User Profile Change in Microsoft Express Logic
Search URL Search Domain Scan URL
Title: How i bought my way to subdomain takeover on Tokopedia
Search URL Search Domain Scan URL
Title: GGvulnz — How I hacked hundreds of companies through Google Groups
Search URL Search Domain Scan URL
Title: How I accidentally found Bug in Google Search Console
Search URL Search Domain Scan URL
Title: Tomi (@noobe_io)
Search URL Search Domain Scan URL
Title: Adding a malicious notebook to be treated like a trusted notebook in Google Colab — 1337$
Search URL Search Domain Scan URL
Title: Raushan Raj (@raushan_rajj)
Search URL Search Domain Scan URL
Title: How I discovered an interesting account takeover flaw?
Search URL Search Domain Scan URL
Title: No Rate Limit - 2K Bounty
Search URL Search Domain Scan URL
Title: How I earn $500 from Razer open S3 bucket
Search URL Search Domain Scan URL
Title: My First RCE (Stressed Employee gets me 2x bounty)
Search URL Search Domain Scan URL
Title: Hunting Good Bugs with only <HTML>
Search URL Search Domain Scan URL
Title: Ak1T4 (@akita_zen)
Search URL Search Domain Scan URL
Title: Google Chrome display locking fuzzing
Search URL Search Domain Scan URL
Title: The Bug That Exposed Your PayPal Password
Search URL Search Domain Scan URL
Title: Update: Want to take over the Java ecosystem? All you need is a MITM!
Search URL Search Domain Scan URL
Title: Jonathan Leitschuh (@jlleitschuh)
Search URL Search Domain Scan URL
Title: HTML Injection(Unique Exploitation)
Search URL Search Domain Scan URL
Title: Pratik Yadav (@PratikY9967)
Search URL Search Domain Scan URL
Title: Saying Goodbye to my Favorite 5 Minute P1
Search URL Search Domain Scan URL
Title: Allyson O’Malley (@ally_o_malley)
Search URL Search Domain Scan URL
Title: How I found a Privilege Escalation Bug in a private Ecommerce?
Search URL Search Domain Scan URL
Title: XSS on Sony subdomain
Search URL Search Domain Scan URL
Title: Gökhan Güzelkokar (@gkhck_)
Search URL Search Domain Scan URL
Title: Account takeover via HTTP Request Smuggling
Search URL Search Domain Scan URL
Title: hipotermia (@hipotermia)
Search URL Search Domain Scan URL
Title: Bypass 2FA in a website
Search URL Search Domain Scan URL
Title: Bypass Mobile PIN Verification
Search URL Search Domain Scan URL
Title: Story of an IDOR via HTTP
Search URL Search Domain Scan URL
Title: Shuaib Oladigbolu (@_sawzeeyy)
Search URL Search Domain Scan URL
Title: Exploiting HTML Injection in Email
Search URL Search Domain Scan URL
Title: From POST to GET Open redirect
Search URL Search Domain Scan URL
Title: Bug Hunting Journey of 2019
Search URL Search Domain Scan URL
Title: Exploiting a Self Stored XSS with an IDOR
Search URL Search Domain Scan URL
Title: How did I earn $3133.70 from Google Translator?
Search URL Search Domain Scan URL
Title: Beri Bey (@uppmen)
Search URL Search Domain Scan URL
Title: Facebook Bug bounty Story: $X000 for an Information Disclosure Bug
Search URL Search Domain Scan URL
Title: How I made $7500 from My First Bug Bounty Found on Google Cloud Platform
Search URL Search Domain Scan URL
Title: Drop the mic?! no! Drop the connection ;)
Search URL Search Domain Scan URL
Title: Sasi Levi (@sasi2103)
Search URL Search Domain Scan URL
Title: Effortlessly finding Cross Site Script Inclusion (XSSI) & JSONP for bug bounty
Search URL Search Domain Scan URL
Title: Omkar Bhagwat (@th3_hidd3n_mist)
Search URL Search Domain Scan URL
Title: Bypassing Brand Collabs Manager Eligibility on Facebook
Search URL Search Domain Scan URL
Title: Subdomain takeover via pantheon
Search URL Search Domain Scan URL
Title: Microsoft Edge (Chromium) - EoP via XSS to Potential RCE
Search URL Search Domain Scan URL
Title: Abdulrahman Al-Qabandi (@Qab)
Search URL Search Domain Scan URL
Title: SOP Bypass via browser-cache
Search URL Search Domain Scan URL
Title: Aaron Costello (@ConspiracyProof)
Search URL Search Domain Scan URL
Title: Abusing ImageMagick to obtain RCE
Search URL Search Domain Scan URL
Title: Strynx (@Strynx_Security)
Search URL Search Domain Scan URL
Title: How we hacked one of the worlds largest Cryptocurrency Website
Search URL Search Domain Scan URL
Title: Airbnb : Steal Earning of Airbnb hosts by Adding Bank Account/Payment Method (IDOR)
Search URL Search Domain Scan URL
Title: Vijay Kumar (@IndoAppSec)
Search URL Search Domain Scan URL
Title: Bugbounty | A Dom Xss
Search URL Search Domain Scan URL
Title: Jinone (@jinonehk)
Search URL Search Domain Scan URL
Title: GraphQL IDOR leads to information disclosure
Search URL Search Domain Scan URL
Title: CSRF Token Bypasss — A Tale of my $2k bug
Search URL Search Domain Scan URL
Title: Adeyefa Oluwatoba (@adeyefa_codes)
Search URL Search Domain Scan URL
Title: reCAPTCHA Exploits
Search URL Search Domain Scan URL
Title: Dr. Neal Krawetz (@hackerfactor)
Search URL Search Domain Scan URL
Title: From broken link to subfolder takeover on Bukalapak
Search URL Search Domain Scan URL
Title: 2 FA Bypass via CSRF Attack
Search URL Search Domain Scan URL
Title: Full Account Takeover (Android Application)
Search URL Search Domain Scan URL
Title: Bypassing Captcha !
Search URL Search Domain Scan URL
Title: Account Takeover Through Password Reset Poisoning
Search URL Search Domain Scan URL
Title: #BugBounty — How Snapdeal (India’s Popular E-commerce Website) Kept their Users Data at Risk!
Search URL Search Domain Scan URL
Title: Nanda Kumar (@nk00_nk)
Search URL Search Domain Scan URL
Title: [Google VRP] SSRF in Google Cloud Platform StackDriver
Search URL Search Domain Scan URL
Title: Ron Chan (@ngalongc)
Search URL Search Domain Scan URL
Title: Abusing feature to steal your tokens
Search URL Search Domain Scan URL
Title: BreakingApp – WhatsApp Crash & Data Loss Bug
Search URL Search Domain Scan URL
Title: Inf0rM@tion Disclosure via IDOR
Search URL Search Domain Scan URL
Title: Stored Iframe Injection + CSRF = Account Takeover 😎😎
Search URL Search Domain Scan URL
Title: Rounak Dhadiwal (@XploiteR_D)
Search URL Search Domain Scan URL
Title: How I Took Over 2 Subdomains with Azure CDN Profiles
Search URL Search Domain Scan URL
Title: 4 Google Cloud Shell bugs explained
Search URL Search Domain Scan URL
Title: Authorization bug that every bug hunter missed on a popular program
Search URL Search Domain Scan URL
Title: Vimeo upload function SSRF
Search URL Search Domain Scan URL
Title: How I was able to find a logical bug on Instagram?
Search URL Search Domain Scan URL
Title: Jabir Khan (@Jabirkhan0x0)
Search URL Search Domain Scan URL
Title: Facebook New Account Verification Bypass
Search URL Search Domain Scan URL
Title: Santosh Baral (@santoshbrl5)
Search URL Search Domain Scan URL
Title: Multiple Host Header Attacks after bypassing protection with… a Header Attack
Search URL Search Domain Scan URL
Title: A $25 Easy Bug.
Search URL Search Domain Scan URL
Title: SSRF via FFmpeg HLS processing
Search URL Search Domain Scan URL
Title: Pflash Punk (@PflashPunk)
Search URL Search Domain Scan URL
Title: Blind Xss (A mind game to win the battle)
Search URL Search Domain Scan URL
Title: Dirtycoder (@dirtycoder0124)
Search URL Search Domain Scan URL
Title: AirDoS: Remotely render any nearby iPhone or iPad unusable
Search URL Search Domain Scan URL
Title: Kishan Bagaria (@KishanBagaria)
Search URL Search Domain Scan URL
Title: Get pwned by scanning QR Code
Search URL Search Domain Scan URL
Title: Authentication Bypass
Search URL Search Domain Scan URL
Title: Rushiikesh (@u1tran00b)
Search URL Search Domain Scan URL
Title: Media deletion CSRF vulnerability on Instagram
Search URL Search Domain Scan URL
Title: Telegram (v4.9.155353) was rendering file:// links + opening them via NSWorkspace.open -> code execution.
Search URL Search Domain Scan URL
Title: $500
Search URL Search Domain Scan URL
Title: Spilling Local Files via XXE when HTTP OOB fails
Search URL Search Domain Scan URL
Title: Reusing Cookies
Search URL Search Domain Scan URL
Title: HTML Injection to XSS bypass in [REDACTED.com]
Search URL Search Domain Scan URL
Title: $150 XSS at Error Page of Respository Code
Search URL Search Domain Scan URL
Title: Google Chrome portal element fuzzing
Search URL Search Domain Scan URL
Title: HTTP Request Smuggling + IDOR
Search URL Search Domain Scan URL
Title: XSS like a Pro
Search URL Search Domain Scan URL
Title: Anas Mahmood (@AnasIsHere)
Search URL Search Domain Scan URL
Title: Dank Writeup On Broken Access Control On An Indian Startup
Search URL Search Domain Scan URL
Title: My first RCE: a tale of good ideas and good friends
Search URL Search Domain Scan URL
Title: rez0 (@rez0__)
Search URL Search Domain Scan URL
Title: How I turned Self XSS to Stored via CSRF
Search URL Search Domain Scan URL
Title: Hacking GitHub with Unicode’s dotless ‘i’
Search URL Search Domain Scan URL
Title: John Gracey (@jagracey)
Search URL Search Domain Scan URL
Title: XSS Stored On [ Outlook Web — Outlook Android App ]
Search URL Search Domain Scan URL
Title: $2,400
Search URL Search Domain Scan URL
Title: Reflected XSS in graph.facebook.com leads to account takeover in IE/Edge
Search URL Search Domain Scan URL
Title: Getting access to disabled/hidden features with the help of Burpsuite Match and Replace settings
Search URL Search Domain Scan URL
Title: Johns Simon (@Johnssimon22)
Search URL Search Domain Scan URL
Title: How Did Tons of People Like Me on Tinder?
Search URL Search Domain Scan URL
Title: Mustafa iran (@Mustafaran)
Search URL Search Domain Scan URL
Title: Finding a security bug in Discord and what it taught me
Search URL Search Domain Scan URL
Title: Tristan Farkas (@TristanAtFarkas)
Search URL Search Domain Scan URL
Title: CORS Misconfiguration to Account TakeOver [Out of scope to grab items In-Scope]
Search URL Search Domain Scan URL
Title: Mashoud1122 (@mashoud1122)
Search URL Search Domain Scan URL
Title: The AccountTakeOver Killing Chain
Search URL Search Domain Scan URL
Title: Exploiting padding oracles with fixed IVs
Search URL Search Domain Scan URL
Title: IDOR via Websockets
Search URL Search Domain Scan URL
Title: Stories Of IDOR-Part 2
Search URL Search Domain Scan URL
Title: Shivbihari Pandey (@ninja_pandit_)
Search URL Search Domain Scan URL
Title: Disable Any Unconfirmed Account in Facebook
Search URL Search Domain Scan URL
Title: 700$ Denial of Service(DoS) vulnerability in script-loader.php (CVE-2018-6389)
Search URL Search Domain Scan URL
Title: Pankaj Thakur (@Nep_1337_1998)
Search URL Search Domain Scan URL
Title: Reply To Instagram Stories where privacy of who can reply is set to ‘Nobody’. (Part 2)
Search URL Search Domain Scan URL
Title: How I paid 2$ for a 1054$ XSS bug + 20 chars blind XSS payloads
Search URL Search Domain Scan URL
Title: Cracking reCAPTCHA, Turbo Intruder style
Search URL Search Domain Scan URL
Title: James Kettle (@albinowax)
Search URL Search Domain Scan URL
Title: Subdomain Takeover via Campaignmonitor.com
Search URL Search Domain Scan URL
Title: How I could delete Facebook Ask for Recommendations post’s place objects in comments
Search URL Search Domain Scan URL
Title: Broken session management leads to bypass 2FA and Permanent access to Facebook user’s
Search URL Search Domain Scan URL
Title: Mahmoud Barakat (@0xBarakat)
Search URL Search Domain Scan URL
Title: Disclose the owner of a recruiting manager in Jobs Beta
Search URL Search Domain Scan URL
Title: Million Users PII Leak Data Leak
Search URL Search Domain Scan URL
Title: XSS in GMail’s AMP4Email via DOM Clobbering
Search URL Search Domain Scan URL
Title: This is How I was able to hunt a rare bug in a private program
Search URL Search Domain Scan URL
Title: My First Bug ($500)
Search URL Search Domain Scan URL
Title: Bypassing the patch for my previous Instagram bug.
Search URL Search Domain Scan URL
Title: Privilege Escalation with simple recon
Search URL Search Domain Scan URL
Title: Mayur Gupta (@RisingHunter_)
Search URL Search Domain Scan URL
Title: LDAP Admin Account Bypassed :)
Search URL Search Domain Scan URL
Title: Himanshu Pdy (@himanshu_pdy_01)
Search URL Search Domain Scan URL
Title: View the ranked messenger users for any page
Search URL Search Domain Scan URL
Title: [Writeup][Bug Bounty][Tokopedia] Manipulation of Likes in Product Reviews [EN]
Search URL Search Domain Scan URL
Title: Authenticated CORS with Access-Control-Allow-Origin: *
Search URL Search Domain Scan URL
Title: BitK (@BitK_)
Search URL Search Domain Scan URL
Title: Chains on Chains!! Chaining several IDOR’s into Account Takeover(PART ONE)
Search URL Search Domain Scan URL
Title: Daniel Marte (@DanielM59720745)
Search URL Search Domain Scan URL
Title: Taking over Facebook Page Tabs
Search URL Search Domain Scan URL
Title: Sagar Tanur (@Sagarvd01)
Search URL Search Domain Scan URL
Title: [Server Side Request Forgery] Blind SSRF due to Sentry Misconfiguration
Search URL Search Domain Scan URL
Title: Kent Bayron (@bayronkentoy)
Search URL Search Domain Scan URL
Title: Command Injection Through BLH
Search URL Search Domain Scan URL
Title: Shankar R (@trapp3r_hat)
Search URL Search Domain Scan URL
Title: Mass XS-Search using Cache Attack
Search URL Search Domain Scan URL
Title: terjanq (@terjanq)
Search URL Search Domain Scan URL
Title: How I accidentally took down GitHub Actions
Search URL Search Domain Scan URL
Title: Bug Bounty: Broken API Authorization
Search URL Search Domain Scan URL
Title: How i Bought VPS, Hosting, Domain only $0.01
Search URL Search Domain Scan URL
Title: Keylogging users via Slack themes
Search URL Search Domain Scan URL
Title: Matt Langlois (@fletchto99)
Search URL Search Domain Scan URL
Title: My First SSRF Using DNS Rebinding
Search URL Search Domain Scan URL
Title: DOM-Based XSS | Bug Bounty Writeup
Search URL Search Domain Scan URL
Title: HacknPentest (@HacknPentest)
Search URL Search Domain Scan URL
Title: BugBounty: How I Cracked 2FA (Two-Factor Authentication) with Simple Factor Brute-force !!! 😎
Search URL Search Domain Scan URL
Title: Akash Agrawal (@akashmagrawal)
Search URL Search Domain Scan URL
Title: How I Hacked Dutch Government in 5 Minutes? Twitter Account Takeover
Search URL Search Domain Scan URL
Title: Numan ÖZDEMİR (@numanozdemircom)
Search URL Search Domain Scan URL
Title: A simple post auth bypass leads to unauthorized web server access
Search URL Search Domain Scan URL
Title: Hein Thant Zin (@H3Lowr)
Search URL Search Domain Scan URL
Title: Bypassing GitHub’s OAuth flow
Search URL Search Domain Scan URL
Title: BugBounty | A Simple SSRF
Search URL Search Domain Scan URL
Title: XSS will never die
Search URL Search Domain Scan URL
Title: Oleksandr Opanasiuk (@Lekssik2)
Search URL Search Domain Scan URL
Title: Filling in the Blanks: Exploiting Null Byte Buffer Overflow for a $40,000 Bounty
Search URL Search Domain Scan URL
Title: Live Video facebook application (Android) its not expired when log out the device on https://www.facebook.com/settings?tab=security§ion=sessions&view
Search URL Search Domain Scan URL
Title: Naufal Septiadi
Search URL Search Domain Scan URL
Title: GraphQL introspection leads to sensitive data disclosure.
Search URL Search Domain Scan URL
Title: 5,000 USD XSS Issue at Avast Desktop AntiVirus for Windows (Yes, Desktop!)
Search URL Search Domain Scan URL
Title: Cross Site Request Forgery Critical Exploitable IN Infected Site?
Search URL Search Domain Scan URL
Title: XSS to Account Takeover
Search URL Search Domain Scan URL
Title: [Leak] Can I take the user information, please?!!
Search URL Search Domain Scan URL
Title: How I hacked 50+ Companies in 6 hrs
Search URL Search Domain Scan URL
Title: Vignesh C (@pwn_r00t)
Search URL Search Domain Scan URL
Title: [Writeup — FB] Crash web — app through application form of job application pages
Search URL Search Domain Scan URL
Title: Illegal Rendered at Download Feature in Several Apps (including Opera Mini) that Lead to Extension Manipulation (with RTLO)
Search URL Search Domain Scan URL
Title: How to Takover a ldap server.
Search URL Search Domain Scan URL
Title: Session Expiration Bypass in Facebook Creator App
Search URL Search Domain Scan URL
Title: How I earned \(\) by finding confidential customer data including plain-text passwords!
Search URL Search Domain Scan URL
Title: Sushant Soni (@sushantsoni5392)
Search URL Search Domain Scan URL
Title: NFC Beaming Bypasses Security Controls in Android [CVE-2019-2114]
Search URL Search Domain Scan URL
Title: (POC) Disclose members in any closed Facebook group
Search URL Search Domain Scan URL
Title: [ BUG BOUNTY ] Flaw in Authentication ( Hall of Fame Google )
Search URL Search Domain Scan URL
Title: Danang Tri Atmaja (@danangtriatmj)
Search URL Search Domain Scan URL
Title: How PayPal helped me to generate XSS
Search URL Search Domain Scan URL
Title: Escalating Privileges like a Pro
Search URL Search Domain Scan URL
Title: Gaurav Narwani (@gauravnarwani97)
Search URL Search Domain Scan URL
Title: Hunting for bounties antihack.me case study
Search URL Search Domain Scan URL
Title: Inf0rM@tion Disclosure via IDOR
Search URL Search Domain Scan URL
Title: 1-800-Flowers Credentials and message log leak via facebook.com/facebook
Search URL Search Domain Scan URL
Title: How I was able to bypass OTP code requirement in Razer [The story of a critical bug]
Search URL Search Domain Scan URL
Title: Ananda Dhakal (@dhakal_ananda)
Search URL Search Domain Scan URL
Title: How I found RCE But Got Duplicated
Search URL Search Domain Scan URL
Title: [ Writeup — Bugbounty Facebook ] Disclosure the verified phone number in Checkpoint.
Search URL Search Domain Scan URL
Title: How I bypassed 2 Factor Authentication
Search URL Search Domain Scan URL
Title: Hemant Singh Manral
Search URL Search Domain Scan URL
Title: An inconsistent CSRF
Search URL Search Domain Scan URL
Title: Finding SQL injections fast with white-box analysis — a recent bug example
Search URL Search Domain Scan URL
Title: frycos (@frycos)
Search URL Search Domain Scan URL
Title: Whitehat test accounts can act as Hidden Admin with Business manager / Ad Accounts.
Search URL Search Domain Scan URL
Title: Bypass Uppercase filters like a PRO (XSS Advanced Methods)
Search URL Search Domain Scan URL
Title: How i Hacked BASF Company !!
Search URL Search Domain Scan URL
Title: Murtada Kamil
Search URL Search Domain Scan URL
Title: EXIF Geolocation Data Not Stripped From Uploaded Images
Search URL Search Domain Scan URL
Title: Sourav Newatia (@souravnewatia)
Search URL Search Domain Scan URL
Title: How “Recon” helped Samsung protect their production repositories of SamsungTv, eCommerce / eStores
Search URL Search Domain Scan URL
Title: Prateek Tiwari
Search URL Search Domain Scan URL
Title: From Multiple IDORs leading to Code Execution on a different Host Container
Search URL Search Domain Scan URL
Title: Rahul (@Rahul_R95)
Search URL Search Domain Scan URL
Title: How I made 1000$ with AT&T Bug Bounty(H1)
Search URL Search Domain Scan URL
Title: REST framework Admin Panel bypass and how I recon for this vulnerability
Search URL Search Domain Scan URL
Title: Aziz Hakim (@hackerb0y_)
Search URL Search Domain Scan URL
Title: GraphQL Introspection leads to Sensitive Data Disclosure.
Search URL Search Domain Scan URL
Title: How to get RCE on AEM instance without Java knowledge
Search URL Search Domain Scan URL
Title: byq (@ByQwert)
Search URL Search Domain Scan URL
Title: Stealing login credentials with Reflected XSS
Search URL Search Domain Scan URL
Title: mehulpanchal007 (@007_sharky)
Search URL Search Domain Scan URL
Title: One Way to Find Hidden IDOR Vulnerability
Search URL Search Domain Scan URL
Title: Vulkey_Chen (@Vulkey_Chen)
Search URL Search Domain Scan URL
Title: Bug Hunting: Xss On Cookie Popup Warning
Search URL Search Domain Scan URL
Title: vict0ni (@vict0ni)
Search URL Search Domain Scan URL
Title: Spear texting via parameter injection
Search URL Search Domain Scan URL
Title: Kyle (@B3nac)
Search URL Search Domain Scan URL
Title: XSS Is Love <3 !
Search URL Search Domain Scan URL
Title: Nirmal Dahal (@TheNittam)
Search URL Search Domain Scan URL
Title: Stories Of IDOR
Search URL Search Domain Scan URL
Title: OnePlus Open/Unvalidated Redirects & Forwards
Search URL Search Domain Scan URL
Title: Analysis of CVE-2019-14994 – Jira Service Desk Path Traversal leads to Massive Information Disclosure
Search URL Search Domain Scan URL
Title: Information Disclosure at PayPal and Xoom (PayPal Acquisition) via Simple Google Dork - 1,000 USD
Search URL Search Domain Scan URL
Title: YoKo Kho (@YoKoAcc)
Search URL Search Domain Scan URL
Title: ONEPLUS XSS vulnerability in Customer Support Portal
Search URL Search Domain Scan URL
Title: Fuzzing Till
Search URL Search Domain Scan URL
Title: Verneet (@err0rrrrr)
Search URL Search Domain Scan URL
Title: Broken Link Hijacking - s3 buckets
Search URL Search Domain Scan URL
Title: Tutorgeeks (@tutorgeeks)
Search URL Search Domain Scan URL
Title: [Bug Bounty] Exploiting Cookie Based XSS by Finding RCE
Search URL Search Domain Scan URL
Title: [Case Study] OAuth Misconfiguration leads to Account Takeover
Search URL Search Domain Scan URL
Title: Facebook Workplace Privilege Escalation Vulnerability To Change The Post Privacy As Public
Search URL Search Domain Scan URL
Title: A Simple bypass of Registration Activation that Lead to many Bug -
Search URL Search Domain Scan URL
Title: Bug or Feature? GitHub Adventure #001
Search URL Search Domain Scan URL
Title: Dominik Opyd (@oad_earth)
Search URL Search Domain Scan URL
Title: Stored XSS on Zendesk via Macro’s PART 2
Search URL Search Domain Scan URL
Title: IDOR in One plus leads to leak User personal Info.
Search URL Search Domain Scan URL
Title: Aditya Sharma (@Assass1nmarcos)
Search URL Search Domain Scan URL
Title: How I able to Takeover 10 subdomains in a Private Program ?
Search URL Search Domain Scan URL
Title: Business ID leak via Creative Hub redirect
Search URL Search Domain Scan URL
Title: Admin hijacked by Sea Surf Pirates
Search URL Search Domain Scan URL
Title: SSRF | Reading Local Files from DownNotifier server
Search URL Search Domain Scan URL
Title: Dr.FarFar (@3XS0)
Search URL Search Domain Scan URL
Title: RCE with Flask Jinja Template Injection
Search URL Search Domain Scan URL
Title: AkShAy KaTkAr (@AkShAy KaTkAr)
Search URL Search Domain Scan URL
Title: Client, not client!
Search URL Search Domain Scan URL
Title: Google Referer Leak Bug
Search URL Search Domain Scan URL
Title: How I found a simple and weird Account takeover bug
Search URL Search Domain Scan URL
Title: OTP Manipulation
Search URL Search Domain Scan URL
Title: Kishan choudhary (@choudhary_1337)
Search URL Search Domain Scan URL
Title: Race Condition that could Result to RCE - (A story with an App that temporary stored an uploaded file within 2 seconds before moving it to Amazon S3)
Search URL Search Domain Scan URL
Title: I Could Have Hacked All Uber Accounts- But I Chose to Report it Instead
Search URL Search Domain Scan URL
Title: Anand Prakash (@sehacure)
Search URL Search Domain Scan URL
Title: How two dead accounts allowed remote crash of any instagram android user
Search URL Search Domain Scan URL
Title: Valerio brussani (@val_brux)
Search URL Search Domain Scan URL
Title: Unauthorized access to all user information leaks
Search URL Search Domain Scan URL
Title: C1h2e1 (@C1h2e11)
Search URL Search Domain Scan URL
Title: HTTP Request Smuggling CL.TE
Search URL Search Domain Scan URL
Title: memN0ps (@memN0ps)
Search URL Search Domain Scan URL
Title: Exploiting File Uploads Pt. 2 – A Tale of a $3k worth RCE.
Search URL Search Domain Scan URL
Title: HackerOn2Wheels (@HackerOn2Wheels)
Search URL Search Domain Scan URL
Title: Facebook employee internal tool and conversations leaked in Facebook video
Search URL Search Domain Scan URL
Title: How I could have hacked your Uber account
Search URL Search Domain Scan URL
Title: How does my recon win $250 in 15 minutes
Search URL Search Domain Scan URL
Title: Add users to roles on Facebook pages without an invitation consent
Search URL Search Domain Scan URL
Title: Pwn Them All #BugBounty
Search URL Search Domain Scan URL
Title: Subscribe to the list of requesters to join a Facebook live video using MQTT
Search URL Search Domain Scan URL
Title: H1-4420: From Quiz to Admin - Chaining Two 0-Days to Compromise An Uber Wordpress
Search URL Search Domain Scan URL
Title: Telegram addresses another privacy issue
Search URL Search Domain Scan URL
Title: Accessing 2 million Verizon Pay Monthly contracts
Search URL Search Domain Scan URL
Title: Daley Bee (@daley)
Search URL Search Domain Scan URL
Title: Oculus identity verification bypass through brute-force
Search URL Search Domain Scan URL
Title: karthik kumar reddy (@karthiksunny007)
Search URL Search Domain Scan URL
Title: XSS in Zoho Mail
Search URL Search Domain Scan URL
Title: Exploiting JSONP and Bypassing Referer Check
Search URL Search Domain Scan URL
Title: Write up of two HTTP Requests Smuggling
Search URL Search Domain Scan URL
Title: Finding Gem in Someone’s Report: Instant $500USD at HackerOne Platform
Search URL Search Domain Scan URL
Title: DOM Based XSS in Private Program
Search URL Search Domain Scan URL
Title: Readme.com Account Takeover
Search URL Search Domain Scan URL
Title: Ankush Goel (@0xankush)
Search URL Search Domain Scan URL
Title: Exposed Jenkins to RCE on 8 Adobe Experience Managers
Search URL Search Domain Scan URL
Title: Corben Leo (@hacker_)
Search URL Search Domain Scan URL
Title: Add new user with Admin permission and takeover the organization
Search URL Search Domain Scan URL
Title: RCE using Path Traversal
Search URL Search Domain Scan URL
Title: inc0gbyt3 (@incogbyte)
Search URL Search Domain Scan URL
Title: HTML to PDF converter bug leads to RCE in Facebook server
Search URL Search Domain Scan URL
Title: Google Cloud Blog platform vulnerability
Search URL Search Domain Scan URL
Title: Alexandru Coltuneac (@dekeeu)
Search URL Search Domain Scan URL
Title: Graphql Bug to Steal Anyone’s Address
Search URL Search Domain Scan URL
Title: My First LFI
Search URL Search Domain Scan URL
Title: Tirtha Mandal (@tirtha_mandal)
Search URL Search Domain Scan URL
Title: Shodan is your friend!!! If you ignore him you will lose many…
Search URL Search Domain Scan URL
Title: Address bar spoofing in Firefox Lite for Android …and the idiocy that followed
Search URL Search Domain Scan URL
Title: How to look for JS files Vulnerability for fun and profit?
Search URL Search Domain Scan URL
Title: Private bug bounty \(,\)$ USD: “RCE as root on Marathon-Mesos instance”
Search URL Search Domain Scan URL
Title: How I Hacked Instagram Again
Search URL Search Domain Scan URL
Title: Laxman Muthiyah (@LaxmanMuthiyah)
Search URL Search Domain Scan URL
Title: Bug Bounty: Bypassing a crappy WAF to exploit a blind SQL injection
Search URL Search Domain Scan URL
Title: Robin Verton (@robinverton)
Search URL Search Domain Scan URL
Title: Create living room polls as a Facebook page analyst
Search URL Search Domain Scan URL
Title: From Github Recon To Account Takeover
Search URL Search Domain Scan URL
Title: Dipak kumar Das (@d1pakdas)
Search URL Search Domain Scan URL
Title: Cookie worth a fortune
Search URL Search Domain Scan URL
Title: One Bug To Rule Them All: Modern Android Password Managers and FLAG_SECURE Misuse
Search URL Search Domain Scan URL
Title: Rights Manager Graph API Disclosure of business employee to non business employee
Search URL Search Domain Scan URL
Title: Jafar Abo Nada (@Jafar_Abo_Nada)
Search URL Search Domain Scan URL
Title: Instagram account is reactivated without entering 2FA ($500)
Search URL Search Domain Scan URL
Title: Aman Shahid (@amansmughal)
Search URL Search Domain Scan URL
Title: Sending Message as page being an analyst/ advertiser?
Search URL Search Domain Scan URL
Title: How I made my first $$$ from finding a bug in Facebook
Search URL Search Domain Scan URL
Title: Aayush Pokhrel (@aayushpok)
Search URL Search Domain Scan URL
Title: How I upgraded my privileges to the administrator of Odnoklassniki’s url shortener
Search URL Search Domain Scan URL
Title: Sergey Kashatov (@iframe0x01)
Search URL Search Domain Scan URL
Title: Facebook Bug Bounty: Reading WhatsApp contacts list without unlocking the device
Search URL Search Domain Scan URL
Title: U.S. Department of Defense - Info Disclosure and SQLi Writeup
Search URL Search Domain Scan URL
Title: Aaron Esau (@arinerron)
Search URL Search Domain Scan URL
Title: Removing profile pictures for any Facebook user
Search URL Search Domain Scan URL
Title: Add users to roles on Facebook pages without an invitation consent (revisited)
Search URL Search Domain Scan URL
Title: How I was able to earn 1000$ with just 10 minutes of bug bounty?
Search URL Search Domain Scan URL
Title: ByPassing fix of Domain Blocking feature in Business Manager
Search URL Search Domain Scan URL
Title: Facebook Messenger exposing deleted messages using [Remove for Everyone]
Search URL Search Domain Scan URL
Title: BookMyShow account takeover using social login
Search URL Search Domain Scan URL
Title: Sukhmeet Singh (@MadGuyyy)
Search URL Search Domain Scan URL
Title: [Business Logic] Bypassing Nickname Feature
Search URL Search Domain Scan URL
Title: [Business Logic Bug] Bypassing Nickname Feature
Search URL Search Domain Scan URL
Title: BugBounty WriteUp — take attention and get Stored XSS
Search URL Search Domain Scan URL
Title: How I XSSed Admin Account
Search URL Search Domain Scan URL
Title: SSRF Vulnerability in https://app.[REDACTED].com
Search URL Search Domain Scan URL
Title: Reporting - Amazon 1 click device XSS
Search URL Search Domain Scan URL
Title: Sneakerhax (@sneakerhax)
Search URL Search Domain Scan URL
Title: Clickjacking DOM XSS on Google.org
Search URL Search Domain Scan URL
Title: Application Level Denial of Service [DoS] using SVG file in https://[REDACTED].com (Write Up)
Search URL Search Domain Scan URL
Title: Two Easy RCE in Atlassian Products
Search URL Search Domain Scan URL
Title: Read other user support tickets in https://support..com (Write Up)
Search URL Search Domain Scan URL
Title: Privilege Escalation using Api endpoint
Search URL Search Domain Scan URL
Title: Writing my Medium blog to complete account takeover
Search URL Search Domain Scan URL
Title: Exploiting Out Of Band XXE using internal network and php wrappers
Search URL Search Domain Scan URL
Title: BugBounty WriteUp — Creative thinking is our everything (Race Condition + Business Logic Error)
Search URL Search Domain Scan URL
Title: Stored XSS on LaporBug.id
Search URL Search Domain Scan URL
Title: rizal (@sayadarijawa)
Search URL Search Domain Scan URL
Title: Vulnerability in Hangouts Chat: from open redirect to code execution
Search URL Search Domain Scan URL
Title: Leveraging AngularJS-based XSS to Privilege Escalation
Search URL Search Domain Scan URL
Title: How I Found XSS By Searching In Shodan
Search URL Search Domain Scan URL
Title: No Rate limiting eligible for bounty ?
Search URL Search Domain Scan URL
Title: From Sub domain Takeover to Open-Redirect
Search URL Search Domain Scan URL
Title: One Misconfig (JIRA) to Leak Them All- Including NASA and Hundreds of Fortune 500 Companies!
Search URL Search Domain Scan URL
Title: Bypassing CORS
Search URL Search Domain Scan URL
Title: Complete information disclosure using Broken Access Control
Search URL Search Domain Scan URL
Title: Download predictions details of ads plans of any business.
Search URL Search Domain Scan URL
Title: Internal path disclosure in Instagram server
Search URL Search Domain Scan URL
Title: Access portal of Facebook mobile retailers and see earnings and referrals reports.
Search URL Search Domain Scan URL
Title: View orders and financial reports lists for any page shop.
Search URL Search Domain Scan URL
Title: Bypassing CORS
Search URL Search Domain Scan URL
Title: RCE in Ruby using Mustache Templates
Search URL Search Domain Scan URL
Title: Rhys Elsmore (@rhyselsmore)
Search URL Search Domain Scan URL
Title: Reposted [2017]: LinkedIn Hacker’s Experience
Search URL Search Domain Scan URL
Title: Reposted [2019]: Hacking YouTube for #fun and #profit
Search URL Search Domain Scan URL
Title: Paypal bug $10K - All Secondary users account takeover leads to unauthorized money transfer from paypal business accounts
Search URL Search Domain Scan URL
Title: Mohd haji (@mohdhaji24)
Search URL Search Domain Scan URL
Title: SQL Injection in private-site.com/login.php
Search URL Search Domain Scan URL
Title: 1st Bounty Story | Rewarded 300$ (IDOR)
Search URL Search Domain Scan URL
Title: Story of an IDOR via Email
Search URL Search Domain Scan URL
Title: Old GitHub Profile Takeover!
Search URL Search Domain Scan URL
Title: Chaining Cache Poisoning To Stored XSS
Search URL Search Domain Scan URL
Title: Rohan aggarwal (@nahoragg)
Search URL Search Domain Scan URL
Title: Solr Injection by abusing Local Parameters on Zomato.com
Search URL Search Domain Scan URL
Title: Story about Facebook Oauth Account Takeover
Search URL Search Domain Scan URL
Title: Facebook BugBounty: Tale of an Instagram bug disclosing user’s phone number via checkpoint
Search URL Search Domain Scan URL
Title: Full Account Takeover via Changing Email And Password of any User through API Parameters
Search URL Search Domain Scan URL
Title: Price Parameter Tampering On Bukalapak
Search URL Search Domain Scan URL
Title: Apapedulimu (@LocalHost31337)
Search URL Search Domain Scan URL
Title: How I found the most critical bug in live bug bounty event?
Search URL Search Domain Scan URL
Title: Lakshay (@inn0c3ntd3v1L)
Search URL Search Domain Scan URL
Title: XSS to RCE in …
Search URL Search Domain Scan URL
Title: Hungry Bytes (@hungrybytes)
Search URL Search Domain Scan URL
Title: Disclose any main and 3rd party contributors email address and movie local path thru XML file in Plex TV - plex.tv (Write Up)
Search URL Search Domain Scan URL
Title: XX to XXX in one day
Search URL Search Domain Scan URL
Title: Pwning child company to get access to ParentCompany’s Slack Team
Search URL Search Domain Scan URL
Title: Parth Malhotra (@Parth_Malhotra)
Search URL Search Domain Scan URL
Title: XSS On Twitter [Worth 1120$]
Search URL Search Domain Scan URL
Title: Bywalks (@bywalkss)
Search URL Search Domain Scan URL
Title: Reflected XSS in Ebay.com
Search URL Search Domain Scan URL
Title: Subscribe to typing notifications for any Instagram user
Search URL Search Domain Scan URL
Title: Not a fancy bug, just HTML Injection in Clause - clause.io (Write Up)
Search URL Search Domain Scan URL
Title: Shopping Products For Free- Parameter Tampering Vulnerability
Search URL Search Domain Scan URL
Title: Exploiting a Tricky Blind SQL Injection inside LIMIT clause
Search URL Search Domain Scan URL
Title: Get Page Inbox notifications for any Facebook page
Search URL Search Domain Scan URL
Title: Microsoft ID Open Redirect
Search URL Search Domain Scan URL
Title: Microsoft Office 365 - Outlook XSS
Search URL Search Domain Scan URL
Title: SQL Injection in Forget Password Function
Search URL Search Domain Scan URL
Title: How to lock a GitHub user out of their repos (bug or feature?)
Search URL Search Domain Scan URL
Title: Сookie-based XSS exploitation | $2300 Bug Bounty story
Search URL Search Domain Scan URL
Title: Max (@iSecMax)
Search URL Search Domain Scan URL
Title: Account Takeover Vulnerability :)
Search URL Search Domain Scan URL
Title: Sumit Jain (@sumit_cfe)
Search URL Search Domain Scan URL
Title: How Recon helped me to to find a Facebook domain takeover
Search URL Search Domain Scan URL
Title: Facebook Informative Bug From Triaged
Search URL Search Domain Scan URL
Title: CSRF Email Confirmation Vulnerability for Gmail & G-Suite in Facebook
Search URL Search Domain Scan URL
Title: Bypass CSRF With ClickJacking Worth $1250
Search URL Search Domain Scan URL
Title: What do Netcat, SMTP and self XSS have in common? Stored XSS
Search URL Search Domain Scan URL
Title: Plenum (@plenumlab)
Search URL Search Domain Scan URL
Title: How I Could Get The Instagram Username of Anyone on Tinder
Search URL Search Domain Scan URL
Title: The Bugs Are Out There, Hiding in Plain Sight
Search URL Search Domain Scan URL
Title: 500$ bounty: Man in the Middle on Slack
Search URL Search Domain Scan URL
Title: Wiard van Rij / Sysrant (@RijWiard)
Search URL Search Domain Scan URL
Title: Facebook Bug : Sending messages as a page with jobmanager permission
Search URL Search Domain Scan URL
Title: Devansh batham (@devanshwolf)
Search URL Search Domain Scan URL
Title: [TOKOPEDIA] Site-wide CSRF through GraphQL request
Search URL Search Domain Scan URL
Title: Rafie Muhammad (@rafiem777)
Search URL Search Domain Scan URL
Title: How I Could Have Hacked Any Instagram Account
Search URL Search Domain Scan URL
Title: Cracking my windshield and earning $10,000 on the Tesla Bug Bounty Program
Search URL Search Domain Scan URL
Title: Hacking intoTinder’s Premium Model
Search URL Search Domain Scan URL
Title: Sanskar Jethi (@sansyrox)
Search URL Search Domain Scan URL
Title: Account takeover on Airbnb acquisition | An Unusual Bug Part-2 🐛
Search URL Search Domain Scan URL
Title: PRince CHaddha (@princechaddha)
Search URL Search Domain Scan URL
Title: Facebook Bug bounty page admin disclose bug {Facebook Android app}
Search URL Search Domain Scan URL
Title: Yusuf Furkan (@h1_yusuf)
Search URL Search Domain Scan URL
Title: XSS on Google Custom Search Engine
Search URL Search Domain Scan URL
Title: Story of my Biggest Bounty ever : Command Execution on Jenkin
Search URL Search Domain Scan URL
Title: Jay Jani (@JayJani007)
Search URL Search Domain Scan URL
Title: SQL Injection Bug Bounty POC!
Search URL Search Domain Scan URL
Title: Tale of account takeover — Sensitive info Disclosure + Broken Access Control
Search URL Search Domain Scan URL
Title: Md Saqib (@sakyb7)
Search URL Search Domain Scan URL
Title: OAuth authentication bypass on Airbnb acquisition using 1-char Open Redirect
Search URL Search Domain Scan URL
Title: Evgeniy Yakovchuk (@h1_sp1d3r)
Search URL Search Domain Scan URL
Title: A malicious editor of a page can support to a community action which can’t be unsupported by the admin!
Search URL Search Domain Scan URL
Title: Information Disclosure via Misconfigured AWS to AWS Bucket Takeover
Search URL Search Domain Scan URL
Title: Cleartext password in LocalStorage (Writeup)
Search URL Search Domain Scan URL
Title: Blind (time-based) SQLi - Bug Bounty
Search URL Search Domain Scan URL
Title: This is how I managed to win $2000 through Facebook Bug Bounty
Search URL Search Domain Scan URL
Title: Facebook Vulnerability: Unremovable Co-Host in facebook page events
Search URL Search Domain Scan URL
Title: Account Takeover Using CSRF(json-based)
Search URL Search Domain Scan URL
Title: shub rathore (@shub66452)
Search URL Search Domain Scan URL
Title: Story of a stored xss to full account takeover vulnerability(N/A to accepted)
Search URL Search Domain Scan URL
Title: Finding hidden gems vol. 4: Rakefile a.k.a. how to get AWS keys again
Search URL Search Domain Scan URL
Title: Yeah! I got P2 in 1 minute - Stored XSS via Markdown Editor
Search URL Search Domain Scan URL
Title: Injecting {{6*200}} to $1200
Search URL Search Domain Scan URL
Title: Another Download Protection Bypass in Google Chrome – BIN files in Mac OS
Search URL Search Domain Scan URL
Title: How I escalated RFI into LFI
Search URL Search Domain Scan URL
Title: Hassan Khan Yusufzai (@Splint3r7)
Search URL Search Domain Scan URL
Title: Accidental IDOR
Search URL Search Domain Scan URL
Title: Stored XSS on Indeed
Search URL Search Domain Scan URL
Title: One more Parameter manipulation bug (🤑)
Search URL Search Domain Scan URL
Title: Kanchan Singh Yadav (@KanchanSingh0)
Search URL Search Domain Scan URL
Title: Facebook BugBounty : Short story on Page admin disclosure
Search URL Search Domain Scan URL
Title: Nuget/Squirrel uncontrolled endpoints leads to arbitrary code execution
Search URL Search Domain Scan URL
Title: Reegun J (@reegun21)
Search URL Search Domain Scan URL
Title: Gain adfly SMTP access with SSRF via Gopher Protocol
Search URL Search Domain Scan URL
Title: View Facebook payouts for any Facebook Trivia Game
Search URL Search Domain Scan URL
Title: 1-Click Account Takeover in Virgool.io — a Nice Case Study
Search URL Search Domain Scan URL
Title: CORS To CSRF Attack
Search URL Search Domain Scan URL
Title: Toggle Group Rules Agreement as a non-member
Search URL Search Domain Scan URL
Title: Sensitive Information Disclosure: Web Cache Deception Attack
Search URL Search Domain Scan URL
Title: Wasim Shaikh (@Wa_sim_sim)
Search URL Search Domain Scan URL
Title: Download .arexport files for any public AR Studio Effect
Search URL Search Domain Scan URL
Title: CSV injection at Comment Section.
Search URL Search Domain Scan URL
Title: Password Reset Vulnerability — Full Account takeover (Insecure Direct Object Reference)
Search URL Search Domain Scan URL
Title: Page Admin Disclosure | Facebook Bug Bounty 2019
Search URL Search Domain Scan URL
Title: How I Hacked the Microsoft Outlook Android App and Found CVE-2019-1105
Search URL Search Domain Scan URL
Title: Bryan Appleby (@bryapp)
Search URL Search Domain Scan URL
Title: Catching support emails from my internet service provider
Search URL Search Domain Scan URL
Title: $1800 worth Clickjacking
Search URL Search Domain Scan URL
Title: About a Sucuri RCE…and How Not to Handle Bug Bounty Reports
Search URL Search Domain Scan URL
Title: IDOR: Payment Fraud
Search URL Search Domain Scan URL
Title: Vibhurushi Chotaliya (@Vibhurushi)
Search URL Search Domain Scan URL
Title: Self XSS To Evil XSS
Search URL Search Domain Scan URL
Title: A Fight For Duplicate Marked Bug: Story of BBC Hall Of Fame
Search URL Search Domain Scan URL
Title: How a classical XSS can lead to persistent ATO Vulnerability?
Search URL Search Domain Scan URL
Title: Yash Sodha (@y_sodha)
Search URL Search Domain Scan URL
Title: Facebook Vulnerability: Unremovable Co-Host in facebook group events
Search URL Search Domain Scan URL
Title: Account Takeover with Clickjacking
Search URL Search Domain Scan URL
Title: XSS Filter Evasion
Search URL Search Domain Scan URL
Title: m0z (@LooseSecurity)
Search URL Search Domain Scan URL
Title: Business user Employees could have applied block list to all ad accounts listed in the business manager.
Search URL Search Domain Scan URL
Title: Reflected XSS in Tokopedia Train Ticket
Search URL Search Domain Scan URL
Title: Jon Bottarini (@jon_bottarini)
Search URL Search Domain Scan URL
Title: Using Burp Suite match and replace settings to escalate your user privileges and find hidden features
Search URL Search Domain Scan URL
Title: Parameter Pollution issue in API resulting $XXX
Search URL Search Domain Scan URL
Title: SQl Injection
Search URL Search Domain Scan URL
Title: Bypassing XSS filter and Stealing User Payment Data
Search URL Search Domain Scan URL
Title: Password Bypass and Something Else…
Search URL Search Domain Scan URL
Title: How I earned $1,500 in just 15 mins due to Amazon S3 bucket misconfiguration?
Search URL Search Domain Scan URL
Title: Account Takeover Worth $900
Search URL Search Domain Scan URL
Title: Stealing Cookies to Login in any Account
Search URL Search Domain Scan URL
Title: Bug Bounty - Information Disclosure through error message + WAF Bypass led to Local File Inclusion
Search URL Search Domain Scan URL
Title: Λявєη (@spenkkkkk)
Search URL Search Domain Scan URL
Title: Çlirim Emini (@0xcela)
Search URL Search Domain Scan URL
Title: Complete Web Server Access
Search URL Search Domain Scan URL
Title: Fullscreen API Attack’s Revisited and the FaceBook NA Story
Search URL Search Domain Scan URL
Title: XSSing Google Employees — Blind XSS on googleplex.com
Search URL Search Domain Scan URL
Title: Admin Account total Information Disclosure
Search URL Search Domain Scan URL
Title: Nishant Saurav (@inishantsinha)
Search URL Search Domain Scan URL
Title: IDOR — Account Takeover
Search URL Search Domain Scan URL
Title: How spending our Saturday hacking earned us 20k
Search URL Search Domain Scan URL
Title: Matti Bijnens (@MattiBijnens)
Search URL Search Domain Scan URL
Title: Chaining Improper Authorization To Race Condition To Harvest Credit Card Details : A Bug Bounty Story
Search URL Search Domain Scan URL
Title: Redstrom Denial Of Service — Write Up
Search URL Search Domain Scan URL
Title: Reflected XSS on Error Page
Search URL Search Domain Scan URL
Title: Facebook Vulnerability: Non-unfriendable user in /hacked workflow
Search URL Search Domain Scan URL
Title: Account takeover using IDOR and the misleading case of error 403.
Search URL Search Domain Scan URL
Title: IDOR Leads To Project Takeover
Search URL Search Domain Scan URL
Title: Don’t underestimates the Errors They can provide good $$$ Bounty!
Search URL Search Domain Scan URL
Title: How I was able to get private ticket response panel and FortiGate web panel via blind XSS
Search URL Search Domain Scan URL
Title: Microsoft Edge Extensions Host Permission Bypass (CVE-2019-0678)
Search URL Search Domain Scan URL
Title: Unicode vs WAF — XSS WAF Bypass
Search URL Search Domain Scan URL
Title: Bypassing CSP with policy injection
Search URL Search Domain Scan URL
Title: Gareth Heyes (@garethheyes)
Search URL Search Domain Scan URL
Title: REMOTE CODE EXECUTION ! 😜 Recon Wins
Search URL Search Domain Scan URL
Title: Chaining multiple low-impact bugs to arbitrary file read in GitLab
Search URL Search Domain Scan URL
Title: Li Rongxi (@nyan_gawa)
Search URL Search Domain Scan URL
Title: Simple PathTraversal bypass
Search URL Search Domain Scan URL
Title: Missing access control at play store
Search URL Search Domain Scan URL
Title: The Unusual Case of Status code- 301 Redirection to AWS Security Credentials Compromise
Search URL Search Domain Scan URL
Title: Story of a uri based xss with some simple google dorking
Search URL Search Domain Scan URL
Title: Edmodo Account Deactivation Vulnerability
Search URL Search Domain Scan URL
Title: My First CSRF to Account Takeover worth $750
Search URL Search Domain Scan URL
Title: Exploiting File Uploads Pt. 1 – MIME Sniffing to Stored XSS #bugbounty
Search URL Search Domain Scan URL
Title: Stored XSS on Edmodo
Search URL Search Domain Scan URL
Title: Rohit Verma (@rv0x00)
Search URL Search Domain Scan URL
Title: Source Code disclose Vulnerability
Search URL Search Domain Scan URL
Title: Mohamed R. Serwah (@mohamedrserwah)
Search URL Search Domain Scan URL
Title: An unexploited CORS misconfiguration reflecting further issues.
Search URL Search Domain Scan URL
Title: How did I bypass a Custom Brute Force protection and why that solution is not a good idea?
Search URL Search Domain Scan URL
Title: Disclose files content from Facebook internal CDNs
Search URL Search Domain Scan URL
Title: Google bug bounty: LFI on production servers in “springboard.google.Com” — $13,337 USD
Search URL Search Domain Scan URL
Title: Multiple API issues due to Fixed Authorization token.
Search URL Search Domain Scan URL
Title: Mustafa Khan (@by6153)
Search URL Search Domain Scan URL
Title: From file upload to email:pass
Search URL Search Domain Scan URL
Title: Security assessment on the staging domains
Search URL Search Domain Scan URL
Title: Instagram GitHub Token with public_scope found In Travis CI Build Logs
Search URL Search Domain Scan URL
Title: How I acquired $XXX bounty by investing 99 cents
Search URL Search Domain Scan URL
Title: Escalating subdomain takeovers to steal cookies by abusing document.domain
Search URL Search Domain Scan URL
Title: Ameya (@iamTakeMyHand)
Search URL Search Domain Scan URL
Title: Determine a Facebook user from an email address
Search URL Search Domain Scan URL
Title: Google Adwords(Privilege Escalation): Read-only user able to add YouTube channels via Linked accounts
Search URL Search Domain Scan URL
Title: Local File Inclusion in peering.google.com
Search URL Search Domain Scan URL
Title: $3,133.7
Search URL Search Domain Scan URL
Title: Leaking OpenID tokens with “ — the bug right infront of you
Search URL Search Domain Scan URL
Title: WRITE UP – GOOGLE BUG BOUNTY: LFI ON PRODUCTION SERVERS in “springboard.google.com” – $13,337 USD
Search URL Search Domain Scan URL
Title: Open-redirect to Account Takeover.
Search URL Search Domain Scan URL
Title: Rishabh (@__cypher__)
Search URL Search Domain Scan URL
Title: A base64 encoded parameter.
Search URL Search Domain Scan URL
Title: XSSed my way to 1000$
Search URL Search Domain Scan URL
Title: Stealing Downloads from Slack Users
Search URL Search Domain Scan URL
Title: Bypassing Instagram’s stories restriction
Search URL Search Domain Scan URL
Title: Baibhav Anand (@iBaibhavJha)
Search URL Search Domain Scan URL
Title: ‘Try-Harder’ for XSS
Search URL Search Domain Scan URL
Title: Frans Hendrik Botes (@initroott)
Search URL Search Domain Scan URL
Title: From parameter pollution to XSS
Search URL Search Domain Scan URL
Title: You do not need to run 80 reconnaissance tools to get access to user accounts
Search URL Search Domain Scan URL
Title: Stefano Vettorazzi (@stefanohablando)
Search URL Search Domain Scan URL
Title: Is MIME Sniffing XSS a real thing? [The story of weird Google bug bounties]
Search URL Search Domain Scan URL
Title: Think Outside the Scope: Advanced CORS Exploitation Techniques
Search URL Search Domain Scan URL
Title: Ayoub (@sandh0t)
Search URL Search Domain Scan URL
Title: Stored XSS on Techprofile Microsoft
Search URL Search Domain Scan URL
Title: BLIND SSRF in *.stripe.com due to Sentry Misconfiguration
Search URL Search Domain Scan URL
Title: 4x CSRFs Chained For Company Account Takeover
Search URL Search Domain Scan URL
Title: pcextreme.nl fake bug bounty
Search URL Search Domain Scan URL
Title: Daniel Maksimovic
Search URL Search Domain Scan URL
Title: SQL injection through User-Agent
Search URL Search Domain Scan URL
Title: Subdomain takeover [Awarded $200]
Search URL Search Domain Scan URL
Title: Friendly (@SkeletorKeys)
Search URL Search Domain Scan URL
Title: Server Side Request Forgery(SSRF){port issue hidden approch }
Search URL Search Domain Scan URL
Title: Deepak Holani (@w_hat_boy)
Search URL Search Domain Scan URL
Title: Tale of a Wormable Twitter XSS
Search URL Search Domain Scan URL
Title: @0xSobky
Search URL Search Domain Scan URL
Title: Why You Shouldn’t Use a Password Manager For Your Linode Account
Search URL Search Domain Scan URL
Title: XSS attacks on Googlebot allow search index manipulation
Search URL Search Domain Scan URL
Title: Remote code execution On Microsoft edge using URL Protocol
Search URL Search Domain Scan URL
Title: Matt harr0ey (@harr0ey)
Search URL Search Domain Scan URL
Title: From NA to $3000 : Facebook’s URL spoofing vulnerability
Search URL Search Domain Scan URL
Title: Reply To Instagram Stories where privacy of who can reply is set to ‘Nobody’.
Search URL Search Domain Scan URL
Title: From Reflected XSS to Account Takeover — Showing XSS Impact
Search URL Search Domain Scan URL
Title: Don’t Follow The Masses: Bug Hunting in JavaScript Engines
Search URL Search Domain Scan URL
Title: Dimitri Fourny (@dimitrifourny)
Search URL Search Domain Scan URL
Title: Two-Factor Authentication Bypass
Search URL Search Domain Scan URL
Title: Broken Access: Posting to Google private groups through any user in the group
Search URL Search Domain Scan URL
Title: Elber Andre (@Elber333)
Search URL Search Domain Scan URL
Title: Denial of Service using Cookie Bombing
Search URL Search Domain Scan URL
Title: How to bypass a 2FA with a HTTP header
Search URL Search Domain Scan URL
Title: for PayPal security team,“get user balances and transaction details” is not a vulnerability!
Search URL Search Domain Scan URL
Title: Todaro (@tod4ro)
Search URL Search Domain Scan URL
Title: Missing Authorization check while deleting App Review for Marketing API
Search URL Search Domain Scan URL
Title: Stealing local storage data through XSS
Search URL Search Domain Scan URL
Title: Harshad Gaikwad (@h4rsh4d)
Search URL Search Domain Scan URL
Title: The journey of Web Cache + Firewall Bypass to SSRF to AWS credentials compromise!
Search URL Search Domain Scan URL
Title: CSRF Attack can lead to Stored XSS
Search URL Search Domain Scan URL
Title: Mohamed Sayed (@FlEx0Geek)
Search URL Search Domain Scan URL
Title: A picture that steals data
Search URL Search Domain Scan URL
Title: Getting access to Zendesk’s Google Cloud and Artifactory from GitHub dotfile repos
Search URL Search Domain Scan URL
Title: Ruby Nealon (@_ruby)
Search URL Search Domain Scan URL
Title: Facebook’s Burglary Shopping List
Search URL Search Domain Scan URL
Title: John Moss (@x41x41x41)
Search URL Search Domain Scan URL
Title: The neglected bug that can infect All Facebook users who pay for leads ads.
Search URL Search Domain Scan URL
Title: Yet Other Examples of Abusing CSRF in Logout
Search URL Search Domain Scan URL
Title: Soroush Dalili (@irsdl)
Search URL Search Domain Scan URL
Title: [XSS] Reflected XSS Bypass Filter
Search URL Search Domain Scan URL
Title: Disclose the content of internal Facebook Javascript modules.
Search URL Search Domain Scan URL
Title: Ssrf to Read Local Files and Abusing the AWS metadata
Search URL Search Domain Scan URL
Title: [CONFIRMATION BYPASS ]
Search URL Search Domain Scan URL
Title: Twitter - protected tweets exposure
Search URL Search Domain Scan URL
Title: Responsible disclosure: improper access control in Gitlab private project.
Search URL Search Domain Scan URL
Title: Riccardo Padovani (@rpadovani93)
Search URL Search Domain Scan URL
Title: Scary Tickets😨
Search URL Search Domain Scan URL
Title: Uranium238 (@uraniumhacker)
Search URL Search Domain Scan URL
Title: PDFReacter SSRF to ROOT Level Local File Read which led to RCE
Search URL Search Domain Scan URL
Title: Armaan Pathan (@armaancrockroax)
Search URL Search Domain Scan URL
Title: Code execution - Evernote
Search URL Search Domain Scan URL
Title: Dhiraj (@mishradhiraj_)
Search URL Search Domain Scan URL
Title: How I was able to Bypass XSS Protection on HackerOne’s Private Program
Search URL Search Domain Scan URL
Title: Banner Grabbing to DoS and Memory Corruption
Search URL Search Domain Scan URL
Title: A $5000 IDOR…
Search URL Search Domain Scan URL
Title: Mr.Hacker (@mr_hacker0007)
Search URL Search Domain Scan URL
Title: How i found credential enriched redis dump
Search URL Search Domain Scan URL
Title: Just 5 minute to get my 2nd stored XSS on Edmodo.com
Search URL Search Domain Scan URL
Title: ZishanAdThandar (@ZishanAdThandar)
Search URL Search Domain Scan URL
Title: How I hacked Vending Machine
Search URL Search Domain Scan URL
Title: Google Groups Authorization Bypass
Search URL Search Domain Scan URL
Title: The Outlook Winner is Dash
Search URL Search Domain Scan URL
Title: marcan2020 (@marcan2020)
Search URL Search Domain Scan URL
Title: How I gained access to revenue and traffic data of thousands of Shopify stores
Search URL Search Domain Scan URL
Title: Ayoub Fathi (@ayoubfathi)
Search URL Search Domain Scan URL
Title: Web Cache Deception to API endpoint attack using cached token header
Search URL Search Domain Scan URL
Title: [RCE] Remote code execution at api.PrivateProgram.com (CVE-2017-5638)
Search URL Search Domain Scan URL
Title: Unauthenticated Account Takeover Through HTTP Leak
Search URL Search Domain Scan URL
Title: Account Takeover by chaining two vulnerabilities.
Search URL Search Domain Scan URL
Title: Multiple xss in *.skype.com
Search URL Search Domain Scan URL
Title: Multiple xss in *.skype.com (2)
Search URL Search Domain Scan URL
Title: Spokeo Bug bounty Experience
Search URL Search Domain Scan URL
Title: Nur A Alam Dipu
Search URL Search Domain Scan URL
Title: Dell KACE K1000 Remote Code Execution — the Story of Bug K1–18652
Search URL Search Domain Scan URL
Title: SSRF Tips: SSRF/XSPA in Microsoft’s Bing Webmaster Central
Search URL Search Domain Scan URL
Title: Obtaining XSS Using Moodle Features and Minor Bugs
Search URL Search Domain Scan URL
Title: Obtaining XSS Using Moodle Features and Minor Bugs
Search URL Search Domain Scan URL
Title: XSS “403 forbidden” bypass (Akamai Security )write up
Search URL Search Domain Scan URL
Title: How I got a trip to amsterdam through bug bounty
Search URL Search Domain Scan URL
Title: Old but GOLD Dot Dot Slash to Get the Flag — Uber Microservice
Search URL Search Domain Scan URL
Title: Email content spoofing at IKEA.com
Search URL Search Domain Scan URL
Title: Edmodo — IDOR to view private files of any class
Search URL Search Domain Scan URL
Title: Rohan Pagey (@rohan_x3)
Search URL Search Domain Scan URL
Title: Scary Bug in Burp Suite Upstream Proxy Allows Hackers to Hack Hackers
Search URL Search Domain Scan URL
Title: Google Ads — Information Disclosure via null pointer exception
Search URL Search Domain Scan URL
Title: Handlebars template injection and RCE in a Shopify app
Search URL Search Domain Scan URL
Title: Leaked Salesforce API access token at IKEA.com
Search URL Search Domain Scan URL
Title: DownNotifier SSRF
Search URL Search Domain Scan URL
Title: _m_q_t (@_m_q_t)
Search URL Search Domain Scan URL
Title: How I am able to hijack you.
Search URL Search Domain Scan URL
Title: terjanq (@terjanq)
Search URL Search Domain Scan URL
Title: Facebook Vulnerability: Hiding from Facebook Page Admin(s) in /hacked workflow
Search URL Search Domain Scan URL
Title: FileZilla Untrusted Search Path
Search URL Search Domain Scan URL
Title: FileZilla ‘fzsftp’ Untrusted Search Path
Search URL Search Domain Scan URL
Title: Chris Lyne (@lynerc)
Search URL Search Domain Scan URL
Title: How I was able to get your facebook private friend list [Responsible Disclosure]
Search URL Search Domain Scan URL
Title: EdM0d0 IDOR Vulnerabilities
Search URL Search Domain Scan URL
Title: Comma is forbidden! No worries!! Inject in insert/update queries without it
Search URL Search Domain Scan URL
Title: Ahmed Sultan (@0x4148)
Search URL Search Domain Scan URL
Title: Recon in 2 minutes and got $250 easy
Search URL Search Domain Scan URL
Title: How I was able to turn self xss into reflected xss
Search URL Search Domain Scan URL
Title: alert(“A tale of 3 XSS!”)
Search URL Search Domain Scan URL
Title: My very first bug: a dreaded dupe and then an IDOR jackpot!
Search URL Search Domain Scan URL
Title: John H4X00R (@JohnH4X00R)
Search URL Search Domain Scan URL
Title: How I could have hijacked a victim’s YouTube notifications! (Google VRP Writeup)
Search URL Search Domain Scan URL
Title: An Unusual Bug 🐛 on Braintree [PayPal]
Search URL Search Domain Scan URL
Title: Twitter Denial of Service bug or How i could prevent all followers from reading or accessing literally ANY tweets!
Search URL Search Domain Scan URL
Title: Seif Elsallamy
Search URL Search Domain Scan URL
Title: Stored (XSS) on [google.com]
Search URL Search Domain Scan URL
Title: Stored XSS in the guide’s GameplayVersion (www.dota2.com)
Search URL Search Domain Scan URL
Title: Self (XSS) on [komunitas.bukalapak.com]
Search URL Search Domain Scan URL
Title: Reflected (XSS)on [alibabacloud.com]
Search URL Search Domain Scan URL
Title: Facebook Marketing Confidential Call Transcript
Search URL Search Domain Scan URL
Title: Google Books X-Hacking
Search URL Search Domain Scan URL
Title: How to hunt for Malvertising ads on Android
Search URL Search Domain Scan URL
Title: A real XSS in OLX Bug Bounty
Search URL Search Domain Scan URL
Title: Paulo Choupina (@PauloChoupina)
Search URL Search Domain Scan URL
Title: Slack announcement-only channel post restriction bypass
Search URL Search Domain Scan URL
Title: Disclose private/scheduled streams of any Livestream user due to open .m3u8 endpoint
Search URL Search Domain Scan URL
Title: Abss TBH @abss_tbh
Search URL Search Domain Scan URL
Title: Denial of service in Facebook Fizz due to integer overflow (CVE-2019-3560)
Search URL Search Domain Scan URL
Title: Kevin Backhouse (@kevin_backhouse)
Search URL Search Domain Scan URL
Title: Discovering a zero day and getting code execution on Mozilla’s AWS Network
Search URL Search Domain Scan URL
Title: Shubham Shah (@infosec_au)
Search URL Search Domain Scan URL
Title: Mathias Karlsson (@avlidienbrunn)
Search URL Search Domain Scan URL
Title: DoS Across Facebook Endpoints
Search URL Search Domain Scan URL
Title: From http:// domain to res:// domain xss by using IE Adobe’s PDF ActiveX plugin
Search URL Search Domain Scan URL
Title: Heige (@80vul)
Search URL Search Domain Scan URL
Title: Should you be concerned about LastPass uploading your passwords to its server?
Search URL Search Domain Scan URL
Title: Disclosure of Pending Roles for any Facebook Page
Search URL Search Domain Scan URL
Title: Avinash Kumar (@itsavinash_)
Search URL Search Domain Scan URL
Title: Target Finds Cross-Site Scripting in Microsoft SharePoint
Search URL Search Domain Scan URL
Title: How I was able to pwned 30000+ user’s webhook
Search URL Search Domain Scan URL
Title: gujjuboy10x00 (@vis_hacker)
Search URL Search Domain Scan URL
Title: Privilege escalation on private program.
Search URL Search Domain Scan URL
Title: Imran Parray (@CreedHackers)
Search URL Search Domain Scan URL
Title: User Account Takeover [Password Change]— Nice Catch!
Search URL Search Domain Scan URL
Title: Write up – $1,000 usd in 5 minutes, xss stored in outlook.com (ios browsers)
Search URL Search Domain Scan URL
Title: WordPress 5.1 CSRF to Remote Code Execution
Search URL Search Domain Scan URL
Title: OLX Bug Bounty: Reflected XSS
Search URL Search Domain Scan URL
Title: Mukhammad Akbar (@abaykandotcom)
Search URL Search Domain Scan URL
Title: My First Stored XSS on Edmodo.com
Search URL Search Domain Scan URL
Title: Hack Your Form-New vector for Blind XSS
Search URL Search Domain Scan URL
Title: Youssef A. Mohamed (@GeneralEG64)
Search URL Search Domain Scan URL
Title: How I found Blind XSS Vulnerability in redacted.com
Search URL Search Domain Scan URL
Title: ssid (@newp_th)
Search URL Search Domain Scan URL
Title: Inserting malware into anyone’s Google Earth Projects Archive
Search URL Search Domain Scan URL
Title: Brute Forcing User IDS via CSRF To Delete all Users with CSRF attack.
Search URL Search Domain Scan URL
Title: Escalating SSRF to RCE
Search URL Search Domain Scan URL
Title: CVE-2018-16794 on fs.thefacebook.com
Search URL Search Domain Scan URL
Title: SQL injection for $50 bounty, but still worth reading!!
Search URL Search Domain Scan URL
Title: Account Takeover Using Cross-Site WebSocket Hijacking (CSWH)
Search URL Search Domain Scan URL
Title: Sharan Panegav (@PanegavSharan)
Search URL Search Domain Scan URL
Title: Vimeo SSRF with code execution potential.
Search URL Search Domain Scan URL
Title: Mapping Communication Between Facebook Accounts Using a Browser-Based Side Channel Attack
Search URL Search Domain Scan URL
Title: Facebook Messenger server random memory exposure through corrupted GIF image
Search URL Search Domain Scan URL
Title: 3 XSS in ProtonMail for iOS
Search URL Search Domain Scan URL
Title: $1,000
Search URL Search Domain Scan URL
Title: Fixed : Register any email address on Facebook Account
Search URL Search Domain Scan URL
Title: Fixed : Brute-force Instagram account’s passwords
Search URL Search Domain Scan URL
Title: Facebook exploit – Confirm website visitor identities
Search URL Search Domain Scan URL
Title: Auditing GitHub Repo Wikis for Fun and Profit
Search URL Search Domain Scan URL
Title: Smeege (@SmeegeSec)
Search URL Search Domain Scan URL
Title: XSS in Edmodo within 5 Minute (My First Bug Bounty)
Search URL Search Domain Scan URL
Title: Vala Keyur (@valakeyur)
Search URL Search Domain Scan URL
Title: A simple Account takeover misusing JWT late expiration
Search URL Search Domain Scan URL
Title: Scalar (@mrprajapati_360)
Search URL Search Domain Scan URL
Title: Bypassing a restrictive JS sandbox
Search URL Search Domain Scan URL
Title: Yet Another (unexpected) Hack for Bounty
Search URL Search Domain Scan URL
Title: Horizontal Privilege Escalation on Quora which can compromise all users on Quora
Search URL Search Domain Scan URL
Title: SpyD3r (@TarunkantG)
Search URL Search Domain Scan URL
Title: [Still work] Redirect Yahoo Subdomain XSS Reflected from americangreetings.com
Search URL Search Domain Scan URL
Title: How I alert(1) in Azure DevOps
Search URL Search Domain Scan URL
Title: Web Cache Deception Attack leads to user info disclosure
Search URL Search Domain Scan URL
Title: Chain of hacks leading to Database Compromise!
Search URL Search Domain Scan URL
Title: Bug Bounty 101 — Always Check The Source Code
Search URL Search Domain Scan URL
Title: Download any organisation Data — S3 amazonaws Misconfiguration
Search URL Search Domain Scan URL
Title: Chand Singh (@Chand_42)
Search URL Search Domain Scan URL
Title: Subdomain Misconfiguration lead to AWS S3 Buckets Reader
Search URL Search Domain Scan URL
Title: Exploiting Google Calendars
Search URL Search Domain Scan URL
Title: Brandon Nguyen (@cmdrsnuggle)
Search URL Search Domain Scan URL
Title: Swiss_E-Voting_Publications
Search URL Search Domain Scan URL
Title: setuid0 (@setuid0)
Search URL Search Domain Scan URL
Title: Abusing autoresponders and email bounces
Search URL Search Domain Scan URL
Title: Reflected XSS at https://photos.shopify.com/
Search URL Search Domain Scan URL
Title: Ahamed Morad (@Modam3r5
Search URL Search Domain Scan URL
Title: How I Registered Multiple Accounts in PrivateInternetAccess VPN Service for FREE
Search URL Search Domain Scan URL
Title: Bug Writeup: FBCTF IDOR
Search URL Search Domain Scan URL
Title: Leakage of Client Secret, Server tokens of all Uber developer applications
Search URL Search Domain Scan URL
Title: Multiple Stored XSS On Tokopedia
Search URL Search Domain Scan URL
Title: Apapedulimu (@Apapedulimu)
Search URL Search Domain Scan URL
Title: Using URI to pop shells via the Discord Client
Search URL Search Domain Scan URL
Title: RagSec (@rag_sec)
Search URL Search Domain Scan URL
Title: DoS on WAF Protected Sites by Abusing Cookie
Search URL Search Domain Scan URL
Title: 2 Subdomains Takeover via Unbounce in a Private Program
Search URL Search Domain Scan URL
Title: Stored XSS on Edmodo
Search URL Search Domain Scan URL
Title: $1.000 SSRF in Slack
Search URL Search Domain Scan URL
Title: Bypass password confirmation in Facebook “DYI” feature
Search URL Search Domain Scan URL
Title: Facebook/Workplace Bug Exposed Offsite Employee Events, Sensitive emails Putting Employees at Risk
Search URL Search Domain Scan URL
Title: Subdomain Takeover via Wufoo Service in a Private Program
Search URL Search Domain Scan URL
Title: Open Redirect in SLACK
Search URL Search Domain Scan URL
Title: Bypassing rate limit abusing misconfiguration rules
Search URL Search Domain Scan URL
Title: Subdomain Takeover via HubSpot
Search URL Search Domain Scan URL
Title: Souq.com Subdomain Takeover via jazzhr.com service
Search URL Search Domain Scan URL
Title: Informative
Search URL Search Domain Scan URL
Title: Never Stop at Banner Grabbing
Search URL Search Domain Scan URL
Title: Third Party Android App Storing Facebook Data Insecurely (Facebook Data Abuse Program)
Search URL Search Domain Scan URL
Title: [SSRF] Server Side Request Forgery in a private Program developers.example.com
Search URL Search Domain Scan URL
Title: Disclose private attachments in Facebook Messenger Infrastructure - 15,000$
Search URL Search Domain Scan URL
Title: Sarmad Hassan (@JubaBaghdad)
Search URL Search Domain Scan URL
Title: Facebook CSRF protection bypass which leads to Account Takeover
Search URL Search Domain Scan URL
Title: Hacking YouTube for #fun and #profit
Search URL Search Domain Scan URL
Title: Export Facebook audience network reports of any business
Search URL Search Domain Scan URL
Title: I Found Clickjacking on Google CSE. Is This Important?
Search URL Search Domain Scan URL
Title: Csrf Bypass Using Cross Frame Scripting
Search URL Search Domain Scan URL
Title: How I hacked ASUS?
Search URL Search Domain Scan URL
Title: Mustafa Kemal Can (@muskecan)
Search URL Search Domain Scan URL
Title: Setting Up Gitrob and using it to find Leaking Repository of an Employee in a hackerone private program.
Search URL Search Domain Scan URL
Title: Design Flaws - Scenario One and Fix
Search URL Search Domain Scan URL
Title: Alli-Balogun Faruq (@node_shack)
Search URL Search Domain Scan URL
Title: Paypal’s Security Check Bypassed
Search URL Search Domain Scan URL
Title: Anees Khan (@AneesEthical)
Search URL Search Domain Scan URL
Title: Internal paths disclosure due to improper exception handling
Search URL Search Domain Scan URL
Title: Leak of private/in-development app ids, names and translation requests
Search URL Search Domain Scan URL
Title: LFI To 10 Servers Pwn
Search URL Search Domain Scan URL
Title: How i was able to dump SqlDB | Simple bug
Search URL Search Domain Scan URL
Title: Cache Deception: How I discovered a vulnerability in Medium and helped them fix it
Search URL Search Domain Scan URL
Title: Remote Code Execution via Path Traversal in the Device Metadata Authoring Wizard
Search URL Search Domain Scan URL
Title: Lee Christensen (@tifkin_)
Search URL Search Domain Scan URL
Title: Jumping Over The Fence
Search URL Search Domain Scan URL
Title: How I hacked 40,000 user accounts of Microsoft using 2FA bypass(outlook.live.com)
Search URL Search Domain Scan URL
Title: Vartul Goyal (@hackvartul)
Search URL Search Domain Scan URL
Title: Detecting and exploiting mass-assignments in order to manipulate user columns and read private messages
Search URL Search Domain Scan URL
Title: Paul (@padannewitz)
Search URL Search Domain Scan URL
Title: Reverse RDP Attack: Code Execution on RDP Clients
Search URL Search Domain Scan URL
Title: A Unique XSS Scenario in SmartSheet || $1000 bounty
Search URL Search Domain Scan URL
Title: Rohan Chavan (@rohanchavan1918)
Search URL Search Domain Scan URL
Title: How I was able to Extract Information of Other Users- Exploiting IDOR
Search URL Search Domain Scan URL
Title: Rupika Luhach (@Rup_Ki_Rani)
Search URL Search Domain Scan URL
Title: LFI in Apigee portals
Search URL Search Domain Scan URL
Title: How I found a simple bug in Facebook without any Test
Search URL Search Domain Scan URL
Title: $7.5k Google Cloud Platform organization issue
Search URL Search Domain Scan URL
Title: How I hacked a website integrated w/ Facebook having 1.1 mil. users under 45 seconds.
Search URL Search Domain Scan URL
Title: Publish tweets by any other user
Search URL Search Domain Scan URL
Title: Kedrisec (@kedrisec)
Search URL Search Domain Scan URL
Title: Guest blog: Eray Mitrani - Hacking isn’t an exact science
Search URL Search Domain Scan URL
Title: Eray Mitrani (@ErayMitrani)
Search URL Search Domain Scan URL
Title: Protonmail XSS — Stored
Search URL Search Domain Scan URL
Title: Unsecured access to personal data of a million Leo Express users
Search URL Search Domain Scan URL
Title: Hijacking accounts by retrieving JWT tokens via unvalidated redirects
Search URL Search Domain Scan URL
Title: A short tale of Account verification bypass
Search URL Search Domain Scan URL
Title: Chaining Tricky OAuth Exploitation To Stored XSS
Search URL Search Domain Scan URL
Title: Misconfiguration-Whatsapp Messenger
Search URL Search Domain Scan URL
Title: Pratheesh P Narayanan
Search URL Search Domain Scan URL
Title: AntiHack IDOR on Create Submission
Search URL Search Domain Scan URL
Title: Syahrul Akbar Rohmani (@sahruldotid)
Search URL Search Domain Scan URL
Title: Facebook Change Product Availability as a PageAnalyst
Search URL Search Domain Scan URL
Title: How I abused 2FA to maintain persistence after a password change (Google, Microsoft, Instagram, Cloudflare, etc)
Search URL Search Domain Scan URL
Title: Magento – RCE & Local File Read with low privilege admin rights
Search URL Search Domain Scan URL
Title: Daniel Le Gall (@Blaklis_)
Search URL Search Domain Scan URL
Title: Antihack.me Blind XSS To PHP File Upload Vulnerability
Search URL Search Domain Scan URL
Title: SayCure (@SaycureIO)
Search URL Search Domain Scan URL
Title: Privilege Escalation to Highest Admin Privileges
Search URL Search Domain Scan URL
Title: Frappé Technologies ERPNext Server Side Template Injection
Search URL Search Domain Scan URL
Title: Brian Hyde
Search URL Search Domain Scan URL
Title: Enroll in Facebook Ad-break program without Facebook approval
Search URL Search Domain Scan URL
Title: Disclose page’s admins and its Monetization payout details
Search URL Search Domain Scan URL
Title: Disclose page violations and its eligibility to use Ad-breaks
Search URL Search Domain Scan URL
Title: Disclose Instagram business account linked to a Facebook page
Search URL Search Domain Scan URL
Title: Change payment account of any Facebook commerce page
Search URL Search Domain Scan URL
Title: Expose business email and payment account balance of any Facebook commerce page.
Search URL Search Domain Scan URL
Title: Samm0uda (@Samm0uda)
Search URL Search Domain Scan URL
Title: Reveal if a Facebook merchant page has pending or completed orders.
Search URL Search Domain Scan URL
Title: Bruteforce Instagram account’s passwords (lack of rate limiting protection).
Search URL Search Domain Scan URL
Title: Generate Access Tokens for any Facebook user
Search URL Search Domain Scan URL
Title: Modify users profiles of techprep.fb.com
Search URL Search Domain Scan URL
Title: Uploading files to api.techprep.fb.com
Search URL Search Domain Scan URL
Title: Reflected XSS in Zomato
Search URL Search Domain Scan URL
Title: How I Found and Reporting Vulnerabilities to AntiHack.me by Tomi
Search URL Search Domain Scan URL
Title: A Simple CORS Misconfig Leaked Private Post Of Twitter, Facebook & Instagram
Search URL Search Domain Scan URL
Title: Oauth Misconfiguration lead to complete account takeover
Search URL Search Domain Scan URL
Title: Jackson kv (@Jacksonkv22)
Search URL Search Domain Scan URL
Title: XSS Through SWF file!
Search URL Search Domain Scan URL
Title: Bypass Content Security Policy framing restriction rule - OLX
Search URL Search Domain Scan URL
Title: Taha Ibrahim Draidia
Search URL Search Domain Scan URL
Title: Command Injection PoC
Search URL Search Domain Scan URL
Title: NoGe
Search URL Search Domain Scan URL
Title: Facebook Vulnerability: Unremovable facebook group admin
Search URL Search Domain Scan URL
Title: #BugBounty How I Hack Billion $ Company
Search URL Search Domain Scan URL
Title: Abusing MySQL clients to get LFI from the server/client
Search URL Search Domain Scan URL
Title: Jarkko Vesiluoma (@jvesiluoma)
Search URL Search Domain Scan URL
Title: Gaining access to Uber’s user data through AMPScript evaluation
Search URL Search Domain Scan URL
Title: Turning Self XSS to good XSS via access control
Search URL Search Domain Scan URL
Title: Yusuf Yazir (@Hacklad)
Search URL Search Domain Scan URL
Title: Hack Your Form – New vector for Blind XSS
Search URL Search Domain Scan URL
Title: Workplace Logo ID to workplace owner name Disclosure Facebook Bug Bounty
Search URL Search Domain Scan URL
Title: Facebook PageAnalyst Could Add oneself as Moderator on Group
Search URL Search Domain Scan URL
Title: AntiHack.me Multiple Vulnerabilities
Search URL Search Domain Scan URL
Title: View the contact list for a Messenger Kid as a parent-approved contact
Search URL Search Domain Scan URL
Title: Tips for bug bounty beginners from a real life experience
Search URL Search Domain Scan URL
Title: Renaud Martinet (@karouf)
Search URL Search Domain Scan URL
Title: When Cookie Hijacking + HTML Injection become dangerous
Search URL Search Domain Scan URL
Title: Reflected XSS ON ASUS.
Search URL Search Domain Scan URL
Title: Stored XSS Via Alternate Text At Zendesk Support
Search URL Search Domain Scan URL
Title: How I hacked Altervista.org
Search URL Search Domain Scan URL
Title: Jacopo Tediosi (@jacopotediosi)
Search URL Search Domain Scan URL
Title: Facebook Android Application
Search URL Search Domain Scan URL
Title: How I could have taken over any Pinterest account
Search URL Search Domain Scan URL
Title: Arnold Anthony (@armold9anthony)
Search URL Search Domain Scan URL
Title: How I stumbled upon a Stored XSS(My first bug bounty story).
Search URL Search Domain Scan URL
Title: Cookie Based Self-XSS to Good XSS
Search URL Search Domain Scan URL
Title: Stealing Side-Channel Attack Tokens in Facebook Account Switcher
Search URL Search Domain Scan URL
Title: Yes I can see your OTP
Search URL Search Domain Scan URL
Title: Vulnerables
Search URL Search Domain Scan URL
Title: A Tricky Open Redirect
Search URL Search Domain Scan URL
Title: How I was able to Harvest other Vine users IP address
Search URL Search Domain Scan URL
Title: How i found web shell on AntiHack.me and Awarded Gold Coin And SWAG
Search URL Search Domain Scan URL
Title: Rudra Sarkar (@rudr4_sarkar)
Search URL Search Domain Scan URL
Title: A Curious Case From Little To Complete Email Verification Bypass
Search URL Search Domain Scan URL
Title: Megaman (@N0_M3ga_Hacks)
Search URL Search Domain Scan URL
Title: Tale of a Misconfiguration in Password Reset
Search URL Search Domain Scan URL
Title: Bypassing Access Control in a Program on Hackerone !!
Search URL Search Domain Scan URL
Title: How I was able to delete Google Gallery Data [IDOR]
Search URL Search Domain Scan URL
Title: Abusing ACL Permissions to Overwrite other User’s Uploaded Files/Videos on s3 Bucket
Search URL Search Domain Scan URL
Title: How I Takeover Wordpress Admin fiiipay.my
Search URL Search Domain Scan URL
Title: How I Was Able To Takeover All User Account And Admin Panel
Search URL Search Domain Scan URL
Title: Reflected XSS on ws-na.amazon-adsystem.com(Amazon)
Search URL Search Domain Scan URL
Title: From Hunting for a Laptop to Hunting down Remote Code Execution
Search URL Search Domain Scan URL
Title: RCE in nokia.com
Search URL Search Domain Scan URL
Title: Unauthenticated user can upload an attachment at HackerOne
Search URL Search Domain Scan URL
Title: Tokopedia Account Takeover Bug Worth 8 Million IDR
Search URL Search Domain Scan URL
Title: Server-side Request Forgery in OpenID support
Search URL Search Domain Scan URL
Title: Client side validation strikes again: PIN code bypass !
Search URL Search Domain Scan URL
Title: Davy (@RandoriSec)
Search URL Search Domain Scan URL
Title: How I accidentally found a clickjacking “feature” in Facebook
Search URL Search Domain Scan URL
Title: Lasq (@lasq88)
Search URL Search Domain Scan URL
Title: XSS worm – A creative use of web application vulnerability
Search URL Search Domain Scan URL
Title: Nicolas Heiniger (@NicolasHeiniger)
Search URL Search Domain Scan URL
Title: Facebook BugBounty — Disclosing page members
Search URL Search Domain Scan URL
Title: Nirmal Thapa (@tnirmalz)
Search URL Search Domain Scan URL
Title: Story of my two (but actually three) RCEs in SharePoint in 2018
Search URL Search Domain Scan URL
Title: Exploiting Two Endpoints to get Account Takeover
Search URL Search Domain Scan URL
Title: Asus’S Admin Panel Auth Bypass
Search URL Search Domain Scan URL
Title: WordPress Privilege Escalation through Post Types
Search URL Search Domain Scan URL
Title: Subdomain Takeover — New Level
Search URL Search Domain Scan URL
Title: Reading ASP secrets for $17,000
Search URL Search Domain Scan URL
Title: Accessing VoIP Internal service via Port 8009: Routing traffic through local Apache proxy
Search URL Search Domain Scan URL
Title: Self XSS to Interesting Stored XSS
Search URL Search Domain Scan URL
Title: How i hacked help desk of a Company
Search URL Search Domain Scan URL
Title: Ali Razzaq (@AliRazzaq_)
Search URL Search Domain Scan URL
Title: Remote Code Execution on a Facebook server
Search URL Search Domain Scan URL
Title: XSSing Google Code-in thanks to improperly escaped JSON data
Search URL Search Domain Scan URL
Title: $3k Bug Bounty - Twitter’s OAuth Mistakes
Search URL Search Domain Scan URL
Title: Terence Eden (@edent)
Search URL Search Domain Scan URL
Title: Unremovable Tags In Facebook Page Reviews
Search URL Search Domain Scan URL
Title: Chaining Two Vulnerabilities to Break Facebook Appointment Times For the Second Time
Search URL Search Domain Scan URL
Title: #BugBounty — “User Account Takeover-I just need your email id to login into your shopping portal account”
Search URL Search Domain Scan URL
Title: Exploiting XXE with local DTD files
Search URL Search Domain Scan URL
Title: Arseniy Sharoglazov (@_mohemiv)
Search URL Search Domain Scan URL
Title: Pilot Into Facebook Group Support
Search URL Search Domain Scan URL
Title: [Open redirect] Developers are lazy(or maybe busy)
Search URL Search Domain Scan URL
Title: KatsuragiCSL (@ZuuitterE)
Search URL Search Domain Scan URL
Title: Second bite on GitLab, and some interesting Ruby functions/features
Search URL Search Domain Scan URL
Title: From blind XXE to root-level file read access
Search URL Search Domain Scan URL
Title: How i was able to pwned application by Bypassing Cloudflare WAF
Search URL Search Domain Scan URL
Title: Microsoft Account Takeover Vulnerability Affecting 400 Million Users
Search URL Search Domain Scan URL
Title: How I could have stolen your photos from Google - my first 3 bug bounty writeups
Search URL Search Domain Scan URL
Title: Gergő Turcsányi (@GergoTurcsanyi)
Search URL Search Domain Scan URL
Title: How I was able to generate Access Tokens for any Facebook user.
Search URL Search Domain Scan URL
Title: Bruteforcing Instagram account’s passwords without limit.
Search URL Search Domain Scan URL
Title: A Misconfiguration in techprep.fb.com REST API allowed me to modify any user profile.
Search URL Search Domain Scan URL
Title: How i was able to upload files to api.techprep.fb.com
Search URL Search Domain Scan URL
Title: Token Brute-Force to Account Take-over to Privilege Escalation to Organization Take-Over
Search URL Search Domain Scan URL
Title: My first bug bounty writeup
Search URL Search Domain Scan URL
Title: Change Anyone’s profile picture-Exploiting IDOR
Search URL Search Domain Scan URL
Title: Proof Of Concept Nokia Cross Site Scripting
Search URL Search Domain Scan URL
Title: How I was Able To Bypass Email Verification
Search URL Search Domain Scan URL
Title: RCE in Hubspot with EL injection in HubL
Search URL Search Domain Scan URL
Title: Fyoorer (@ƒyoorer)
Search URL Search Domain Scan URL
Title: Facebook WhiteHat: Able to access group plan even after leaving the group
Search URL Search Domain Scan URL
Title: Billion Laugh Attack in https://sites.google.com
Search URL Search Domain Scan URL
Title: Antonio Sanso (@asanso)
Search URL Search Domain Scan URL
Title: XSS to XXE in Prince v10 and below (CVE-2018-19858)
Search URL Search Domain Scan URL
Title: Complete User Account Takeover on an Android Application
Search URL Search Domain Scan URL
Title: Taking over Google calendar of a company
Search URL Search Domain Scan URL
Title: How to accidentally find a XSS in ProtonMail iOS app
Search URL Search Domain Scan URL
Title: SecuNinja (@secuninja)
Search URL Search Domain Scan URL
Title: GitHub Desktop RCE (OSX)
Search URL Search Domain Scan URL
Title: André Baptista (@0xACB)
Search URL Search Domain Scan URL
Title: Digging in to SCP Command Injection
Search URL Search Domain Scan URL
Title: Dylan Katz (@Plazmaz)
Search URL Search Domain Scan URL
Title: [BBP系列三] Hijack the JS File of Uber’s Website
Search URL Search Domain Scan URL
Title: Chaobin Zhang
Search URL Search Domain Scan URL
Title: Love Story Of A Account Takeover (Chaining Host Header Injection To Takeover Someones Account)
Search URL Search Domain Scan URL
Title: Story about my first bug bounty
Search URL Search Domain Scan URL
Title: Exploiting post message to steal and replace user’s cookies
Search URL Search Domain Scan URL
Title: Yasser Gersy (@yassergersy)
Search URL Search Domain Scan URL
Title: Story of Stored Xss
Search URL Search Domain Scan URL
Title: Walid Hossain (@NoobWalid)
Search URL Search Domain Scan URL
Title: Broken Authentication — Bug Bounty
Search URL Search Domain Scan URL
Title: IRCTC — Millions of Passenger Details left at huge risk!
Search URL Search Domain Scan URL
Title: Pwning eBay - How I Dumped eBay Japan’s Website Source Code
Search URL Search Domain Scan URL
Title: Instagram Multi-factor authentication Bypass
Search URL Search Domain Scan URL
Title: Disclose contact_email of any Facebook application
Search URL Search Domain Scan URL
Title: XSS on Facebook’s acquisition Oculus CDN
Search URL Search Domain Scan URL
Title: Facebook Source Code Disclosure in ads API
Search URL Search Domain Scan URL
Title: From CTFs to Bug Bounty Booty
Search URL Search Domain Scan URL
Title: XML XSS in *.yandex.ru by Accident
Search URL Search Domain Scan URL
Title: My Journey To The Google Hall Of Fame
Search URL Search Domain Scan URL
Title: Abartan Dhakal (@imhaxormad)
Search URL Search Domain Scan URL
Title: Stored XSS Vulnerability in Jotform and H1C Private Site
Search URL Search Domain Scan URL
Title: Bypassing Scratch Cards On Google Pay
Search URL Search Domain Scan URL
Title: Exploiting SSRF like a Boss — Escalation of an SSRF to Local File Read!
Search URL Search Domain Scan URL
Title: Zain Sabahat (@Zain_Sabahat)
Search URL Search Domain Scan URL
Title: An interesting XXE in SAP.
Search URL Search Domain Scan URL
Title: How i Found Information Disclosure on Scribd.com
Search URL Search Domain Scan URL
Title: How I Hacked Netflix users & Use it free forever
Search URL Search Domain Scan URL
Title: Blueberryinfosec (@bbinfosec)
Search URL Search Domain Scan URL
Title: XS-Searching Google’s bug tracker to find out vulnerable source code
Search URL Search Domain Scan URL
Title: Authentication bypass in NodeJS application — a bug bounty story
Search URL Search Domain Scan URL
Title: bl4de (@_bl4de)
Search URL Search Domain Scan URL
Title: XSS bypass using META tag in realestate.postnl.nl
Search URL Search Domain Scan URL
Title: From Security Misconfiguration to Gaining Access of SMTP server
Search URL Search Domain Scan URL
Title: Edmodo XSS Bug
Search URL Search Domain Scan URL
Title: Sameer Phad (@sameerphad72)
Search URL Search Domain Scan URL
Title: Bypassing “How I hacked Google’s bug tracking system itself for $15,600 in bounties.”
Search URL Search Domain Scan URL
Title: Gopal Singh (@gopalsinghcse)
Search URL Search Domain Scan URL
Title: How I Managed to Create Unauthorized Comments on Facebook Live Stream
Search URL Search Domain Scan URL
Title: Microsoft BingPlaces Business - (url) Redirect Vulnerability
Search URL Search Domain Scan URL
Title: XSS in hidden input fields
Search URL Search Domain Scan URL
Title: [POC] Cross-Site Scripting on Garuda Indonesia Website
Search URL Search Domain Scan URL
Title: HackenProof Customer Story: Uklon
Search URL Search Domain Scan URL
Title: HackenProof (@hackenproof)
Search URL Search Domain Scan URL
Title: Most common security vulnerabilities in npm static server modules
Search URL Search Domain Scan URL
Title: Lintern@ute Account Takeover via Cross site request forgery
Search URL Search Domain Scan URL
Title: Spoofing file extensions on HackerOne
Search URL Search Domain Scan URL
Title: Anurag Jain(@csanuragjain)
Search URL Search Domain Scan URL
Title: Disclose Page Admins via Gaming Dashboard Bans
Search URL Search Domain Scan URL
Title: Facebook Vulnerability: Hiding from the view of Business Admin in the Business Manager
Search URL Search Domain Scan URL
Title: How I Discovered XSS that Affects around 20 Uber Subdomains
Search URL Search Domain Scan URL
Title: Fady Othman (@Fady_Othman)
Search URL Search Domain Scan URL
Title: Breaking Appointments and Job Interview Schedules With Malformed Times
Search URL Search Domain Scan URL
Title: Spoof All Domains Containing ‘d’ in Apple Products [CVE-2018-4277]
Search URL Search Domain Scan URL
Title: Tencent’s Xuanwu Lab
Search URL Search Domain Scan URL
Title: OOB XXE in PrizmDoc (CVE-2018–15805)
Search URL Search Domain Scan URL
Title: [DOM based XSS] Or why you should not rely on Cloudflare too much
Search URL Search Domain Scan URL
Title: Patched Facebook Vulnerability Could Have Exposed Private Information About You and Your Friends
Search URL Search Domain Scan URL
Title: Chain exploitation of XSS
Search URL Search Domain Scan URL
Title: Mikhail Klyuchnikov (@__Mn1__)
Search URL Search Domain Scan URL
Title: Clickjacking on Google MyAccount Worth 7,500$
Search URL Search Domain Scan URL
Title: #bugbounty How I Takeover Microsoft Store.
Search URL Search Domain Scan URL
Title: Object name Exposure — ING Bank Responsible Disclosure Program
Search URL Search Domain Scan URL
Title: How I earned 5040$ from Twitter by showing a way to Harvest other users IP address
Search URL Search Domain Scan URL
Title: Vine User’s Private information disclosure
Search URL Search Domain Scan URL
Title: WordPress Design Flaw Leads to WooCommerce RCE
Search URL Search Domain Scan URL
Title: XSS in Dynamics 365
Search URL Search Domain Scan URL
Title: Tim Kent (@__timk)
Search URL Search Domain Scan URL
Title: Evernote For Windows Read Local File and Command Execute Vulnerabilities
Search URL Search Domain Scan URL
Title: Duplicate but still cool
Search URL Search Domain Scan URL
Title: Unauthenticated RSFTP to Command Injection
Search URL Search Domain Scan URL
Title: Nicodemo Gawronski
Search URL Search Domain Scan URL
Title: Full Account Takeover via Referer Header (OAuth token Steal, Open Redirect Vulnerability Chaining)
Search URL Search Domain Scan URL
Title: How Outdated JIRA Instances suffers from multiple security vulnerabilities?
Search URL Search Domain Scan URL
Title: Imagemagick GIF coder vulnerability leads to memory disclosure (Hackerone)
Search URL Search Domain Scan URL
Title: Finding hidden gems vol. 3: quick win with .sh file
Search URL Search Domain Scan URL
Title: P1 Like a Boss | Information Disclosure via Github leads to Employee Account Takeover | Bug Bounty POC
Search URL Search Domain Scan URL
Title: Stored XSS in Bug Bounty
Search URL Search Domain Scan URL
Title: Bypass HackerOne 2FA requirement and reporter blacklist
Search URL Search Domain Scan URL
Title: Japz Divino (@japzdivino)
Search URL Search Domain Scan URL
Title: It’s all in the detail: Email leak & Account takeover thanks to WayBackMachine & extensive knowledge about the program
Search URL Search Domain Scan URL
Title: IDOR in JWT and the shortest token you will ever see {}.{“uid”: “1234567890”}
Search URL Search Domain Scan URL
Title: Journey through Google referer leakage bugs.
Search URL Search Domain Scan URL
Title: #BugBounty — How I was able to download the Source Code of India’s Largest Telecom Service Provider including dozens of more popular websites!
Search URL Search Domain Scan URL
Title: Privilege Escalation like a Boss
Search URL Search Domain Scan URL
Title: How Misconfigured API leaked user private information?
Search URL Search Domain Scan URL
Title: A very useful technique to bypass the CSRF protection for fun and profit.
Search URL Search Domain Scan URL
Title: CSRF account takeover Explained Automated/Manual — Bug Bounty
Search URL Search Domain Scan URL
Title: CSRF account takeover in a company worth 1B$
Search URL Search Domain Scan URL
Title: Subdomain takeover dew to missconfigured project settings for Custom domain .
Search URL Search Domain Scan URL
Title: DoS on Facebook Android app using 65530 characters of ZERO WIDTH NO-BREAK SPACE.
Search URL Search Domain Scan URL
Title: SOAP- Based Unauthenticated Out-of-Band XML External Entity (OOB-XXE) in a Help Desk Software
Search URL Search Domain Scan URL
Title: Facebook hidden redirection vulnerability
Search URL Search Domain Scan URL
Title: XSS with HTML and how to convert the HTML into charcode()
Search URL Search Domain Scan URL
Title: Google sites and exploiting same origin policy
Search URL Search Domain Scan URL
Title: Cookie-based-injection XSS making exploitable with-out exploiting other Vulns
Search URL Search Domain Scan URL
Title: Utkarsh Agrawal
Search URL Search Domain Scan URL
Title: Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature
Search URL Search Domain Scan URL
Title: A possibility of Account Takeover in Medium
Search URL Search Domain Scan URL
Title: Prashant Kumar (@notsoshant)
Search URL Search Domain Scan URL
Title: XSS with PUT in Ghost Blog
Search URL Search Domain Scan URL
Title: Derek (@StackCrash)
Search URL Search Domain Scan URL
Title: Add comment on a private Oculus Developer bug report
Search URL Search Domain Scan URL
Title: Security teams Internal attachments can be exported via “Export as .zip” feature on HackerOne
Search URL Search Domain Scan URL
Title: XXE in IBM’s MaaS360 Platform
Search URL Search Domain Scan URL
Title: Path traversal while uploading results in RCE
Search URL Search Domain Scan URL
Title: Brave Browser Script Blocker Bypass Vulnerability
Search URL Search Domain Scan URL
Title: Microsoft CSRF Vulnerability
Search URL Search Domain Scan URL
Title: [Bug bounty | mail.ru] Access to the admin panel of the partner site and data disclosure of 2 million users
Search URL Search Domain Scan URL
Title: Magic XSS with two parameters
Search URL Search Domain Scan URL
Title: Mahmood Shahabi (@m4shahab1)
Search URL Search Domain Scan URL
Title: Add description to Instagram Posts on behalf of other users - 6500$
Search URL Search Domain Scan URL
Title: Microsoft Edge Remote Code Execution
Search URL Search Domain Scan URL
Title: Access to staging environment via User-Agent string
Search URL Search Domain Scan URL
Title: Symantec Messaging Gateway authentication bypass
Search URL Search Domain Scan URL
Title: Artem Kondratenko (@artkond)
Search URL Search Domain Scan URL
Title: Payment bypass
Search URL Search Domain Scan URL
Title: Facebook Business Takeover
Search URL Search Domain Scan URL
Title: Get as image function pulls any Insights/NRQL data from any New Relic account (IDOR)
Search URL Search Domain Scan URL
Title: DOM-XSS Bug Affecting Tinder, Shopify, Yelp, and More
Search URL Search Domain Scan URL
Title: VPN Mentor (@vpnmentor)
Search URL Search Domain Scan URL
Title: Make any Unit in Facebook Groups Undeletable
Search URL Search Domain Scan URL
Title: [Critical] Bypass CSRF protection on IBM
Search URL Search Domain Scan URL
Title: Persistent XSS (unvalidated Open Graph embed) at LinkedIn.com
Search URL Search Domain Scan URL
Title: My First 0day Exploit (CSP Bypass + Reflected XSS) #BUGBOUNTY
Search URL Search Domain Scan URL
Title: Ali Tütüncü(@alicanact60)
Search URL Search Domain Scan URL
Title: Blind XML External Entities Out-Of-Band Channel Vulnerability : PayPal Case Study
Search URL Search Domain Scan URL
Title: Clickjacking in Google Docs and Voice typing feature.
Search URL Search Domain Scan URL
Title: GoogleMeetRoulette: Joining random meetings
Search URL Search Domain Scan URL
Title: Martin Vigo (@martin_vigo)
Search URL Search Domain Scan URL
Title: An interesting Google vulnerability that got me 3133.7 reward.
Search URL Search Domain Scan URL
Title: Ebrahem Hegazy (@Zigoo0)
Search URL Search Domain Scan URL
Title: Persistent XSS (Unvalidated oEmbed) at Medium.com
Search URL Search Domain Scan URL
Title: Exploiting an unknown vulnerability
Search URL Search Domain Scan URL
Title: Abhishek Bundela (@abhibundela)
Search URL Search Domain Scan URL
Title: Facebook Bug Bounty: Email Id, Phone Number Can be exposed Through Business Manager
Search URL Search Domain Scan URL
Title: AWS takeover through SSRF in JavaScript
Search URL Search Domain Scan URL
Title: Gwendal Le Coguic (@gwendallecoguic)
Search URL Search Domain Scan URL
Title: Applying a small bypass to steal Facebook Session tokens in Uber
Search URL Search Domain Scan URL
Title: Samuel (@saamux)
Search URL Search Domain Scan URL
Title: $2,000
Search URL Search Domain Scan URL
Title: How i found Stored xss on your-domain.redacted.com
Search URL Search Domain Scan URL
Title: Collecting Shells by the Sea of NAS Vulnerabilities
Search URL Search Domain Scan URL
Title: Rick Ramgattie (@RRamgattie)
Search URL Search Domain Scan URL
Title: Subdomain Takeover via Shopify Vendor ( blog.exchangemarketplace.com ) with Steps
Search URL Search Domain Scan URL
Title: Google Stored XSS in Payments
Search URL Search Domain Scan URL
Title: Barış Sağdıç (@brsgdc)
Search URL Search Domain Scan URL
Title: How I was able to takeover account’s of an Earning App
Search URL Search Domain Scan URL
Title: Hacking the Subway Android app
Search URL Search Domain Scan URL
Title: Wesley Gahr (@wesley_gahr)
Search URL Search Domain Scan URL
Title: IDOR, Content Spoofing and Url Redirection via unsubscribe email in Confluent
Search URL Search Domain Scan URL
Title: Just another tale of severe bugs on a private program.
Search URL Search Domain Scan URL
Title: Siva Krishna Samireddi (@le4rner)
Search URL Search Domain Scan URL
Title: #BugBounty — From finding Jenkins instance to Command Execution.Secure your Jenkins Instance!
Search URL Search Domain Scan URL
Title: Thick Client — Attacking databases the fun/easy way
Search URL Search Domain Scan URL
Title: Arbitrary File Read in one of the largest CRMs
Search URL Search Domain Scan URL
Title: [XSS] survey.dropbox.com
Search URL Search Domain Scan URL
Title: Weaponizing XSS Attacking Internal System
Search URL Search Domain Scan URL
Title: Subdomain Takeover via Unsecured S3 Bucket Connected to the Website
Search URL Search Domain Scan URL
Title: Responsible disclosure: retrieving a user’s private Facebook friends.
Search URL Search Domain Scan URL
Title: How I XSS’ed Uber and Bypassed CSP
Search URL Search Domain Scan URL
Title: Efkan (@mefkansec)
Search URL Search Domain Scan URL
Title: R-XSS -> CSRF bypass to account takeover/
Search URL Search Domain Scan URL
Title: Bypassing Firebase authorization to create custom goo.gl subdomains
Search URL Search Domain Scan URL
Title: Another XSS in Google Colaboratory
Search URL Search Domain Scan URL
Title: Shopify Athena Bug
Search URL Search Domain Scan URL
Title: Local file inclusion at IKEA.com
Search URL Search Domain Scan URL
Title: Bypassing Authentication Using Javascript Debugger.
Search URL Search Domain Scan URL
Title: Mohit Dabas (@mohitdabas08)
Search URL Search Domain Scan URL
Title: How i bypassed AKAMAI KONA WAF , XSS in overstock.com !
Search URL Search Domain Scan URL
Title: Facebook $750 Reward for a Simple Bug
Search URL Search Domain Scan URL
Title: Chain The Bugs to Pwn an Organisation ( LFI + Unrestricted File Upload = Remote Code Execution )
Search URL Search Domain Scan URL
Title: Reflected XSS at Philips.com
Search URL Search Domain Scan URL
Title: XSS Vulnerabilities in Multiple iFrame Busters Affecting Top Tier Sites
Search URL Search Domain Scan URL
Title: Randy Westergren (@RandyWestergren)
Search URL Search Domain Scan URL
Title: Vertical escalation of privileges Leading to Sensitive Data Exposure
Search URL Search Domain Scan URL
Title: Umair Ahmed (@u_ahmedofficial)
Search URL Search Domain Scan URL
Title: User Account takeover in India’s largest digital business company
Search URL Search Domain Scan URL
Title: Minali Arora (@AroraMinali)
Search URL Search Domain Scan URL
Title: IDOR User Account Takeover By Connecting My Facebook Account with victims Account
Search URL Search Domain Scan URL
Title: Persistent Cross-Site Scripting on redacted worth $2,000
Search URL Search Domain Scan URL
Title: How I hijacked your account when you opened my cat picture
Search URL Search Domain Scan URL
Title: Hacking your own antivirus for fun and profit (Safe browsing gone wrong)
Search URL Search Domain Scan URL
Title: Martin Thirup Christensen (@Mthirup)
Search URL Search Domain Scan URL
Title: Subdomain Takeover worth 200$
Search URL Search Domain Scan URL
Title: Reflected DOM XSS and CLICKJACKING on https://silvergoldbull.de/bt.html
Search URL Search Domain Scan URL
Title: Subdomain Takeover via Campaignmonitor
Search URL Search Domain Scan URL
Title: Open-Redirect Vulnerability in udacity.com
Search URL Search Domain Scan URL
Title: Hacking a Crypto Debit Card Service
Search URL Search Domain Scan URL
Title: Muhammad Abdullah
Search URL Search Domain Scan URL
Title: XXE at Bol.com
Search URL Search Domain Scan URL
Title: How to do 55.000+ Subdomain Takeover in a Blink of an Eye
Search URL Search Domain Scan URL
Title: BuckHacker (@thebuckhacker)
Search URL Search Domain Scan URL
Title: Authentication Bypass Using SQL Injection AutoTrader Webmail – Bug Bounty POC
Search URL Search Domain Scan URL
Title: Stored XSS Vulnerability in H1C Private site
Search URL Search Domain Scan URL
Title: Making the Facebook app more secure - $8500 bounty
Search URL Search Domain Scan URL
Title: ZOL Zimbabwe Authentication Bypass to XSS & SQLi Vulnerability – Bug Bounty POC
Search URL Search Domain Scan URL
Title: How I find Open-Redirect Vulnerability in redacted.com (One of the top online payment processing service website)
Search URL Search Domain Scan URL
Title: Disclosure of Facebook Page Admin due to insecure tagging behavior
Search URL Search Domain Scan URL
Title: Aj Dumanhug (@ajdumanhug)
Search URL Search Domain Scan URL
Title: Stored XSS Vulnerability in Tumblr
Search URL Search Domain Scan URL
Title: Reflected XSS in Google Code Jam
Search URL Search Domain Scan URL
Title: SQL Injection Vulnerability bootcamp.nutanix.com | Bug Bounty POC
Search URL Search Domain Scan URL
Title: LFI to 10 servers pwn
Search URL Search Domain Scan URL
Title: Bypassing Hotstar Premium with DOM manipulation and some JavaScript
Search URL Search Domain Scan URL
Title: OpSecX
Search URL Search Domain Scan URL
Title: RCE Unsecure Jenkins Instance | Bug Bounty POC
Search URL Search Domain Scan URL
Title: Write-up - Love story, from closed as informative to $3,500 USD, XSS stored in Yahoo! iOS MaiL app
Search URL Search Domain Scan URL
Title: Simple Login Brute Force / Current Password Requirement Bypass
Search URL Search Domain Scan URL
Title: #BugBounty — How Naaptol (India’s popular home shopping company) Kept their Millions of User Data at Risk!
Search URL Search Domain Scan URL
Title: How I could download the source code of an Indian e-commerce website!!
Search URL Search Domain Scan URL
Title: P1 Vulnerability in 60 seconds
Search URL Search Domain Scan URL
Title: Facebook Bug Bounty! {Permission Bug}
Search URL Search Domain Scan URL
Title: Admin Disclosure of Facebook Business all Pages by normal employees:
Search URL Search Domain Scan URL
Title: How I could have launched a spear phishing campaign with Starbucks email servers
Search URL Search Domain Scan URL
Title: Kyle (@b3nac)
Search URL Search Domain Scan URL
Title: Send request to Martians. Earthlings are already your friends.
Search URL Search Domain Scan URL
Title: Sagar VD
Search URL Search Domain Scan URL
Title: I Own Your Customers !!!
Search URL Search Domain Scan URL
Title: Pwned Together: Hacking dev.to
Search URL Search Domain Scan URL
Title: Antony Garand
Search URL Search Domain Scan URL
Title: $100 Bounty in 300 seconds isn’t bad !!!
Search URL Search Domain Scan URL
Title: Reflected XSS in Django REST Framework Api at MapBox Subdomain
Search URL Search Domain Scan URL
Title: Finding hidden gems vol. 2: REAMDE.md, the story of a bit too helpful readme file
Search URL Search Domain Scan URL
Title: A Infinite Loop Story.
Search URL Search Domain Scan URL
Title: A $1000 Bounty
Search URL Search Domain Scan URL
Title: Reflected Swf XSS at ( https://plugins.svn.wordpress.org )
Search URL Search Domain Scan URL
Title: How i found a 1500$ worth Deserialization vulnerability
Search URL Search Domain Scan URL
Title: IDOR FACEBOOK: malicious person add people to the “Top Fans”
Search URL Search Domain Scan URL
Title: Jafar Abo Nada
Search URL Search Domain Scan URL
Title: Traversing the Path to RCE
Search URL Search Domain Scan URL
Title: Uber Bug Bounty: 1000$ for two “high severity” issue
Search URL Search Domain Scan URL
Title: Open Redirection
Search URL Search Domain Scan URL
Title: My first valid xss(@Hackerone)
Search URL Search Domain Scan URL
Title: Privileged Escalation in Facebook Messenger Rooms
Search URL Search Domain Scan URL
Title: SQL Injection Vulnerability In University Of Cambridge
Search URL Search Domain Scan URL
Title: Liking GitHub repositories on behalf of other users — Stored XSS in WebComponents.org
Search URL Search Domain Scan URL
Title: API key: The real goldmine
Search URL Search Domain Scan URL
Title: Privileged Escalation in Facebook Messenger Rooms
Search URL Search Domain Scan URL
Title: User credential are sent in clear text in Whatsapp web— FIXED | Facebook Bug Bounty
Search URL Search Domain Scan URL
Title: YAHOO IDOR -elimination of any comment
Search URL Search Domain Scan URL
Title: Bada Diaz (@bada77)
Search URL Search Domain Scan URL
Title: 3 Minutes & XSS!
Search URL Search Domain Scan URL
Title: IDOR leads to account takeover
Search URL Search Domain Scan URL
Title: @s0cket7
Search URL Search Domain Scan URL
Title: ICloud.com DOM-Based XSS! #BugBounty
Search URL Search Domain Scan URL
Title: Another “TicketTrick” story
Search URL Search Domain Scan URL
Title: XSS at Hubspot and XSS in email areas.
Search URL Search Domain Scan URL
Title: IDOR leads to getting Access tokens of users linked to Google Drive on Edmodo
Search URL Search Domain Scan URL
Title: Aagam shah (@neutrinoguy)
Search URL Search Domain Scan URL
Title: Distorted and Undeletable Posts in Facebook Group
Search URL Search Domain Scan URL
Title: How I Chained 4 Bugs(Features?) into RCE on Amazon Collaboration System
Search URL Search Domain Scan URL
Title: S3 Bucket Misconfiguration in Amazon
Search URL Search Domain Scan URL
Title: Adminer Script Results to Pwning Server?, Private Bug Bounty Program
Search URL Search Domain Scan URL
Title: Misconfigured JIRA setting - Apigee
Search URL Search Domain Scan URL
Title: [Twitter Bug Bounty] Misconfigured JSON endpoint on ads.twitter.com lead to Access control issue and Information Disclosure of role privileged users.
Search URL Search Domain Scan URL
Title: Peerzada Fawaz Ahmad Qureshi (@zk34911)
Search URL Search Domain Scan URL
Title: Subdomain Takeover: Yet another Starbucks case
Search URL Search Domain Scan URL
Title: Patrik Hudak
Search URL Search Domain Scan URL
Title: From TOMCAT to NT AUTHORITY\SYSTEM
Search URL Search Domain Scan URL
Title: My Disclosed Report about Basic auth Api details at Reverb.com
Search URL Search Domain Scan URL
Title: This is how can I spoof ANY Sentry.Io log infinitely and create fake error-logs
Search URL Search Domain Scan URL
Title: My First Critical Report
Search URL Search Domain Scan URL
Title: Miguel Corral (@mcorral74)
Search URL Search Domain Scan URL
Title: How I hacked a Crypto Exchange (Bug Bounty Writeup)
Search URL Search Domain Scan URL
Title: From data leak to account takeover
Search URL Search Domain Scan URL
Title: How I gained commit access to Homebrew in 30 minutes
Search URL Search Domain Scan URL
Title: Eric Holmes (@vesirin)
Search URL Search Domain Scan URL
Title: Sending out phishing e-mails from @microsoft.com
Search URL Search Domain Scan URL
Title: @si9int
Search URL Search Domain Scan URL
Title: Unauth meetings access
Search URL Search Domain Scan URL
Title: Self XSS leads to blind XSS and reflected XSS.
Search URL Search Domain Scan URL
Title: Reflected XSS Primagames.com
Search URL Search Domain Scan URL
Title: My First Swag Pack : A Logical Bug on Edmodo
Search URL Search Domain Scan URL
Title: Stored XSS in GameSkinny
Search URL Search Domain Scan URL
Title: Blind-XSS in Chrome Experiments - Google (Write Up)
Search URL Search Domain Scan URL
Title: #BugBounty — @Paytm Customer Information is at risk — India’s largest digital wallet company
Search URL Search Domain Scan URL
Title: Discovering and Exploiting a Vulnerability in Android’s Personal Dictionary (CVE-2018-9375)
Search URL Search Domain Scan URL
Title: Daniel Kachakil
Search URL Search Domain Scan URL
Title: Exploiting a Microsoft Edge Vulnerability to Steal Files
Search URL Search Domain Scan URL
Title: Ziyahan Albeniz
Search URL Search Domain Scan URL
Title: Shipt Subdomain TakeOver via HeroKu ( test.shipt.com )
Search URL Search Domain Scan URL
Title: Disclose Facebook Internal Server Information With A Strange Poll
Search URL Search Domain Scan URL
Title: CRLF Injection Into PHP’s cURL Options
Search URL Search Domain Scan URL
Title: TomNomNom
Search URL Search Domain Scan URL
Title: How I could access your internal servers, steal and modify your image repository
Search URL Search Domain Scan URL
Title: PoC || GO
Search URL Search Domain Scan URL
Title: Hacking Imgur for Fun and Profit
Search URL Search Domain Scan URL
Title: Nathan (@NathOnSecurity)
Search URL Search Domain Scan URL
Title: 18th Acknowledgement From Microsoft
Search URL Search Domain Scan URL
Title: Muhammad Muhaddis
Search URL Search Domain Scan URL
Title: Yahoo — Two XSSi vulnerabilities chained to steal user information. ($750 Bounty)
Search URL Search Domain Scan URL
Title: Microsoft Office 365 Stored XSS
Search URL Search Domain Scan URL
Title: Making a Blind SQL Injection a Little Less Blind
Search URL Search Domain Scan URL
Title: Binary.com ClickJacking Vulnerability — Exploiting HTML5 Security Features
Search URL Search Domain Scan URL
Title: Ameer Assadi
Search URL Search Domain Scan URL
Title: How I found XSS on Amazon?
Search URL Search Domain Scan URL
Title: Coding_Karma
Search URL Search Domain Scan URL
Title: Exfiltration via CSS Injection
Search URL Search Domain Scan URL
Title: SQL Injection and A silly WAF
Search URL Search Domain Scan URL
Title: Exploitation of Server Side Template Injection with Craft CMS plugin SEOmatic <=3.1.3 [CVE-2018-14716]
Search URL Search Domain Scan URL
Title: Sebastian (ha.cker.info)
Search URL Search Domain Scan URL
Title: Vulnerability in Hangouts Chat a.k.a. how Electron makes open redirect great again
Search URL Search Domain Scan URL
Title: Finding hidden gems vol. 1: forging OAuth tokens using discovered client id and client secret
Search URL Search Domain Scan URL
Title: IDOR FACEBOOK: malicious person add people to the “Top Fans”
Search URL Search Domain Scan URL
Title: Unclaimed Medium Publication takeover in WeTransfer
Search URL Search Domain Scan URL
Title: Google Assistant Bug Worth $3133.7 !
Search URL Search Domain Scan URL
Title: RCE due to ShowExceptions
Search URL Search Domain Scan URL
Title: Into the Borg – SSRF inside Google production network
Search URL Search Domain Scan URL
Title: The call is coming from inside the house — DNS rebinding in EOSIO keosd wallet
Search URL Search Domain Scan URL
Title: François Proulx
Search URL Search Domain Scan URL
Title: RCE on Yahoo Luminate
Search URL Search Domain Scan URL
Title: How I was able to delete 13k+ Microsoft Translator projects
Search URL Search Domain Scan URL
Title: Haider Mahmood
Search URL Search Domain Scan URL
Title: Hey Developer, Give me your API keys.!!
Search URL Search Domain Scan URL
Title: Bypass Admin approval, Mute Member and Posting Permissions for Only admins in Facebook groups
Search URL Search Domain Scan URL
Title: Hacking thousands of companies through their helpdesk
Search URL Search Domain Scan URL
Title: CVE-2018-13784: PrestaShop 1.6.x Privilege Escalation
Search URL Search Domain Scan URL
Title: WRITE UP – TELEGRAM BUG BOUNTY – WHATSAPP N/A [“Blind” XSS Stored iOS in messengers twins, who really care about your security?]
Search URL Search Domain Scan URL
Title: Attacking PostgreSQL Database
Search URL Search Domain Scan URL
Title: Bug Bounty at Bangladeshi Site.
Search URL Search Domain Scan URL
Title: Shaifullah Shaon
Search URL Search Domain Scan URL
Title: Should this be public though?
Search URL Search Domain Scan URL
Title: XSS in Microsoft subdomain
Search URL Search Domain Scan URL
Title: The tradeRifle Vulnerability Identified in LBank Mobile Service (CVE-2018-13363)
Search URL Search Domain Scan URL
Title: PeckShield
Search URL Search Domain Scan URL
Title: Gsuite Hangouts Chat 5k IDOR
Search URL Search Domain Scan URL
Title: Cam (@SecretlyHidden1)
Search URL Search Domain Scan URL
Title: Persistent XSS at AH.nl
Search URL Search Domain Scan URL
Title: #BugBounty - Compromising User Account- “How I was able to compromise user account via HTTP Parameter Pollution(HPP)”
Search URL Search Domain Scan URL
Title: Server Side Request Forgery on Vanilla Forums
Search URL Search Domain Scan URL
Title: Vikash Chaudhary
Search URL Search Domain Scan URL
Title: Latex to RCE, Private Bug Bounty Program
Search URL Search Domain Scan URL
Title: The $12,000 Intersection between Clickjacking, XSS, and Denial of Service
Search URL Search Domain Scan URL
Title: Chaining Multiple Vulnerabilities to Gain Admin Access
Search URL Search Domain Scan URL
Title: Bug Bounty: Tumblr reCAPTCHA vulnerability write up
Search URL Search Domain Scan URL
Title: Leigh-Anne Galloway (@L_AGalloway)
Search URL Search Domain Scan URL
Title: Authentication bypass in Cisco Meraki
Search URL Search Domain Scan URL
Title: This popular Facebook app publicly exposed your data for years
Search URL Search Domain Scan URL
Title: Take Advantage of Out-of-Scope Domains in Bug Bounty Programs
Search URL Search Domain Scan URL
Title: Abdullah Hussam (@Abdulahhusam)
Search URL Search Domain Scan URL
Title: How re-signing up for an account lead to account takeover
Search URL Search Domain Scan URL
Title: @zseano
Search URL Search Domain Scan URL
Title: Subdomain Takeover: Starbucks points to Azure
Search URL Search Domain Scan URL
Title: Account Take over via reset password
Search URL Search Domain Scan URL
Title: How I got access to local AWS info via Jira
Search URL Search Domain Scan URL
Title: Coen Goedegebure
Search URL Search Domain Scan URL
Title: Fastest Fix on Open Bug Bounty Platform
Search URL Search Domain Scan URL
Title: Wen Bin KONG
Search URL Search Domain Scan URL
Title: How I hacked Apple.com (Unrestricted File Upload)
Search URL Search Domain Scan URL
Title: XSS in Google Colaboratory + CSP bypass
Search URL Search Domain Scan URL
Title: Using a GitHub app to escalate to an organization owner for a $10,000 bounty
Search URL Search Domain Scan URL
Title: Tanner
Search URL Search Domain Scan URL
Title: Setting arbitrary request headers in Chromium via CRLF injection
Search URL Search Domain Scan URL
Title: I discovered a browser bug
Search URL Search Domain Scan URL
Title: Jake Archibald
Search URL Search Domain Scan URL
Title: [Responsible disclosure] How I could have booked movie tickets through other user accounts
Search URL Search Domain Scan URL
Title: Bharathvaj Ganesan
Search URL Search Domain Scan URL
Title: How i found blind XSS in Apple
Search URL Search Domain Scan URL
Title: Taha Smily
Search URL Search Domain Scan URL
Title: Reflected Client XSS at Amazon.com
Search URL Search Domain Scan URL
Title: Yay! 3133.70$ for RCE on *.withgoogle.com subdomain.
Search URL Search Domain Scan URL
Title: Password reset to full account takeover
Search URL Search Domain Scan URL
Title: Hamza Bettache
Search URL Search Domain Scan URL
Title: Reflected XSS in 360totalsecurity
Search URL Search Domain Scan URL
Title: The 2.5 BTC Stored XSS
Search URL Search Domain Scan URL
Title: How I got paid premium plan for free on many popular websites
Search URL Search Domain Scan URL
Title: Vulnerability Netflix (cross-site-scripting) XSS
Search URL Search Domain Scan URL
Title: Unvalidated Open Redirect Bol.com
Search URL Search Domain Scan URL
Title: Full account Takeover via reset password function
Search URL Search Domain Scan URL
Title: Server-Side Spreadsheet Injection – Formula Injection to Remote Code Execution
Search URL Search Domain Scan URL
Title: How I Found CVE-2018-8819: Out-of-Band (OOB) XXE in WebCTRL
Search URL Search Domain Scan URL
Title: Darrell Damstedt
Search URL Search Domain Scan URL
Title: [PayPal BBP] I could’ve deleted All SMC messages. Using Brute-Force technique.
Search URL Search Domain Scan URL
Title: Ayoub Ait Elmokhtar
Search URL Search Domain Scan URL
Title: Steam, Fire, and Paste – A Story of UXSS via DOM-XSS & Clickjacking in Steam Inventory Helper
Search URL Search Domain Scan URL
Title: Matthew Bryan
Search URL Search Domain Scan URL
Title: Steam Inventory Helper
Search URL Search Domain Scan URL
Title: How I was able to list some internal information from PayPal #BugBounty
Search URL Search Domain Scan URL
Title: Adrien Jeanneau
Search URL Search Domain Scan URL
Title: How I found XSS via SSRF vulnerability -Adesh Kolte
Search URL Search Domain Scan URL
Title: #BugBounty —” Database hacked of India’s Popular Sports company”-Bypassing Host Header to SQL injection to dumping Database — An unusual case of SQL injection.
Search URL Search Domain Scan URL
Title: Zero to Account Takeover: How I ‘Impersonated’ Someone Else Using Auth0
Search URL Search Domain Scan URL
Title: Daniel Svartman
Search URL Search Domain Scan URL
Title: Searching for XSS found LDAP injection
Search URL Search Domain Scan URL
Title: Davide Tampellini
Search URL Search Domain Scan URL
Title: Are you sure this is a trusted email?
Search URL Search Domain Scan URL
Title: Reading Your Emails With A Read&Write Chrome Extension Same Origin Policy Bypass (~8 Million Users Affected)
Search URL Search Domain Scan URL
Title: Read&Write
Search URL Search Domain Scan URL
Title: How I Hacked Fotor & Got “Nothing”
Search URL Search Domain Scan URL
Title: Somdev Sangwan (s0md3v)
Search URL Search Domain Scan URL
Title: Getting PHP Code Execution and leverage access to panels,databases,server
Search URL Search Domain Scan URL
Title: How i converted SSRF to XSS in Jira.
Search URL Search Domain Scan URL
Title: How I Earned $750 Bounty Reward From AT&T bug Bounty -Adesh Kolte
Search URL Search Domain Scan URL
Title: #Bug Bounty — How I booked a rental house for just 1.00 INR — Price Manipulation in Citrus Pay
Search URL Search Domain Scan URL
Title: Raghavendra Reddy
Search URL Search Domain Scan URL
Title: Reflected XSS in Yahoo Subdomain ( hk.movies.yahoo.com )
Search URL Search Domain Scan URL
Title: 5k$ for path traversal on *.paypal-corp.com subdomain
Search URL Search Domain Scan URL
Title: Account Takeover and Blind XSS! Go Pro, get Bugs!
Search URL Search Domain Scan URL
Title: How I found 5 store XSS on a private program. Each worth “1,016.66$”
Search URL Search Domain Scan URL
Title: Shahzad Sadiq
Search URL Search Domain Scan URL
Title: How I got hall of fame in two fortune 500 companies — An RCE story…
Search URL Search Domain Scan URL
Title: Alfie
Search URL Search Domain Scan URL
Title: How i was able to get admin panel on a private program
Search URL Search Domain Scan URL
Title: reCAPTCHA bypass via HTTP Parameter Pollution
Search URL Search Domain Scan URL
Title: Andres Riancho
Search URL Search Domain Scan URL
Title: Persistent XSS to Steal Passwords – Paypal
Search URL Search Domain Scan URL
Title: Akhil Reni
Search URL Search Domain Scan URL
Title: Simple IDOR to reject a to-be users invitation via their notification
Search URL Search Domain Scan URL
Title: How I was able to see any private album passwrod in Picturepush — IDOR
Search URL Search Domain Scan URL
Title: #BugBounty — ”How I was able to hack any user account via password reset?”
Search URL Search Domain Scan URL
Title: Bikash Gupta
Search URL Search Domain Scan URL
Title: RCE by uploading a web.config
Search URL Search Domain Scan URL
Title: 003random
Search URL Search Domain Scan URL
Title: AWS Security Flaw which can grant admin access!
Search URL Search Domain Scan URL
Title: Getting read access on Edmodo Production Server by exploiting SSRF
Search URL Search Domain Scan URL
Title: Self-XSS + CSRF to Stored XSS
Search URL Search Domain Scan URL
Title: $36k Google App Engine RCE
Search URL Search Domain Scan URL
Title: Fastest Fix on Open Bug Bounty Platform
Search URL Search Domain Scan URL
Title: How i got 100$ from one private website
Search URL Search Domain Scan URL
Title: How i HACKED admin account via password reset IDOR function of one private currency exchanger site
Search URL Search Domain Scan URL
Title: Stored XSS in Yahoo and all subdomains!
Search URL Search Domain Scan URL
Title: Hakim Bencella
Search URL Search Domain Scan URL
Title: Xss in Microsoft
Search URL Search Domain Scan URL
Title: How I was able to get subscription of $120/year For Free
Search URL Search Domain Scan URL
Title: Muhammad Khizer Javed / babayaga47 (@khizer_javed47)
Search URL Search Domain Scan URL
Title: Whatsapp- DOS vulnerability on Android/iOS/Web
Search URL Search Domain Scan URL
Title: HSTS Bypass Vulnerability in IE Preview
Search URL Search Domain Scan URL
Title: How I used a simple Google query to mine passwords from dozens of public Trello boards
Search URL Search Domain Scan URL
Title: Kushagra Pathak
Search URL Search Domain Scan URL
Title: Internet Safety for Kids & Families — Trend Micro Bypass DOM XSS
Search URL Search Domain Scan URL
Title: Honc (@honcbb)
Search URL Search Domain Scan URL
Title: Asus Control Center – An Information Disclosure and a database connection Clear-Text password leakage Vulnerability
Search URL Search Domain Scan URL
Title: A Five Minute SQL-I
Search URL Search Domain Scan URL
Title: How I Got Paid $0 From the India’s largest online gifting portal — Bug Bounty Program
Search URL Search Domain Scan URL
Title: Hariom Vashisth
Search URL Search Domain Scan URL
Title: $4500 bounty - How I got lucky
Search URL Search Domain Scan URL
Title: Disclose Private Video Thumbnail from Facebook WorkPlace
Search URL Search Domain Scan URL
Title: Stealing money from one account to another account
Search URL Search Domain Scan URL
Title: Story Of a Stored XSS Bypass
Search URL Search Domain Scan URL
Title: Multiple security vulnerabilities in domains belonging to Google
Search URL Search Domain Scan URL
Title: Sysdreams
Search URL Search Domain Scan URL
Title: How I found 2.9 RCE at Yahoo! Bug Bounty program
Search URL Search Domain Scan URL
Title: #BugBounty — How I was able to bypass firewall to get RCE and then went from server shell to get root user account!
Search URL Search Domain Scan URL
Title: Reflected XSS on Stack Overflow
Search URL Search Domain Scan URL
Title: Stored XSS in Yahoo!
Search URL Search Domain Scan URL
Title: Shahzada AL Shahriar Khan
Search URL Search Domain Scan URL
Title: Bypassing the Confirmation Email for Newsletter (bof.nl)
Search URL Search Domain Scan URL
Title: How I earned 60K+ from private program
Search URL Search Domain Scan URL
Title: The Unknown Hero-App Logic Bugs
Search URL Search Domain Scan URL
Title: XSS “403 forbidden” bypass write up
Search URL Search Domain Scan URL
Title: How we got LFI in apache Drill (Recon like a boss)
Search URL Search Domain Scan URL
Title: DOM XSS in Google VRView library
Search URL Search Domain Scan URL
Title: Federico Fazzi
Search URL Search Domain Scan URL
Title: Three Cases, Three Open Redirect Bypasses
Search URL Search Domain Scan URL
Title: Mohammed Eldeeb (@malcolmx0x)
Search URL Search Domain Scan URL
Title: Turning Self-XSS into non-Self Stored-XSS via Authorization Issue at “PayPal Tech-Support and Brand Central Portal
Search URL Search Domain Scan URL
Title: #BugBounty — ”Journey from LFI to RCE!!!”-How I was able to get the same in one of the India’s popular property buy/sell company.
Search URL Search Domain Scan URL
Title: Bypassing the Current Password Protection at PayPal TechSupport Portal
Search URL Search Domain Scan URL
Title: Google Bug: Posting on groups as any user’s behalf
Search URL Search Domain Scan URL
Title: Whatsapp user’s IP disclosure with Link Preview feature
Search URL Search Domain Scan URL
Title: Ribose — IDOR with Simple CSRF Bypass — Unrestricted Changes and Deletion to other Photo Profile
Search URL Search Domain Scan URL
Title: How I Get the Name of the Hotel (and other Data) that you ever Stay - Personal Data Leaks: Private Bug Bounty Program
Search URL Search Domain Scan URL
Title: IDOR (at Private Bug Bounty Program) that could Leads to Personal Data Leaks
Search URL Search Domain Scan URL
Title: How I got stored XSS using file upload
Search URL Search Domain Scan URL
Title: From an error message to DB disclosure
Search URL Search Domain Scan URL
Title: Spoof an user to create a description of a group in Flickr
Search URL Search Domain Scan URL
Title: Bypassing Captcha Like a Boss
Search URL Search Domain Scan URL
Title: #SecurityBreach — ”How I was able to book hotel room for 1.50₹!”
Search URL Search Domain Scan URL
Title: Bypass CSP by Abusing XSS Filter in Edge
Search URL Search Domain Scan URL
Title: How I hacked companies related to the crypto currency and earned $60,000
Search URL Search Domain Scan URL
Title: How I bypassed Ebay process on redirect
Search URL Search Domain Scan URL
Title: Hijacking User’s Private Information access_token from Microsoft Office360 facebook App
Search URL Search Domain Scan URL
Title: Please email me your password
Search URL Search Domain Scan URL
Title: Jasmin Laundry
Search URL Search Domain Scan URL
Title: How I broke into Google Issue Tracker
Search URL Search Domain Scan URL
Title: Source Code Analysis in YSurvey — Luminate bug
Search URL Search Domain Scan URL
Title: Piercing the veil: Server Side Request Forgery to NIPRNet access
Search URL Search Domain Scan URL
Title: Alyssa Herrera (@Alyssa_Herrera_)
Search URL Search Domain Scan URL
Title: Stealing HttpOnly Cookie via XSS
Search URL Search Domain Scan URL
Title: Reflected XSS on www.zomato.com By Mustafa Hasan
Search URL Search Domain Scan URL
Title: “Exploiting a Single Parameter”
Search URL Search Domain Scan URL
Title: Hisham Mir (@Hishammir1)
Search URL Search Domain Scan URL
Title: Link injection on 2 Twitter Subdomain
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: How I caught Multiple vulnerabilities in Udemy.com, But not rewarded for serious XSS vulnerability :(
Search URL Search Domain Scan URL
Title: Satyendra Shrivastava
Search URL Search Domain Scan URL
Title: Facebook BugBounty: Intercept incoming friend requests of Victim add/accept to your facebook account
Search URL Search Domain Scan URL
Title: My Best Small Report Bounty Report in Private Program ( Django REST framework Admin Login ByPass )
Search URL Search Domain Scan URL
Title: XSS in Yahoo Subdomain
Search URL Search Domain Scan URL
Title: XSS In sports.tw.campaign.yahoo.net
Search URL Search Domain Scan URL
Title: How I hacked one cryptocurrency service
Search URL Search Domain Scan URL
Title: How I Could Have Promoted Any Facebook Page For Free.
Search URL Search Domain Scan URL
Title: View Insights for Any Facebook Marketplace Product
Search URL Search Domain Scan URL
Title: Creating Test Conversion using any App
Search URL Search Domain Scan URL
Title: Google bug bounty for security exploit that influences search results
Search URL Search Domain Scan URL
Title: Reflected XSS Moogaloop SWF ( Version < 6.2.x )
Search URL Search Domain Scan URL
Title: Misconfiguration of Demographics Privacy in a Page
Search URL Search Domain Scan URL
Title: #BugBounty — Rewarded by securing vulnerabilities in Bookmyshow (India’s largest online movie & event booking portal)
Search URL Search Domain Scan URL
Title: Hacking Oracle in 5 Minutes
Search URL Search Domain Scan URL
Title: Google adwords 3133.7$ Stored XSS
Search URL Search Domain Scan URL
Title: Emad Shanab
Search URL Search Domain Scan URL
Title: Leaking WordPress CSRF Tokens for Fun, $1337 bounty, and CVE-2017-5489
Search URL Search Domain Scan URL
Title: #BugBounty — “Let me reset your password and login into your account “-How I was able to Compromise any User Account via Reset Password Functionality
Search URL Search Domain Scan URL
Title: Dox Facebook Employees Behind “Did You Know” Questions
Search URL Search Domain Scan URL
Title: Union Based Sql injection Write up ->A private Company Site
Search URL Search Domain Scan URL
Title: How I hacked 74k users of a website.
Search URL Search Domain Scan URL
Title: Getting any Facebook user’s friend list and partial payment card details
Search URL Search Domain Scan URL
Title: Josip Franjkovic
Search URL Search Domain Scan URL
Title: Stored XSS, and SSRF in Google using the Dataset Publishing Language
Search URL Search Domain Scan URL
Title: Clickjackings in Google worth 12644.7$
Search URL Search Domain Scan URL
Title: Facebook Bug Bounty Reports
Search URL Search Domain Scan URL
Title: #BugBounty — How I could book cab using your wallet money in India’s largest auto transportation company!
Search URL Search Domain Scan URL
Title: How I found A Surprising XSS Vulnerability on Oracle NetSuite ?
Search URL Search Domain Scan URL
Title: The 2.5mins or 2.5k$ hawk-eye bug – A Facebook Pages Admins Disclosure Vulnerability!
Search URL Search Domain Scan URL
Title: Re-dressing Instagram – Leaking Application Tokens via Instagram ClickJacking Vulnerability!
Search URL Search Domain Scan URL
Title: How i Hacked into a bugcrowd. public program
Search URL Search Domain Scan URL
Title: #BugBounty — API keys leakage, Source code disclosure in India’s largest e-commerce health care company.
Search URL Search Domain Scan URL
Title: How I was able to delete any image in Facebook community question forum
Search URL Search Domain Scan URL
Title: Bypassing Google’s authentication to access their Internal Admin panels
Search URL Search Domain Scan URL
Title: Vishnu Prasad P G
Search URL Search Domain Scan URL
Title: The Fuzz…The Bug..The Action – A Race Condition bug in Facebook Chat Groups leads to spy on conversations!
Search URL Search Domain Scan URL
Title: Modifying any Ad Space and Placement
Search URL Search Domain Scan URL
Title: POODLE SSLv3 bug on multiple twitter smtp servers
Search URL Search Domain Scan URL
Title: Google bugs stories and the shiny pixelbook.
Search URL Search Domain Scan URL
Title: How I hacked Tinder accounts using Facebook’s Account Kit and earned $6,250 in bounties
Search URL Search Domain Scan URL
Title: Exploiting CORS Miss configuration using XSS
Search URL Search Domain Scan URL
Title: Noman Shaikh
Search URL Search Domain Scan URL
Title: #BugBounty — Exploiting CRLF Injection can lands into a nice bounty
Search URL Search Domain Scan URL
Title: How I was able to remotely crash any android user’s instagram app and was paid a mere 500$ for it.
Search URL Search Domain Scan URL
Title: #BugBounty — “How I was able to shop for free!”- Payment Price Manipulation
Search URL Search Domain Scan URL
Title: Oracle Cross Site Scripting Vulnerability -Adesh Kolte
Search URL Search Domain Scan URL
Title: Stored XSS on Snapchat
Search URL Search Domain Scan URL
Title: Mrityunjoy
Search URL Search Domain Scan URL
Title: I figured out a way to hack any of Facebook’s 2 billion accounts, and they paid me a $15,000 bounty for it
Search URL Search Domain Scan URL
Title: Taking over Facebook accounts using Free Basics partner portal
Search URL Search Domain Scan URL
Title: Bug bounty left over (and rant) Part III (Google and Twitter)
Search URL Search Domain Scan URL
Title: How I gained access to Sony’s database
Search URL Search Domain Scan URL
Title: SQL injection with load file and into outfile
Search URL Search Domain Scan URL
Title: How I found IDOR on Twitter’s Acquisition – Mopub.com
Search URL Search Domain Scan URL
Title: Facebook mailto injection leads to social engineering & spam attack
Search URL Search Domain Scan URL
Title: #BugBounty — ”I don’t need your current password to login into your account” - How could I completely takeover any user’s account in an online classified ads company.
Search URL Search Domain Scan URL
Title: Hunting Insecure Direct Object Reference Vulnerabilities for Fun and Profit (PART 2)
Search URL Search Domain Scan URL
Title: Hunting Insecure Direct Object Reference Vulnerabilities for Fun and Profit (PART-1)
Search URL Search Domain Scan URL
Title: Internal IPs disclosure
Search URL Search Domain Scan URL
Title: How I was able to Bypass XSS Protection on HackerOne’s Private Program
Search URL Search Domain Scan URL
Title: Getting access to prompt debug dialog and serialized tool on main website facebook.com
Search URL Search Domain Scan URL
Title: How I was able to Download Any file from Web server!
Search URL Search Domain Scan URL
Title: How I got 22000$ worth ethereum
Search URL Search Domain Scan URL
Title: Shubham Gupta
Search URL Search Domain Scan URL
Title: JSON CSRF attack on a Social Networking Site[Hackerone Platform]
Search URL Search Domain Scan URL
Title: Here’s how I could’ve ridden for free with Uber
Search URL Search Domain Scan URL
Title: Full Account Takeover through CORS with connection Sockets
Search URL Search Domain Scan URL
Title: [Yahoo Bug Bounty] Unauthorized Access to Unisphere Management Server Debugging Facility on https://bf1-uaddbcx-002.data.bf1.yahoo.com/Debug/
Search URL Search Domain Scan URL
Title: No RCE? Then SSH to the box!
Search URL Search Domain Scan URL
Title: Reflected XSS + Possible Server Side Template Injection in HubSpot CMS ( All Websites Uses HubSpot was affected )
Search URL Search Domain Scan URL
Title: #BugBounty @ Linkedln-How I was able to bypass Open Redirection Protection
Search URL Search Domain Scan URL
Title: Asus Cross Site Scrpting And Directory Listing Vulnerability
Search URL Search Domain Scan URL
Title: File Disclosure via .DS_Store file (macOS)
Search URL Search Domain Scan URL
Title: Internshala Bug in Internshala Student Partner
Search URL Search Domain Scan URL
Title: Reflected File Download ( RFD ) in www.Google.com
Search URL Search Domain Scan URL
Title: $1800 in less than an hour.
Search URL Search Domain Scan URL
Title: Reflected XSS via AngularJS Template Injection
Search URL Search Domain Scan URL
Title: #BugBounty — AWS S3 added to my “Bucket” list!
Search URL Search Domain Scan URL
Title: View the bug subscriptions for any Oculus User
Search URL Search Domain Scan URL
Title: Hacking Facebook accounts using CSRF in Oculus-Facebook integration
Search URL Search Domain Scan URL
Title: #BugBounty — How I was able to delete anyone’s account in an Online Car Rental Company
Search URL Search Domain Scan URL
Title: Google Tez XSS
Search URL Search Domain Scan URL
Title: #BugBounty — How I was able to read chat of users in an Online travel portal
Search URL Search Domain Scan URL
Title: RCE Vulnerabilite in Yahoo Subdomain! ( Yahoo! RCE via Spring Engine SSTI ) By tghawkins
Search URL Search Domain Scan URL
Title: Hunting Insecure Direct Object Reference Vulnerabilities for Fun and Profit (PART-1)
Search URL Search Domain Scan URL
Title: F**k you Thomas” - ToyTalk bug bounty writeup
Search URL Search Domain Scan URL
Title: Content Injection in DuoLingo’s TinyCards App for Android [CVE-2017-16905]
Search URL Search Domain Scan URL
Title: Abusing internal API to achieve IDOR in New Relic
Search URL Search Domain Scan URL
Title: Stealing $10,000 Yahoo Cookies!
Search URL Search Domain Scan URL
Title: How I found SSRF on TheFacebook.com
Search URL Search Domain Scan URL
Title: Jumping to the hell with 10 attempts to bypass devil’s WAF
Search URL Search Domain Scan URL
Title: Microsoft SharePoint’s ‘Follow’ Feature XSS (CVE-2017–8514) -Adesh Kolte
Search URL Search Domain Scan URL
Title: Account Takeover Due to Misconfigured Login with Facebook/Google
Search URL Search Domain Scan URL
Title: P4 to P2 - The story of one blind SSRF
Search URL Search Domain Scan URL
Title: Unrestricted File Upload to RCE | Bug Bounty POC
Search URL Search Domain Scan URL
Title: Don’t Trust the Host Header for Sending Password Reset Emails
Search URL Search Domain Scan URL
Title: Jack Cable
Search URL Search Domain Scan URL
Title: How I was able to takeover Facebook account
Search URL Search Domain Scan URL
Title: Using App Ads Helper as an Analytic User
Search URL Search Domain Scan URL
Title: Bug Bounty: Fastmail
Search URL Search Domain Scan URL
Title: How I Was Able To See The Bounty Balance Of Any Bug Bounty Program In HackerOne
Search URL Search Domain Scan URL
Title: Cj Legacion
Search URL Search Domain Scan URL
Title: Getting a RCE — CTF Way
Search URL Search Domain Scan URL
Title: DEV XSS Protection bypass made my quickest bounty ever!!
Search URL Search Domain Scan URL
Title: LFI to Command Execution: Deutche Telekom Bug Bounty
Search URL Search Domain Scan URL
Title: Image removal vulnerability in Facebook polling feature
Search URL Search Domain Scan URL
Title: Story of bypassing Referer Header to make open redirect
Search URL Search Domain Scan URL
Title: Taking note: XSS to RCE in the Simplenote Electron client
Search URL Search Domain Scan URL
Title: Yasin Soliman (@SecurityYasin)
Search URL Search Domain Scan URL
Title: Amazon Bypass Open Redirect
Search URL Search Domain Scan URL
Title: VMware Official VCDX Reflected XSS
Search URL Search Domain Scan URL
Title: UBER Wildcard Subdomain Takeover | BugBounty POC
Search URL Search Domain Scan URL
Title: Account Take Over Vulnerability in Google acquisition [Famebit]
Search URL Search Domain Scan URL
Title: Hassan Khan Yusufzai
Search URL Search Domain Scan URL
Title: Transforming a Domain into the Matrix (an open redirect story)
Search URL Search Domain Scan URL
Title: SQL in everywhere.
Search URL Search Domain Scan URL
Title: Why I walked away from $30,000 of DJI bounty money
Search URL Search Domain Scan URL
Title: Kevin Finisterre
Search URL Search Domain Scan URL
Title: Bypassing Crossdomain Policy and Hit Hundreds of Top Alexa Sites
Search URL Search Domain Scan URL
Title: How signing up for an account with an @company.com email can have unexpected results
Search URL Search Domain Scan URL
Title: How I Pwned a company using IDOR & Blind XSS
Search URL Search Domain Scan URL
Title: Osama Ansari
Search URL Search Domain Scan URL
Title: From Recon to DOM-Based XSS
Search URL Search Domain Scan URL
Title: Stealing bitcoin wallet backups from blockchain.info
Search URL Search Domain Scan URL
Title: How to delete all company progress by one “rm” command in AWS s3 Buckets
Search URL Search Domain Scan URL
Title: Local File Read via XSS in Dynamically Generated PDF
Search URL Search Domain Scan URL
Title: From SSRF to Local File Disclosure
Search URL Search Domain Scan URL
Title: Get your Microsoft account hijacked by simply clicking connect button -Adesh Kolte
Search URL Search Domain Scan URL
Title: Open redirect in informatica (BugBounty)
Search URL Search Domain Scan URL
Title: Multiple Intel Vulnerabilities-Adesh Kolte
Search URL Search Domain Scan URL
Title: Non-persistent XSS at Microsoft -Adesh Kolte
Search URL Search Domain Scan URL
Title: CRLF injection in blockchain.info
Search URL Search Domain Scan URL
Title: Accessing Localhost via Vhost
Search URL Search Domain Scan URL
Title: Senstive Information Leak Lead To join any Organisation
Search URL Search Domain Scan URL
Title: [Facebook Bug Bounty] How I was able to enumerate Instagram Accounts who had enabled 2FA (Two Step Verification) for additional protection
Search URL Search Domain Scan URL
Title: App Maker and Colaboratory: a stored Google XSS double-bill
Search URL Search Domain Scan URL
Title: How I hacked Google’s bug tracking system itself for $15,600 in bounties
Search URL Search Domain Scan URL
Title: Abusing new Claps feature in Medium
Search URL Search Domain Scan URL
Title: Sai Krishna Kothapalli
Search URL Search Domain Scan URL
Title: Slack SAML authentication bypass
Search URL Search Domain Scan URL
Title: How i found an SSRF in Yahoo! Guesthouse (Recon Wins)
Search URL Search Domain Scan URL
Title: Taking over every Ad on OLX (automated), an IDOR story
Search URL Search Domain Scan URL
Title: Roderick Schaefer
Search URL Search Domain Scan URL
Title: Sensitive data exposure by requesting a resource with a different content type
Search URL Search Domain Scan URL
Title: Yogendra Jaiswal (Vulnholic)
Search URL Search Domain Scan URL
Title: How I hacked all the [REDACT] Agents accounts
Search URL Search Domain Scan URL
Title: Neeraj Sonaniya
Search URL Search Domain Scan URL
Title: Reading Internal Files using SSRF vulnerability
Search URL Search Domain Scan URL
Title: DOM XSS – auth.uber.com
Search URL Search Domain Scan URL
Title: How I was Able to see someone’s all private files with a single file share link through Atom feed & Never Give Up #togetherwehitharder HackerOne
Search URL Search Domain Scan URL
Title: Leaking Amazon.com CSRF Tokens Using Service Worker API
Search URL Search Domain Scan URL
Title: Bugcrowd’s Domain & Subdomain Takeover vulnerability!
Search URL Search Domain Scan URL
Title: Exploiting Insecure Cross Origin Resource Sharing ( CORS ) | api.artsy.net
Search URL Search Domain Scan URL
Title: Artsy
Search URL Search Domain Scan URL
Title: Subdomain Takeover Through Expired Cloudfront Distribution
Search URL Search Domain Scan URL
Title: Lamborghini
Search URL Search Domain Scan URL
Title: Facebook GraphQL CSRF
Search URL Search Domain Scan URL
Title: How I Was Able To View Private Tweets Of Any Private Twitter Account
Search URL Search Domain Scan URL
Title: How I could have mass uploaded from every Flickr account!
Search URL Search Domain Scan URL
Title: Jazzy (@ret2got)
Search URL Search Domain Scan URL
Title: Device Authorization Bypass!
Search URL Search Domain Scan URL
Title: Filter Bypass to Reflected XSS on https://finance.yahoo.com (mobile version)
Search URL Search Domain Scan URL
Title: 900$ XSS in yahoo ( Recon Wins )
Search URL Search Domain Scan URL
Title: How i bypassed Practo’s firewall and triggered a XSS.
Search URL Search Domain Scan URL
Title: Vipin Chaudhary
Search URL Search Domain Scan URL
Title: IDOR – Execute JavaScript into anyone account
Search URL Search Domain Scan URL
Title: Stored XSS to Full Information disclosure
Search URL Search Domain Scan URL
Title: Luminate Internal Privilege Escalation — Admin to Owner
Search URL Search Domain Scan URL
Title: All About Hackerone Private Program Terapeak
Search URL Search Domain Scan URL
Title: This domain is my domain — G Suite A record vulnerability
Search URL Search Domain Scan URL
Title: Multiple vulnerabilities in Oracle EBS
Search URL Search Domain Scan URL
Title: First bounty, time to step up my game
Search URL Search Domain Scan URL
Title: Exploiting a Single Request for Multiple Vulnerabilities
Search URL Search Domain Scan URL
Title: Story of a Parameter Specific XSS!
Search URL Search Domain Scan URL
Title: Chaining Self XSS with UI Redressing is Leading to Session Hijacking (PWN users like a boss)
Search URL Search Domain Scan URL
Title: Stored XSS] with arbitrary cookie installation
Search URL Search Domain Scan URL
Title: Arbaz Hussain
Search URL Search Domain Scan URL
Title: URL Whitelist Bypass - Accounts Google (accounts.google.com) - VRP
Search URL Search Domain Scan URL
Title: Manuel Sousa (@manuelvsousa)
Search URL Search Domain Scan URL
Title: How I hacked hundreds of companies through their helpdesk
Search URL Search Domain Scan URL
Title: Bypassing Facebook Profile Picture Guard Security.
Search URL Search Domain Scan URL
Title: Phishing with history.back() open redirect
Search URL Search Domain Scan URL
Title: Reflective XSS and Open Redirect on Indeed.com subdomain
Search URL Search Domain Scan URL
Title: Syntax Error
Search URL Search Domain Scan URL
Title: How I found Reflective XSS in Yahoo Subdomain
Search URL Search Domain Scan URL
Title: IDOR on HackerOne Hacker Review “What Program Say”
Search URL Search Domain Scan URL
Title: Japz Divino
Search URL Search Domain Scan URL
Title: Don’t just alert(1) , Because XSS is for fun…!!
Search URL Search Domain Scan URL
Title: My write up about UBER Cross-site scripting by help of KNOXSS
Search URL Search Domain Scan URL
Title: Stealing 0Auth Token (MITM)
Search URL Search Domain Scan URL
Title: Reflected XSS in Yahoo!
Search URL Search Domain Scan URL
Title: Uber XSS via Cookie
Search URL Search Domain Scan URL
Title: Luminate Store Basics defacement and potential takeover
Search URL Search Domain Scan URL
Title: Developer Luminate IDOR
Search URL Search Domain Scan URL
Title: Developer Luminate IDOR
Search URL Search Domain Scan URL
Title: Luminate Store Basics defacement and potential takeover
Search URL Search Domain Scan URL
Title: Improper Storage of Private Project’s Files
Search URL Search Domain Scan URL
Title: Bypassing Rate Limit Protection by spoofing originating IP
Search URL Search Domain Scan URL
Title: Upgrade from LFI to RCE via PHP Sessions
Search URL Search Domain Scan URL
Title: Pre-domain wildcard CORS Exploitation
Search URL Search Domain Scan URL
Title: Facebook stories disclose Facebook friend list
Search URL Search Domain Scan URL
Title: Password Not Provided - Compromising Any Flurry User’s Account [Yahoo Bug Bounty]
Search URL Search Domain Scan URL
Title: Accidentally typo to bypass administration access
Search URL Search Domain Scan URL
Title: Reflected XSS on www.yahoo.com
Search URL Search Domain Scan URL
Title: Chain the vulnerabilities and take your report impact on the moon (CSRF to HTML INJECTION which results OPEN REDIRECT and could steal USER CREDENTIALS)
Search URL Search Domain Scan URL
Title: Armaan Patha
Search URL Search Domain Scan URL
Title: Getting access to 25k employees details
Search URL Search Domain Scan URL
Title: Sahil Ahamad
Search URL Search Domain Scan URL
Title: How to confirm a Google user’s specific email address (Bug Bounty Submission)
Search URL Search Domain Scan URL
Title: XSS Because of wrong Content-type Header
Search URL Search Domain Scan URL
Title: Business Logic Vulnerabilities Series: How I became invisible and immune to blocking on Instagram!
Search URL Search Domain Scan URL
Title: Ali Kabeel
Search URL Search Domain Scan URL
Title: How i found massive information disclosure of 1500 famous people
Search URL Search Domain Scan URL
Title: Referer Based XSS
Search URL Search Domain Scan URL
Title: How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE!
Search URL Search Domain Scan URL
Title: How we invented the Tesla DOM DOOM XSS
Search URL Search Domain Scan URL
Title: Detectify Labs
Search URL Search Domain Scan URL
Title: Disabling New Emails From Facebook Without Email Owner Interaction
Search URL Search Domain Scan URL
Title: Rolling around and Bypassing Facebook’s Linkshim protection on iOS
Search URL Search Domain Scan URL
Title: Stored XSS on Rockstar Game
Search URL Search Domain Scan URL
Title: Open Redirect In Flock | My First Swag pack
Search URL Search Domain Scan URL
Title: May the Shells be with You - A Star Wars RCE Adventure!
Search URL Search Domain Scan URL
Title: Andy Gill
Search URL Search Domain Scan URL
Title: How i was able to bypass strong xss protection in well known website. (imgur.com)
Search URL Search Domain Scan URL
Title: Missing Authorization check in Facebook Pages Manager
Search URL Search Domain Scan URL
Title: Race Condition bypassing team limit
Search URL Search Domain Scan URL
Title: Self XSS to Good XSS Clickjacking
Search URL Search Domain Scan URL
Title: Business Logic Vulnerabilities Series: A brief on Abusing Invitation Systems
Search URL Search Domain Scan URL
Title: That Escalated Quickly : From partial CSRF to reflected XSS to complete CSRF to Stored XSS
Search URL Search Domain Scan URL
Title: Xss using dynamically generated js file
Search URL Search Domain Scan URL
Title: Exploiting Misconfigured CORS on popular BTC Site
Search URL Search Domain Scan URL
Title: Stealing Access Token of One-drive Integration By Chaining CSRF Vulnerability
Search URL Search Domain Scan URL
Title: IDOR While Connecting Social Account in Hackster.io
Search URL Search Domain Scan URL
Title: Bypassing XSS Filtering at Anchor Tag
Search URL Search Domain Scan URL
Title: ctrl+c & ctrl+v to Steal SESSIONID
Search URL Search Domain Scan URL
Title: How to find internal subdomains? YQL, Yahoo! and bug bounty.
Search URL Search Domain Scan URL
Title: Hey UserID x, what’s your secret token? Broken API enables me to leak/modify any users personal information
Search URL Search Domain Scan URL
Title: Fabric.io API permission apocalypse – Privilege Escalations
Search URL Search Domain Scan URL
Title: wesecureapp
Search URL Search Domain Scan URL
Title: How we tookover shopify accounts with one single click
Search URL Search Domain Scan URL
Title: XSS by tossing cookies
Search URL Search Domain Scan URL
Title: How a simple IDOR become a $4K User Impersonation vulnerability
Search URL Search Domain Scan URL
Title: Shahmeer Amir (@Shahmeer_Amir)
Search URL Search Domain Scan URL
Title: Coinbase AngularJS DOM XSS via Kiteworks
Search URL Search Domain Scan URL
Title: Medium Content Spoofing Leads to XSS
Search URL Search Domain Scan URL
Title: Managed Apps and Music: a tale of two XSSes in Google Play
Search URL Search Domain Scan URL
Title: Making an XSS triggered by CSP bypass on Twitter.
Search URL Search Domain Scan URL
Title: OpenProject Session Management Security Vulnerability aka CVE-2017-11667
Search URL Search Domain Scan URL
Title: Posting on groups as people whenever their email was known by an attacker
Search URL Search Domain Scan URL
Title: Escalating XSS in PhantomJS Image Rendering to SSRF/Local-File Read
Search URL Search Domain Scan URL
Title: Brett Buerhaus
Search URL Search Domain Scan URL
Title: CVE-2017-10711: Reflected XSS vulnerability in SimpleRisk – Open Source Risk Management System
Search URL Search Domain Scan URL
Title: Road to (unauthenticated) recovery: downloading GitHub SSO bypass codes
Search URL Search Domain Scan URL
Title: Authentication bypass on Uber’s Single Sign-On via subdomain takeover
Search URL Search Domain Scan URL
Title: Arne Swinnen
Search URL Search Domain Scan URL
Title: Stored XSS in the heart of the Russian email provider giant (Mail.ru)
Search URL Search Domain Scan URL
Title: Yahoo Small Business (Luminate) and the Not-So-Secret Keys
Search URL Search Domain Scan URL
Title: Tommy DeVoss / dawgyg (@thedawgyg)
Search URL Search Domain Scan URL
Title: How I Built An XSS Worm On Atmail
Search URL Search Domain Scan URL
Title: Authentication bypass on Airbnb via OAuth tokens theft
Search URL Search Domain Scan URL
Title: How I hacked 23.900.000 tumblr domains at once :)
Search URL Search Domain Scan URL
Title: XSS on Bugcrowd and so many other website’s main Domain
Search URL Search Domain Scan URL
Title: Bull
Search URL Search Domain Scan URL
Title: Vulnerability in Metasploit Project aka CVE-2017-5244
Search URL Search Domain Scan URL
Title: Godaddy XSS affects parked domains redirector/processor!
Search URL Search Domain Scan URL
Title: Let’s steal some tokens!
Search URL Search Domain Scan URL
Title: WHATSAPP — DOS VULNERABILITY IN IOS & ANDROID
Search URL Search Domain Scan URL
Title: From JS to another JS files lead to authentication bypass
Search URL Search Domain Scan URL
Title: How I got 5500$ from Yahoo for RCE
Search URL Search Domain Scan URL
Title: Django Privilege Escalation – Zero To Superuser
Search URL Search Domain Scan URL
Title: Sean Melia
Search URL Search Domain Scan URL
Title: XSS on Google{5.000$}-Google Vulnerability Reward Program (VRP)
Search URL Search Domain Scan URL
Title: Pivoting from blind SSRF to RCE with HashiCorp Consul
Search URL Search Domain Scan URL
Title: Peter Adkins
Search URL Search Domain Scan URL
Title: A pair of Plotly bugs: Stored XSS and AWS Metadata SSRF
Search URL Search Domain Scan URL
Title: Hacking the NHS for Fun and No Profit
Search URL Search Domain Scan URL
Title: One Cloud-based Local File Inclusion = Many Companies affected
Search URL Search Domain Scan URL
Title: Francisco Correa (@panchocosil)
Search URL Search Domain Scan URL
Title: Find Mingle Suggestions for any Facebook User (Revisited)
Search URL Search Domain Scan URL
Title: I got emails — G Suite Vulnerability
Search URL Search Domain Scan URL
Title: AWS S3 bucket misconfiguration - Paytm
Search URL Search Domain Scan URL
Title: Inspect Element leads to Stripe Account Lockout Authentication Bypass
Search URL Search Domain Scan URL
Title: Airbnb – Web to App Phone Notification IDOR to view Everyone’s Airbnb Messages
Search URL Search Domain Scan URL
Title: Hundreds of hundreds sub-secdomains hack3d! (including Hacker0ne)
Search URL Search Domain Scan URL
Title: Critical information disclosure on Wappalyzer.com
Search URL Search Domain Scan URL
Title: Near universal XSS in McAfee Web Gateway
Search URL Search Domain Scan URL
Title: Penetrating PornHub – XSS vulns galore (plus a cool shirt!)
Search URL Search Domain Scan URL
Title: Airbnb – Ruby on Rails String Interpolation led to Remote Code Execution
Search URL Search Domain Scan URL
Title: How I found a $5,000 Google Maps XSS (by fiddling with Protobuf)
Search URL Search Domain Scan URL
Title: Airbnb – Chaining Third-Party Open Redirect into Server-Side Request Forgery (SSRF) via LivePerson Chat
Search URL Search Domain Scan URL
Title: Airbnb – When Bypassing JSON Encoding, XSS Filter, WAF, CSP, and Auditor turns into Eight Vulnerabilities
Search URL Search Domain Scan URL
Title: Ok Google, Give Me All Your Internal DNS Information!
Search URL Search Domain Scan URL
Title: Hacking Slack using postMessage and WebSocket-reconnect to steal your precious token
Search URL Search Domain Scan URL
Title: Frans Rosén
Search URL Search Domain Scan URL
Title: How I got your phone number through Facebook
Search URL Search Domain Scan URL
Title: How I bypassed State Bank of India OTP.
Search URL Search Domain Scan URL
Title: How I was able to remove your Instagram Phone number
Search URL Search Domain Scan URL
Title: From RSS to XXE: feed parsing on Hootsuite
Search URL Search Domain Scan URL
Title: SQL injection in an UPDATE query - a bug bounty story!
Search URL Search Domain Scan URL
Title: Lightweight markup: a trio of persistent XSS in GitLab
Search URL Search Domain Scan URL
Title: Vulnerabilities in Facebook Login Approval Form
Search URL Search Domain Scan URL
Title: Facebook Account Recovery Form (CONFLICTING)
Search URL Search Domain Scan URL
Title: Bypassed Facebook Phone Number Security
Search URL Search Domain Scan URL
Title: This domain is my domain - G Suite A record vulnerability
Search URL Search Domain Scan URL
Title: White Hats - Nepal
Search URL Search Domain Scan URL
Title: Facebook Groups Hack
Search URL Search Domain Scan URL
Title: Cross Site Request Forgery in Facebook
Search URL Search Domain Scan URL
Title: I got emails - G Suite Vulnerability
Search URL Search Domain Scan URL
Title: 12k$ for simple path traversal on http://web.whatsapp.com
Search URL Search Domain Scan URL
Title: How I could have compromised any account on one of the biggest startup based in California
Search URL Search Domain Scan URL
Title: 0day writeup: XXE in uber.com
Search URL Search Domain Scan URL
Title: How I could have Hacked IIT Guwahati’s website
Search URL Search Domain Scan URL
Title: My first bug on @facebook bug bounty program.
Search URL Search Domain Scan URL
Title: IDOR in Facebook’s Acquisition (Parse)
Search URL Search Domain Scan URL
Title: Venkatesh Sivakumar
Search URL Search Domain Scan URL
Title: The Orphaned Internet – Taking Over 120K Domains via a DNS Vulnerability in AWS, Google Cloud, Rackspace and Digital Ocean
Search URL Search Domain Scan URL
Title: Authentication bypass on Ubiquity’s Single Sign-On via subdomain takeover
Search URL Search Domain Scan URL
Title: Bypassing Ebay XSS Protection to launch XSS by Nirmal Dahal
Search URL Search Domain Scan URL
Title: Svg XSS in Unifi v5.0.2
Search URL Search Domain Scan URL
Title: Stored XSS in UniFi v4.8.12 Controller
Search URL Search Domain Scan URL
Title: Rewriting a photo not owned by the session user in Moments App (Revisited)
Search URL Search Domain Scan URL
Title: Leak Private Videos [Vimeo Bug Bounty]
Search URL Search Domain Scan URL
Title: Open Redirect Scanner with Uber.com
Search URL Search Domain Scan URL
Title: Command Injection Without Spaces
Search URL Search Domain Scan URL
Title: gif it time it’ll come to you - Finding More Holes in The Hub
Search URL Search Domain Scan URL
Title: Persisting on Pornhub
Search URL Search Domain Scan URL
Title: Link Injection Manipulation at admin.google.com
Search URL Search Domain Scan URL
Title: Vine Re-auth Bypass [Twitter Bug Bounty]
Search URL Search Domain Scan URL
Title: Bug Bounty : Account Takeover Vulnerability POC
Search URL Search Domain Scan URL
Title: Rakesh Mane
Search URL Search Domain Scan URL
Title: How I snooped into your private Slack messages [Slack Bug bounty worth $2,500]
Search URL Search Domain Scan URL
Title: Decoding a $😱,000.00 htpasswd bounty
Search URL Search Domain Scan URL
Title: Internet Explorer has a URL problem
Search URL Search Domain Scan URL
Title: File Descriptor
Search URL Search Domain Scan URL
Title: Reading Uber’s Internal Emails [Uber Bug Bounty report worth $10,000]
Search URL Search Domain Scan URL
Title: RCE In AddThis
Search URL Search Domain Scan URL
Title: PornHub: Email Confirmation Bypass
Search URL Search Domain Scan URL
Title: Vaxo Dai (@___0x00)
Search URL Search Domain Scan URL
Title: Turning Self-XSS into Good XSS v2: Challenge Completed but Not Rewarded
Search URL Search Domain Scan URL
Title: [demo.paypal.com] Node.js code injection (RCE)
Search URL Search Domain Scan URL
Title: Swf XSS (Dom Based Xss)
Search URL Search Domain Scan URL
Title: Xss filter bypass in Yahoo dev.flurry.com
Search URL Search Domain Scan URL
Title: XSS on Flickr
Search URL Search Domain Scan URL
Title: CSV Injection -> Meterpreter on Pornhub
Search URL Search Domain Scan URL
Title: Messenger.com Site-Wide CSRF
Search URL Search Domain Scan URL
Title: Jack Whitton
Search URL Search Domain Scan URL
Title: BMW Vulnerabilities – Hijack Cars ConnectedDrive™ Service!
Search URL Search Domain Scan URL
Title: Remote Code Execution (RCE) on Microsoft’s ‘signout.live.com’
Search URL Search Domain Scan URL
Title: How we broke PHP, hacked Pornhub and earned $20,000
Search URL Search Domain Scan URL
Title: Ruslan Habalov
Search URL Search Domain Scan URL
Title: cutz
Search URL Search Domain Scan URL
Title: Dario Weißer
Search URL Search Domain Scan URL
Title: Twitter’s Vine Source code dump - $10080
Search URL Search Domain Scan URL
Title: @avicoder
Search URL Search Domain Scan URL
Title: Stealing Facebook access_tokens using CSRF in device login flow
Search URL Search Domain Scan URL
Title: How I Could Steal Money from Instagram, Google and Microsoft
Search URL Search Domain Scan URL
Title: Race conditions on the web
Search URL Search Domain Scan URL
Title: TopCoder.com Vulnerabilities – A tail of site-wide bugs leads to accounts compromise & payments hijacking
Search URL Search Domain Scan URL
Title: Uber Hacking: How we found out who you are, where you are and where you went
Search URL Search Domain Scan URL
Title: Vitor “r0t” Oliveira (@r0t1v)
Search URL Search Domain Scan URL
Title: Medium Full Account Takeover By One Click
Search URL Search Domain Scan URL
Title: Two vulnerabilities makes an Exploit!! (XSS and CSRF in Bing)
Search URL Search Domain Scan URL
Title: Why you shouldn’t share links on Facebook
Search URL Search Domain Scan URL
Title: Popping the Pornhub Cherry
Search URL Search Domain Scan URL
Title: RunKeeper Stored XSS Vulnerability – Where worms are able to run too!
Search URL Search Domain Scan URL
Title: InstaBrute: Two Ways to Brute-force Instagram Account Credentials
Search URL Search Domain Scan URL
Title: Microsoft Yammer Clickjacking – Exploiting HTML5 Security Features
Search URL Search Domain Scan URL
Title: When your privacy disclosure is a “feature” not a “bug” – Badoo & HotorNot failure!
Search URL Search Domain Scan URL
Title: Sleeping stored Google XSS Awakens a $5000 Bounty
Search URL Search Domain Scan URL
Title: How I bypassed Facebook CSRF once again!
Search URL Search Domain Scan URL
Title: Facebook Vulnerability – a “Cute Bug” that reveals the “likes” of deleted posts regardless of their privacy settings
Search URL Search Domain Scan URL
Title: Mohamed Aty
Search URL Search Domain Scan URL
Title: Fiverr.com Full Accounts Takeover – A Vulnerability Puts $50 Million Company At Risk
Search URL Search Domain Scan URL
Title: FirefoxOS Find My Device Service Clickjacking Bug results in Changing PINs, Wiping and Locking Phones!
Search URL Search Domain Scan URL
Title: Poisoning the Well – Compromising GoDaddy Customer Support With Blind XSS
Search URL Search Domain Scan URL
Title: Facebook movies recommendation vulnerability – A bug capable of erasing all your important notifications!
Search URL Search Domain Scan URL
Title: WhatsApp Clickjacking Vulnerability – Yet another web client failure!
Search URL Search Domain Scan URL
Title: Official Telegram Web Client ClickJacking Vulnerability – When crypto is strong and client is weak
Search URL Search Domain Scan URL
Title: Facebook ClickJacking – How we put a new dress on Facebook UI
Search URL Search Domain Scan URL
Title: ESEA Server-Side Request Forgery and Querying AWS Meta Data
Search URL Search Domain Scan URL
Title: Yahoo Login Protection Seal – Stored CSS Injection
Search URL Search Domain Scan URL
Title: Facebook Invitees Email Address Disclosure
Search URL Search Domain Scan URL
Title: Obtaining Login Tokens for an Outlook, Office or Azure Account
Search URL Search Domain Scan URL
Title: How I Could Compromise 4% (Locked) Instagram Accounts
Search URL Search Domain Scan URL
Title: Uber Bug Bounty: Turning Self-XSS into Good-XSS
Search URL Search Domain Scan URL
Title: Command injection which got me “6000$” from #Google
Search URL Search Domain Scan URL
Title: SQL Injection On MEGA.NZ
Search URL Search Domain Scan URL
Title: Naresh LamGade (@nlamgade)
Search URL Search Domain Scan URL
Title: Hacking Magento eCommerce For Fun And 17.000 USD
Search URL Search Domain Scan URL
Title: Ubiquiti Bug Bounty: UniFi v3.2.10 Generic CSRF Protection Bypass
Search URL Search Domain Scan URL
Title: How I Hacked [Oculus] OAuth +Ebay +IBM
Search URL Search Domain Scan URL
Title: A Hilarious ESET Broken Authentication Vulnerability (one click free purchase)
Search URL Search Domain Scan URL
Title: How I got access to millions of [redacted] accounts
Search URL Search Domain Scan URL
Title: Bitquark
Search URL Search Domain Scan URL
Title: An XSS on Facebook via PNGs & Wonky Content Types
Search URL Search Domain Scan URL
Title: [manager.paypal.com] Remote Code Execution Vulnerability
Search URL Search Domain Scan URL
Title: Broken Access Control in bingmapsportal !!!
Search URL Search Domain Scan URL
Title: Click Jacking in bingmapsportal
Search URL Search Domain Scan URL
Title: Leaking API keys in Bing Maps Portal
Search URL Search Domain Scan URL
Title: Instagram’s Million Dollar Bug
Search URL Search Domain Scan URL
Title: Wesley Wineberg
Search URL Search Domain Scan URL
Title: Cloudflare WAF XSS
Search URL Search Domain Scan URL
Title: Open Redirect in Linkedin and Yahoo
Search URL Search Domain Scan URL
Title: XSS vulnerability in Google image search
Search URL Search Domain Scan URL
Title: XSS to RCE in …
Search URL Search Domain Scan URL
Title: Neil Hakuna Matatall
Search URL Search Domain Scan URL
Title: CVE-2014-7216: A Journey Through Yahoo’s Bug Bounty Program
Search URL Search Domain Scan URL
Title: Blind SQL Inejction [Hootsuite]
Search URL Search Domain Scan URL
Title: One Payload to XSS Them All!
Search URL Search Domain Scan URL
Title: Bypassing Google Authentication on Periscope’s Administration Panel
Search URL Search Domain Scan URL
Title: The easiest bug bounties I have ever won
Search URL Search Domain Scan URL
Title: Bypass ad account roles vulnerability 2015
Search URL Search Domain Scan URL
Title: Race conditions on Facebook, DigitalOcean and others (fixed)
Search URL Search Domain Scan URL
Title: How I bypassed Facebook CSRF Protection
Search URL Search Domain Scan URL
Title: Neglected DNS records exploited to takeover subdomains
Search URL Search Domain Scan URL
Title: Yassine Aboukir (@Yassineaboukir)
Search URL Search Domain Scan URL
Title: Google.com – Mobile Feedback URL Redirect Regex/Validation Flaw
Search URL Search Domain Scan URL
Title: Flickr API Explorer – Force users to execute any API request.
Search URL Search Domain Scan URL
Title: admin.google.com Reflected Cross-Site Scripting (XSS)
Search URL Search Domain Scan URL
Title: Yahoo – Root Access SQL Injection – tw.yahoo.com
Search URL Search Domain Scan URL
Title: Papyal XML Upload Cross Site Scripting Vulnerability
Search URL Search Domain Scan URL
Title: How I discovered a 1000$ open redirect in Facebook
Search URL Search Domain Scan URL
Title: Reflected Cross Site Scripting at Paypal.com
Search URL Search Domain Scan URL
Title: Malicious redirect on mailroom.prezi.com
Search URL Search Domain Scan URL
Title: Reading local files from Facebook’s server (fixed)
Search URL Search Domain Scan URL
Title: Google Bug Bounty: Nice Catch on Google Cloud Platform Live
Search URL Search Domain Scan URL
Title: Reflected Cross Site Scripting BillMeLater
Search URL Search Domain Scan URL
Title: Paypal stored XSS + Security bypass
Search URL Search Domain Scan URL
Title: Paypal DOM XSS main domain
Search URL Search Domain Scan URL
Title: The 5000$ Google XSS
Search URL Search Domain Scan URL
Title: Facebook Bug Bounty: secondary damage (revisited) why I really like reporting to Facebook too :)
Search URL Search Domain Scan URL
Title: Yahoo phpinfo.php disclosure
Search URL Search Domain Scan URL
Title: Step-by-step: exploiting SQL injection(s) in Oculus’ website.
Search URL Search Domain Scan URL
Title: Popping a shell on the Oculus developer portal
Search URL Search Domain Scan URL
Title: Flickr XSRF to Change Photo Details
Search URL Search Domain Scan URL
Title: Facebook – Stored Cross-Site Scripting (XSS) – Badges
Search URL Search Domain Scan URL
Title: ebay bug bounty
Search URL Search Domain Scan URL
Title: Prezi (map.prezi.com) Path Traversal
Search URL Search Domain Scan URL
Title: Magix Bug Bounty: magix.com (RCE, SQLi) and xara.com (LFI, XSS)
Search URL Search Domain Scan URL
Title: A Tale of 7 Vulnerabilities
Search URL Search Domain Scan URL
Title: iCloud XXS’ed
Search URL Search Domain Scan URL
Title: Prashanth Varma (@cymtrick)
Search URL Search Domain Scan URL
Title: Facebook – Send Notifications to any User Exploit
Search URL Search Domain Scan URL
Title: Google Exploit – Steal Account Login Email Addresses
Search URL Search Domain Scan URL
Title: Tesla Motors blind SQL injection
Search URL Search Domain Scan URL
Title: How I hacked Github again.
Search URL Search Domain Scan URL
Title: Google Sites: A Tale of Five Vulnerabilities
Search URL Search Domain Scan URL
Title: Waze arbitrary file upload
Search URL Search Domain Scan URL
Title: Imgur xss
Search URL Search Domain Scan URL
Title: Abusing CORS for an XSS on Flickr
Search URL Search Domain Scan URL
Title: Heroku Directory Transversal
Search URL Search Domain Scan URL
Title: XSS - Google Groups (groups.google.com) - Vulnerability Reward Program
Search URL Search Domain Scan URL
Title: Oracle xss
Search URL Search Domain Scan URL
Title: Instagram’s One-Click Privacy Switch
Search URL Search Domain Scan URL
Title: Nokia email app pwnage
Search URL Search Domain Scan URL
Title: LFI in Nokia maps
Search URL Search Domain Scan URL
Title: Facebook bug bounty: secondary damage (one report that leads to more bugs), fairness, and why I really like reporting to Facebook
Search URL Search Domain Scan URL
Title: Content Types and XSS: Facebook Studio
Search URL Search Domain Scan URL
Title: Facebook CSRF leading to full account takeover (fixed)
Search URL Search Domain Scan URL
Title: PayPal Bug Bounty: PayPaltech.com E-Mail Injection
Search URL Search Domain Scan URL
Title: Removing Covers Images on Friendship Pages, on Facebook
Search URL Search Domain Scan URL
Title: SQL injections in Nokia sites.
Search URL Search Domain Scan URL
Title: How I found my way into Instagram’s Ganglia, and a bug with Facebook likes.
Search URL Search Domain Scan URL
Title: Admob creative image cross-site scripting vulnerability
Search URL Search Domain Scan URL
Title: Amazon packaging feedback cross-site scripting vulnerability
Search URL Search Domain Scan URL
Title: Hijacking a Facebook Account with SMS
Search URL Search Domain Scan URL
Title: Overwriting Banner Images on Etsy
Search URL Search Domain Scan URL
Title: PayPal Bug Bounty: PayPaltech.com XSS
Search URL Search Domain Scan URL
Title: Stealing Facebook Access Tokens with a Double Submit
Search URL Search Domain Scan URL
Title: How I Rewarded with USD?K Just With a Simple Search Form
Search URL Search Domain Scan URL
Title: Framing, Part 1: Click-Jacking Etsy
Search URL Search Domain Scan URL
Title: Persistent XSS on myworld.ebay.com
Search URL Search Domain Scan URL
Title: Google.com cross site scripting and privilege escalation in Consumer Surveys
Search URL Search Domain Scan URL
Title: My Experience with the PayPal Bug Bounty Programme
Search URL Search Domain Scan URL
Title: Parameter pollution bug at twitter
Search URL Search Domain Scan URL
Title: G Suite - Device Management XSS
Search URL Search Domain Scan URL
Title: Auth Issues
Search URL Search Domain Scan URL
Title: Multiple XSS
Search URL Search Domain Scan URL
Title: Blind XSS against a Googler
Search URL Search Domain Scan URL
Title: Stored XSS on biz.waze.com
Search URL Search Domain Scan URL
Title: CSRF ‘protection’ bypass on xvideos
Search URL Search Domain Scan URL
Title: Open URL redirects to grab FB OAuth Tokens
Search URL Search Domain Scan URL
Title: XML XSS via POST
Search URL Search Domain Scan URL
Title: $10k host header
Search URL Search Domain Scan URL
Title: $7.5k Google services mix-up
Search URL Search Domain Scan URL
Title: $5k Service dependencies
Search URL Search Domain Scan URL
Title: $500 getClass
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
list-of-bug-bounty-writeups.html
pentester.land/ |
963 KB 195 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
embed.js
downloads.mailchimp.com/js/signup-forms/popup/ |
126 KB 46 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3-29 |
main.css
pentester.land/assets/css/ |
13 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
722 B 468 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3-29 |
logo.png
pentester.land/assets/img/ |
29 KB 30 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
form-settings
mc.us17.list-manage.com/subscribe/ |
1 KB 2 KB |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
analytics.js
www.google-analytics.com/ |
48 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
zOL64pLDlL1D99S8g8PtiKchq-dmjQ.woff2
fonts.gstatic.com/s/abrilfatface/v12/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H3-29 |
collect
www.google-analytics.com/j/ |
2 B 22 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
popup.js
downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ |
100 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame B422 |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
banner.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame B422 |
1005 B 942 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 052F |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
layout-1.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 052F |
804 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
modal-slidein.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ |
3 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
email-decode.min.js
pentester.land/cdn-cgi/scripts/5c5dd728/cloudflare-static/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| define function| require object| dojo object| dijit object| dojox object| dojo_request_script_callbacks string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| SignupForm function| PopupSignupForm object| parts0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
downloads.mailchimp.com
fonts.googleapis.com
fonts.gstatic.com
mc.us17.list-manage.com
pentester.land
www.google-analytics.com
23.45.110.243
2606:4700:3030::ac43:9606
2a00:1450:4001:802::200a
2a00:1450:4001:80f::200e
2a00:1450:4001:827::2003
2a00:1450:4001:82a::200e
65.9.77.85
07442f2bc9e417e7e700d142493b5564d926d3b28a365632e87f9e0a1c992b70
0d1906eaa72c65980348cfcabab49c4dac6ceb3f5e999ed42b9fbe87dfb59054
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2ace42297fe0b9f914235d39cc28f0891a2d4624476c0a1686a64e371371865c
3291d99328ace5b1bd08dddb8707ef52230db2562051d15b710e2915a0f483b9
4c69c701fd3700fca10f8e6180c9f60f9af13c943ee7f1513f4b7709d8b75d72
60defd0229880a6f78696fcf8e687f94e43fc8bb5ff66028e23e546d0345d2f1
650e65709312c691110957b8a8cc1609ac7b5685f265e1e06f389d271da4fedf
6c5a6cf8b85ac2b8c7e9e08242ac765e320456f4ad4349f852259e365b525a2b
717a079466da86282255203ddb9f6faafb2bf0ca0bb23ecb539463b3f963bde4
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
7c21826d1cb5d2a8d57fd6ac5a83f222e3c04c579cbc155618cc481cb3ce6ae6
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
bece213397fe5f546674ee29dd3f69ec2f2cc0e480e67f09dcc4c25c0d12a3d7
d846be9502c36e791fb7ad212e76ce3fe7de64226de5898d8c13c6ca9b25b437