🐛 Bug Bounty Writeup
• Raijin AI Explained | The Next Generation of AI-Powered Cybersecurity Tools: medium.com/@pentesterclub…
• The Template That Closes Real Findings: Anatomy of a CORS Dismissal: cyphernova1337.medium.com/the-template-t…
• My first AI bug report got closed within hours (and that was good for me): medium.com/@manuelfdzgo/m…
• The WAF Was Never the Wall: cyphernova1337.medium.com/the-waf-was-ne…
• Chaining an Open Redirect Into Account Takeover (P1 · CVSS 9.0): medium.com/@josekuttykunn…
• RAG Is an Injection Surface: medium.com/@vigneshkumaro…
• The Cache That Trusted a Fake Extension: masimshahzad.medium.com/the-cache-that…
• Deserialization Is 0.4% of Bounty Reports and 4% of Exploited Bugs. Both Numbers Are Right.: meetcyber.net/deserializatio…
• Smali By bithowl: Chapter 17 Method Calls: medium.com/@bithowl/smali…
• The Dangling CDN Record That Unlocked SSO: masimshahzad.medium.com/the-dangling-c…
• Raijin AI Explained | The Next Generation of AI-Powered Cybersecurity Tools: medium.com/@pentesterclub…
• The Template That Closes Real Findings: Anatomy of a CORS Dismissal: cyphernova1337.medium.com/the-template-t…
• My first AI bug report got closed within hours (and that was good for me): medium.com/@manuelfdzgo/m…
• The WAF Was Never the Wall: cyphernova1337.medium.com/the-waf-was-ne…
• Chaining an Open Redirect Into Account Takeover (P1 · CVSS 9.0): medium.com/@josekuttykunn…
• RAG Is an Injection Surface: medium.com/@vigneshkumaro…
• The Cache That Trusted a Fake Extension: masimshahzad.medium.com/the-cache-that…
• Deserialization Is 0.4% of Bounty Reports and 4% of Exploited Bugs. Both Numbers Are Right.: meetcyber.net/deserializatio…
• Smali By bithowl: Chapter 17 Method Calls: medium.com/@bithowl/smali…
• The Dangling CDN Record That Unlocked SSO: masimshahzad.medium.com/the-dangling-c…
0
4
15
1,369
🐛 Bug Bounty Writeup
• 2FA Bypass via OAuth Account Migration: sudohunt.medium.com/2fa-bypass-via…
• From Stored XSS to Forced Login via Cookie Tossing: medium.com/@vicodo/from-s…
• Wanglin Shoes — Redlimit CTF Lab: medium.com/@Mr_vndlsme/wa…
• How One AI Feature Exposed Data from Multiple Restricted Functions: medium.com/@hs942422/how-…
• Power CookieWeb Exploitation by LT ‘syreal’ Jones: medium.com/@salyhamaks/po…
• P3 — Sensitive Information Disclosure Through Verbose API Error Messages: medium.com/@akashmotkar00…
• Prompt Injection Is Not a Prompt Problem: medium.com/@vigneshkumaro…
• GPT-6 Cyber: A 51% Jump in Exploit Skill and the Rise of Specialized Cybersecurity AI: nitingavhane.medium.com/gpt-6-cyber-a-…
• From P4 to P1: Day 15 — Business Logic Vulnerabilities: Finding Flaws in Application Workflows: medium.com/@cyb3rD1vvya/f…
• How Peloton Confused Authentication with Authorization: medium.com/@l4zz3rj0d/how…
• 2FA Bypass via OAuth Account Migration: sudohunt.medium.com/2fa-bypass-via…
• From Stored XSS to Forced Login via Cookie Tossing: medium.com/@vicodo/from-s…
• Wanglin Shoes — Redlimit CTF Lab: medium.com/@Mr_vndlsme/wa…
• How One AI Feature Exposed Data from Multiple Restricted Functions: medium.com/@hs942422/how-…
• Power CookieWeb Exploitation by LT ‘syreal’ Jones: medium.com/@salyhamaks/po…
• P3 — Sensitive Information Disclosure Through Verbose API Error Messages: medium.com/@akashmotkar00…
• Prompt Injection Is Not a Prompt Problem: medium.com/@vigneshkumaro…
• GPT-6 Cyber: A 51% Jump in Exploit Skill and the Rise of Specialized Cybersecurity AI: nitingavhane.medium.com/gpt-6-cyber-a-…
• From P4 to P1: Day 15 — Business Logic Vulnerabilities: Finding Flaws in Application Workflows: medium.com/@cyb3rD1vvya/f…
• How Peloton Confused Authentication with Authorization: medium.com/@l4zz3rj0d/how…
1
16
118
5,398
Wishing everyone a bright, prosperous, and secure Diwali! 🪔✨
May the festival of lights bring boundless joy, success, and safety to you and your loved ones. Have a wonderful celebration! 🎆
🌐 securitycipher.com
#HappyDiwali #Diwali #FestivalOfLights #SecurityCipher ali
May the festival of lights bring boundless joy, success, and safety to you and your loved ones. Have a wonderful celebration! 🎆
🌐 securitycipher.com
#HappyDiwali #Diwali #FestivalOfLights #SecurityCipher ali
0
1
5
1,157
🐛 Bug Bounty Writeup
• How Bug Bounty Programs Work: A Beginner’s Guide: cybrox.medium.com/how-bug-bounty…
• The JWT Bugs That Survive ‘We Use OAuth, So We’re Secure’: medium.com/@dhirenkumar/t…
• The Permission the Consent Screen Never Mentioned: OAuth Scope Escalation Through Token Refresh: medium.com/@t4nv1/the-per…
• eWPTX Exam Review — What Actually Matters: medium.com/@mo.muwafak200…
• When OAuth Works Correctly and Security Doesn’t: A Bug in OAuth Account Linking: medium.com/@0xnexus0xfaul…
• Information Disclosure: The Bug Hunter’s Complete Guide: osintteam.blog/information-di…
• Why Rate Limiting Fails Against Distributed Attacks — and How to Build One That Holds: medium.com/@vigneshkumaro…
• SSTI2 ~ CyLab Security Academy Write-up | Server-Side Template Injection: medium.com/@affanhaxor/ss…
• Group Injection in aws-iam-authenticator: RBAC Privilege Escalation via {{SessionName}}: medium.com/@sachinpatilsp…
• From P4 to P1: Day 14 — Privilege Escalation: Finding Horizontal and Vertical Access Control…: medium.com/@cyb3rD1vvya/f…
• How Bug Bounty Programs Work: A Beginner’s Guide: cybrox.medium.com/how-bug-bounty…
• The JWT Bugs That Survive ‘We Use OAuth, So We’re Secure’: medium.com/@dhirenkumar/t…
• The Permission the Consent Screen Never Mentioned: OAuth Scope Escalation Through Token Refresh: medium.com/@t4nv1/the-per…
• eWPTX Exam Review — What Actually Matters: medium.com/@mo.muwafak200…
• When OAuth Works Correctly and Security Doesn’t: A Bug in OAuth Account Linking: medium.com/@0xnexus0xfaul…
• Information Disclosure: The Bug Hunter’s Complete Guide: osintteam.blog/information-di…
• Why Rate Limiting Fails Against Distributed Attacks — and How to Build One That Holds: medium.com/@vigneshkumaro…
• SSTI2 ~ CyLab Security Academy Write-up | Server-Side Template Injection: medium.com/@affanhaxor/ss…
• Group Injection in aws-iam-authenticator: RBAC Privilege Escalation via {{SessionName}}: medium.com/@sachinpatilsp…
• From P4 to P1: Day 14 — Privilege Escalation: Finding Horizontal and Vertical Access Control…: medium.com/@cyb3rD1vvya/f…
4
19
147
7,331
🐛 Bug Bounty Writeup
• 20 Identity Security Mistakes That Lead to Account Takeover: Learn to Master Your Defenses: medium.com/@verylazytech/…
• The Renderer That Trusted Its Own Output: Stored XSS Through a Markdown Sanitization Gap: medium.com/@t4nv1/the-ren…
• The Password Was in the JSON: A WordPress REST API Access-Control Bug in Secure Custom Fields: medium.com/@mohamed.adel.…
• Broken Access Control #2: I Flipped One Cookie From “false” to “true” and Walked Into the Admin…: osintteam.blog/broken-access-…
• The Bouncer Who Only Read IPv4: SSRF in WordPress Playground’s CORS Proxy: medium.com/@mohamed.adel.…
• The Jail That Gave Its Prisoner a Staff Badge: Escaping WordPress Playground’s Sandbox: medium.com/@mohamed.adel.…
• Bypassing URL Validation with IPv6: An SSRF Story: medium.com/@muhammedmosla…
• The Shipment You Shouldn’t Be Able to Touch: medium.com/@ohyunwoods663…
• Dependency Confusion Explained: How a Missing NPM Package Becomes Remote Code Execution: medium.com/@vigneshkumaro…
• 20 Identity Security Mistakes That Lead to Account Takeover: Learn to Master Your Defenses: medium.com/@verylazytech/…
• The Renderer That Trusted Its Own Output: Stored XSS Through a Markdown Sanitization Gap: medium.com/@t4nv1/the-ren…
• The Password Was in the JSON: A WordPress REST API Access-Control Bug in Secure Custom Fields: medium.com/@mohamed.adel.…
• Broken Access Control #2: I Flipped One Cookie From “false” to “true” and Walked Into the Admin…: osintteam.blog/broken-access-…
• The Bouncer Who Only Read IPv4: SSRF in WordPress Playground’s CORS Proxy: medium.com/@mohamed.adel.…
• The Jail That Gave Its Prisoner a Staff Badge: Escaping WordPress Playground’s Sandbox: medium.com/@mohamed.adel.…
• Bypassing URL Validation with IPv6: An SSRF Story: medium.com/@muhammedmosla…
• The Shipment You Shouldn’t Be Able to Touch: medium.com/@ohyunwoods663…
• Dependency Confusion Explained: How a Missing NPM Package Becomes Remote Code Execution: medium.com/@vigneshkumaro…
0
3
28
2,344
🚨 Critical OpenSSH Vulnerability: Passwordless Account Access With Any Password Over 256 Characters!
securitycipher.com/2026/11/05/ope…
A newly reported security flaw in OpenSSH could allow attackers to bypass password authentication by supplying an unusually long password (over 256 is matters:
Potential authentication bypass.
Attackers may gain unauthorized account access.
Systems relying on affected OpenSSH versions could be at risk.
🔍 Security teams should:
Identify affected OpenSSH versions.
Review vendor advisories and available patches.
Prioritize remediation on exposed SSH services.
Monitor authentication logs for suspicious activity.
Stay alert and keep your SSH infrastructure patched!
#CyberSecurity #OpenSSH #Vulnerability #InfoSec #SecurityResearch #Linux #ZeroDay
securitycipher.com/2026/11/05/ope…
A newly reported security flaw in OpenSSH could allow attackers to bypass password authentication by supplying an unusually long password (over 256 is matters:
Potential authentication bypass.
Attackers may gain unauthorized account access.
Systems relying on affected OpenSSH versions could be at risk.
🔍 Security teams should:
Identify affected OpenSSH versions.
Review vendor advisories and available patches.
Prioritize remediation on exposed SSH services.
Monitor authentication logs for suspicious activity.
Stay alert and keep your SSH infrastructure patched!
#CyberSecurity #OpenSSH #Vulnerability #InfoSec #SecurityResearch #Linux #ZeroDay
3
18
85
4,115
The $6.3 Billion Binance Hack: A Product Security Breakdown of What Happened, What Should Have Happened, and What Changes Now
securitycipher.com/2026/11/05/bin…
securitycipher.com/2026/11/05/bin…
0
0
6
1,178
🐛 Bug Bounty Writeup
• 10 Burp Suite Features Most Bug Bounty Hunters Don’t Know About: meetcyber.net/10-burp-suite-…
• The Bridge Between a Web Page and the Phone Itself: Abusing an Android WebView JavaScript Interface: medium.com/@t4nv1/the-bri…
• How I Found My First Bug: Information Disclosure via Exposed Directory Listing: medium.com/@atitofffff/ho…
• Killed by a Browser, Revived by a Backslash: medium.com/@cfmohammed24/…
• The Database Said No. The Disk Said Yes.: medium.com/@0xSpiderx/the…
• How to Code Python PoCs to Exploit Web Vulnerabilities (2026 Guide): systemweakness.com/how-to-code-py…
• This Is How Phishing Links Slip Into Trusted Business Emails: medium.com/@TheWildEye/th…
• Network Security Testing Explained: What to Look For and How to Test It End to End: medium.com/@vigneshkumaro…
• Two Parsers, One Input, Two Different Answers: kd-200.medium.com/two-parsers-on…
• Intigriti XSS Challenge: Beyond the Sanitizer: medium.com/@vulnix.dev/in…
• 10 Burp Suite Features Most Bug Bounty Hunters Don’t Know About: meetcyber.net/10-burp-suite-…
• The Bridge Between a Web Page and the Phone Itself: Abusing an Android WebView JavaScript Interface: medium.com/@t4nv1/the-bri…
• How I Found My First Bug: Information Disclosure via Exposed Directory Listing: medium.com/@atitofffff/ho…
• Killed by a Browser, Revived by a Backslash: medium.com/@cfmohammed24/…
• The Database Said No. The Disk Said Yes.: medium.com/@0xSpiderx/the…
• How to Code Python PoCs to Exploit Web Vulnerabilities (2026 Guide): systemweakness.com/how-to-code-py…
• This Is How Phishing Links Slip Into Trusted Business Emails: medium.com/@TheWildEye/th…
• Network Security Testing Explained: What to Look For and How to Test It End to End: medium.com/@vigneshkumaro…
• Two Parsers, One Input, Two Different Answers: kd-200.medium.com/two-parsers-on…
• Intigriti XSS Challenge: Beyond the Sanitizer: medium.com/@vulnix.dev/in…
3
22
114
5,922
𝕏 Bug Bounty Writeups 𝕏 retweeted
🖇️A Guide on Modern Web Application Content Discovery
Blog: trustedsec.com/blog/modern-we…
Author: Luke Bremer (@TrustedSec)
Blog: trustedsec.com/blog/modern-we…
Author: Luke Bremer (@TrustedSec)
1
35
257
9,873
🐛 Bug Bounty Writeup
• The Matrix Reloaded: How Web Servers Unmask Malicious HTML & URL Exploits: medium.com/@zoningxtr/the…
• The Mutation Everyone Tested, and the One Field Nobody Did: GraphQL Field-Level Authorization…: medium.com/@t4nv1/the-mut…
• 15 CI/CD Security Mistakes That Can Lead to Supply Chain Attacks: Learn to Spot and Fix Them: medium.com/@verylazytech/…
• Authentication Bypass via Password Reset Flow Manipulation: medium.com/@aytha324568/a…
• GraphQL API Security: Reconnaissance, Common Vulnerabilities, Exploitation Techniques, and…: medium.com/@xalpha032/gra…
• API Security Testing: A Complete Guide to Reconnaissance, Hidden Endpoints, Mass Assignment, and…: medium.com/@xalpha032/api…
• Broken Access Control via Direct URL Navigation: Bypassing Premium Feature Restrictions: medium.com/@aytha324568/b…
• From P4 to P1: Day 10 — Server-Side Request Forgery (SSRF): Finding and Validating Server-Side…: medium.com/@cyb3rD1vvya/f…
• The Impact Section Is One Word. The Bounty Is $25,000.: meetcyber.net/the-impact-sec…
• The Matrix Reloaded: How Web Servers Unmask Malicious HTML & URL Exploits: medium.com/@zoningxtr/the…
• The Mutation Everyone Tested, and the One Field Nobody Did: GraphQL Field-Level Authorization…: medium.com/@t4nv1/the-mut…
• 15 CI/CD Security Mistakes That Can Lead to Supply Chain Attacks: Learn to Spot and Fix Them: medium.com/@verylazytech/…
• Authentication Bypass via Password Reset Flow Manipulation: medium.com/@aytha324568/a…
• GraphQL API Security: Reconnaissance, Common Vulnerabilities, Exploitation Techniques, and…: medium.com/@xalpha032/gra…
• API Security Testing: A Complete Guide to Reconnaissance, Hidden Endpoints, Mass Assignment, and…: medium.com/@xalpha032/api…
• Broken Access Control via Direct URL Navigation: Bypassing Premium Feature Restrictions: medium.com/@aytha324568/b…
• From P4 to P1: Day 10 — Server-Side Request Forgery (SSRF): Finding and Validating Server-Side…: medium.com/@cyb3rD1vvya/f…
• The Impact Section Is One Word. The Bounty Is $25,000.: meetcyber.net/the-impact-sec…
0
1
11
1,664
🐛 Bug Bounty Writeup
• 2FA simple bypass — An Authentication Bypass Lab Walkthrough: vivek0x.medium.com/2fa-simple-byp…
• The JWT Bug I Almost Walked Past : And Why Most Developers Still Get This Wrong: meetcyber.net/the-jwt-bug-i-…
• The Debugging File Nobody Removed Before Shipping: Secrets Exposed Through a Public Source Map: medium.com/@t4nv1/the-deb…
• Güvenlik Ürünü Kendini Koruyamazsa: Endpoint Central Ajanı ile Sorumlu İfşa Hikâyem: medium.com/@furkanyasinke…
• When a Security Product Can’t Protect Itself: My Responsible Disclosure Story with the Endpoint…: medium.com/@furkanyasinke…
• Valenfind-THM: medium.com/@adesinat045/v…
• The Hidden IDOR Vulnerability in /me/ API Endpoints: medium.com/@Dark_Boss/the…
• Request Smuggling in 2026: Four Bugs, Four Layers, One Seam: medium.com/codetodeploy/r…
• Terraform Security Explained: How to Write, Scan and Deploy Infrastructure Code Safely: medium.com/@vigneshkumaro…
• From P4 to P1 — Day 9: Mass Assignment Vulnerabilities in Bug Bounty Hunting: medium.com/@cyb3rD1vvya/f…
• 2FA simple bypass — An Authentication Bypass Lab Walkthrough: vivek0x.medium.com/2fa-simple-byp…
• The JWT Bug I Almost Walked Past : And Why Most Developers Still Get This Wrong: meetcyber.net/the-jwt-bug-i-…
• The Debugging File Nobody Removed Before Shipping: Secrets Exposed Through a Public Source Map: medium.com/@t4nv1/the-deb…
• Güvenlik Ürünü Kendini Koruyamazsa: Endpoint Central Ajanı ile Sorumlu İfşa Hikâyem: medium.com/@furkanyasinke…
• When a Security Product Can’t Protect Itself: My Responsible Disclosure Story with the Endpoint…: medium.com/@furkanyasinke…
• Valenfind-THM: medium.com/@adesinat045/v…
• The Hidden IDOR Vulnerability in /me/ API Endpoints: medium.com/@Dark_Boss/the…
• Request Smuggling in 2026: Four Bugs, Four Layers, One Seam: medium.com/codetodeploy/r…
• Terraform Security Explained: How to Write, Scan and Deploy Infrastructure Code Safely: medium.com/@vigneshkumaro…
• From P4 to P1 — Day 9: Mass Assignment Vulnerabilities in Bug Bounty Hunting: medium.com/@cyb3rD1vvya/f…
0
20
175
7,736
🐛 Bug Bounty Writeup
• A Sub-User Could Delete a Company in Munshi: medium.com/@TheWildEye/a-…
• A Webhook With No Memory: Replay and Forgery in a Payment Notification Endpoint: medium.com/@t4nv1/a-webho…
• Spring4Shell Step by Step: How CVE 2022 22965 Turns Data Binding Into Remote Code Execution in a…: masimshahzad.medium.com/spring4shell-s…
• ProxyShell Step by Step: How Three Exchange Flaws Chain Into Remote Code Execution in a Lab: masimshahzad.medium.com/proxyshell-ste…
• Meet GitPay: Pay Contributors with a Single Comment: medium.com/@random212/mee…
• From Shodan to an Unpaid Delivery: How a Chain of Weaknesses Led to Real-World Impact: medium.com/@gjethva10/fro…
• Giving an AI Agent a File Reader Without a Fence: Arbitrary File Read in an AWS Open-Source Tool: medium.com/@vigneshkumaro…
• Introducing the Ticko Bug Bounty: Up to 200,000 USDT for Critical Vulnerabilities: medium.com/ticko/introduc…
• From P4 to P1 — Day 8: Broken Function-Level Authorization (BFLA) in Bug Bounty Hunting: medium.com/@cyb3rD1vvya/f…
• A Sub-User Could Delete a Company in Munshi: medium.com/@TheWildEye/a-…
• A Webhook With No Memory: Replay and Forgery in a Payment Notification Endpoint: medium.com/@t4nv1/a-webho…
• Spring4Shell Step by Step: How CVE 2022 22965 Turns Data Binding Into Remote Code Execution in a…: masimshahzad.medium.com/spring4shell-s…
• ProxyShell Step by Step: How Three Exchange Flaws Chain Into Remote Code Execution in a Lab: masimshahzad.medium.com/proxyshell-ste…
• Meet GitPay: Pay Contributors with a Single Comment: medium.com/@random212/mee…
• From Shodan to an Unpaid Delivery: How a Chain of Weaknesses Led to Real-World Impact: medium.com/@gjethva10/fro…
• Giving an AI Agent a File Reader Without a Fence: Arbitrary File Read in an AWS Open-Source Tool: medium.com/@vigneshkumaro…
• Introducing the Ticko Bug Bounty: Up to 200,000 USDT for Critical Vulnerabilities: medium.com/ticko/introduc…
• From P4 to P1 — Day 8: Broken Function-Level Authorization (BFLA) in Bug Bounty Hunting: medium.com/@cyb3rD1vvya/f…
0
2
10
1,744
🐛 Bug Bounty Writeup
• Access Control Vulnerabilities: A Practical Guide to Broken Authorization: medium.com/@xalpha032/acc…
• DAST and Web Recon Explained: An End-to-End Methodology for Understanding Any Web Application: medium.com/@vigneshkumaro…
• The Race Condition That Paid Its Own Bounty: medium.com/codetodeploy/t…
• Mastering Open Redirect Vulnerabilities: From Simple Bypasses to Critical Bug Bounties: medium.com/@nish.pawar.25…
• SQLMap 1 ~ CyLab Security Academy Write-up | Exploiting SQL Injection and Accessing Protected Data: medium.com/@affanhaxor/sq…
• Unauthenticated DaData Relay: Leaking FNS Registry Records and Burning a Paid API Quota: medium.com/@abdoalkaser53…
• From P4 to P1 — Day 7: IDOR and Broken Object-Level Authorization (BOLA) in Bug Bounty Hunting: medium.com/@cyb3rD1vvya/f…
• Unauthenticated Spring Boot Actuator: Credential-Shaped Secrets Leaking from /actuator/env and…: medium.com/@abdoalkaser53…
• GraphQL IDOR: How a Missing Org Check Let Me Edit Another Tenant’s Permissions: medium.com/@Mohamed3adel/…
• Access Control Vulnerabilities: A Practical Guide to Broken Authorization: medium.com/@xalpha032/acc…
• DAST and Web Recon Explained: An End-to-End Methodology for Understanding Any Web Application: medium.com/@vigneshkumaro…
• The Race Condition That Paid Its Own Bounty: medium.com/codetodeploy/t…
• Mastering Open Redirect Vulnerabilities: From Simple Bypasses to Critical Bug Bounties: medium.com/@nish.pawar.25…
• SQLMap 1 ~ CyLab Security Academy Write-up | Exploiting SQL Injection and Accessing Protected Data: medium.com/@affanhaxor/sq…
• Unauthenticated DaData Relay: Leaking FNS Registry Records and Burning a Paid API Quota: medium.com/@abdoalkaser53…
• From P4 to P1 — Day 7: IDOR and Broken Object-Level Authorization (BOLA) in Bug Bounty Hunting: medium.com/@cyb3rD1vvya/f…
• Unauthenticated Spring Boot Actuator: Credential-Shaped Secrets Leaking from /actuator/env and…: medium.com/@abdoalkaser53…
• GraphQL IDOR: How a Missing Org Check Let Me Edit Another Tenant’s Permissions: medium.com/@Mohamed3adel/…
0
2
15
1,890
🐛 Bug Bounty Writeup
• CRLF Injection: When a Newline Becomes a Weapon: medium.com/@raksharoot/cr…
• How to Find SSRF Bugs That Pay: Hunting Server Side Request Forgery in URL Fetch and Image Import…: masimshahzad.medium.com/how-to-find-ss…
• GraphQL Authorization Flaws: How One Missing Check in a Resolver Exposes Private Data: masimshahzad.medium.com/graphql-author…
• Hacker101 CTF: OSUSEC (School of Pwn) — Write-up: medium.com/@YusifMammadza…
• Authorization Is the Attack Surface: An Expert Field Guide to Breaking Modern Access Control: cyphernova1337.medium.com/authorization-…
• Intigriti Halloween Challenge (1026) by Globules writeup: savi0r.medium.com/intigriti-hall…
• Search Source ~ CyLab Security Academy Write-up | Finding Hidden Information in Website Files: medium.com/@affanhaxor/se…
• From P4 to P1 — Day 6: CORS Misconfigurations in Bug Bounty Hunting: medium.com/@cyb3rD1vvya/f…
• When “Known Issue” Becomes an Excuse: My Zerodha Bug Bounty Experience: bunny0417.medium.com/when-known-iss…
• 7 Common Bug Bounty Mistakes to Avoid in 2026: A Practical Guide for Ethical Hackers: medium.com/@asadmohsin760…
• CRLF Injection: When a Newline Becomes a Weapon: medium.com/@raksharoot/cr…
• How to Find SSRF Bugs That Pay: Hunting Server Side Request Forgery in URL Fetch and Image Import…: masimshahzad.medium.com/how-to-find-ss…
• GraphQL Authorization Flaws: How One Missing Check in a Resolver Exposes Private Data: masimshahzad.medium.com/graphql-author…
• Hacker101 CTF: OSUSEC (School of Pwn) — Write-up: medium.com/@YusifMammadza…
• Authorization Is the Attack Surface: An Expert Field Guide to Breaking Modern Access Control: cyphernova1337.medium.com/authorization-…
• Intigriti Halloween Challenge (1026) by Globules writeup: savi0r.medium.com/intigriti-hall…
• Search Source ~ CyLab Security Academy Write-up | Finding Hidden Information in Website Files: medium.com/@affanhaxor/se…
• From P4 to P1 — Day 6: CORS Misconfigurations in Bug Bounty Hunting: medium.com/@cyb3rD1vvya/f…
• When “Known Issue” Becomes an Excuse: My Zerodha Bug Bounty Experience: bunny0417.medium.com/when-known-iss…
• 7 Common Bug Bounty Mistakes to Avoid in 2026: A Practical Guide for Ethical Hackers: medium.com/@asadmohsin760…
0
13
68
3,989
🐛 Bug Bounty Writeup
• fiverr.com/sanarasheed639: medium.com/@mdshohelrana2…
• Discovering and Reporting SQL Injection: A Technical Walkthrough of CAN-2026–2040978: medium.com/@mjoker22mjoke…
• I Didn’t Even Open Burp Suite — One URL Change Exposed Hidden WordPress Content: medium.com/@The_Knower/i-…
• I Found SSRF in 30 Minutes: Here’s My Exact Bug Bounty Workflow (Complete Guide) | by Samadhan…: samadhanshimple.medium.com/i-found-ssrf-i…
• Four Redirects, One URL, Full Account Takeover: An OAuth Chain Autopsy: medium.com/codetodeploy/f…
• From P4 to P1 — Day 5: Open Redirect Vulnerabilities in Bug Bounty Hunting: medium.com/@cyb3rD1vvya/f…
• Secrets : CyLab Security Academy Write-up | Discovering Hidden Web Paths: medium.com/@affanhaxor/se…
• P3 — Missing Rate Limiting on Sensitive API Endpoint: medium.com/@akashmotkar00…
• From POST-Based XSS to Full Account Takeover: medium.com/@Alharbe0/from…
• From POST-Based XSS to Full Account Takeover: medium.com/@duckeg97/from…
• fiverr.com/sanarasheed639: medium.com/@mdshohelrana2…
• Discovering and Reporting SQL Injection: A Technical Walkthrough of CAN-2026–2040978: medium.com/@mjoker22mjoke…
• I Didn’t Even Open Burp Suite — One URL Change Exposed Hidden WordPress Content: medium.com/@The_Knower/i-…
• I Found SSRF in 30 Minutes: Here’s My Exact Bug Bounty Workflow (Complete Guide) | by Samadhan…: samadhanshimple.medium.com/i-found-ssrf-i…
• Four Redirects, One URL, Full Account Takeover: An OAuth Chain Autopsy: medium.com/codetodeploy/f…
• From P4 to P1 — Day 5: Open Redirect Vulnerabilities in Bug Bounty Hunting: medium.com/@cyb3rD1vvya/f…
• Secrets : CyLab Security Academy Write-up | Discovering Hidden Web Paths: medium.com/@affanhaxor/se…
• P3 — Missing Rate Limiting on Sensitive API Endpoint: medium.com/@akashmotkar00…
• From POST-Based XSS to Full Account Takeover: medium.com/@Alharbe0/from…
• From POST-Based XSS to Full Account Takeover: medium.com/@duckeg97/from…
0
0
6
1,487