We’ve just released 6 new videos covering real-world vulnerabilities:
• Exposed API Grant Unauthorized Access to Premium Option
https://www.youtube.com/watch?v=W0aCx6aaKaw
• Email Verification Bypass
https://www.youtube.com/watch?v=HqH3IXYT3Ds
• Business Logic Bugs: Admin Couldn’t Delete Files!
https://www.youtube.com/watch?v=w28D0_evC80
• Bypassing the AI Chat Limit
https://www.youtube.com/watch?v=sPaZzk37PWA
• How Pre-Account Takeover Works + Access Control Bypass
https://www.youtube.com/watch?v=ehNHpbaQrPY
• Unauthorized Email Modification & Account Lockout
https://www.youtube.com/watch?v=qMa9BZ6QQ8k&t=8s
• Exposed API Grant Unauthorized Access to Premium Option
https://www.youtube.com/watch?v=W0aCx6aaKaw
• Email Verification Bypass
https://www.youtube.com/watch?v=HqH3IXYT3Ds
• Business Logic Bugs: Admin Couldn’t Delete Files!
https://www.youtube.com/watch?v=w28D0_evC80
• Bypassing the AI Chat Limit
https://www.youtube.com/watch?v=sPaZzk37PWA
• How Pre-Account Takeover Works + Access Control Bypass
https://www.youtube.com/watch?v=ehNHpbaQrPY
• Unauthorized Email Modification & Account Lockout
https://www.youtube.com/watch?v=qMa9BZ6QQ8k&t=8s
YouTube
(17)Exposed API Grant Unauthorized Access to Premium Option
In this video, I walk through a real issue where an exposed API endpoint allowed access to premium features without any proper authorization.
The idea here is simple: the backend trusted a request it shouldn’t trust.
I’ll break down:
- How exposed APIs…
The idea here is simple: the backend trusted a request it shouldn’t trust.
I’ll break down:
- How exposed APIs…
❤55🔥8🥰1👾1
🚨 Critical Vulnerability
🚨 Critical Hardcoded IBM Cloud API Key in Admin JavaScript Allows Unauthorized IAM Token Generation (Cloud Account Compromise)
📝 Full writeup:
https://www.facebook.com/share/p/18JAevtdRq/?mibextid=wwXIfr
🚨 Critical Hardcoded IBM Cloud API Key in Admin JavaScript Allows Unauthorized IAM Token Generation (Cloud Account Compromise)
📝 Full writeup:
https://www.facebook.com/share/p/18JAevtdRq/?mibextid=wwXIfr
❤20🔥6
My First Accepted HackerOne Report: Finding Exposed API Keys Across 5 Targets:
https://medium.com/@ziadali200244/my-first-accepted-hackerone-report-finding-exposed-weglot-api-keys-across-5-targets-fb14ecda869b
https://medium.com/@ziadali200244/my-first-accepted-hackerone-report-finding-exposed-weglot-api-keys-across-5-targets-fb14ecda869b
Medium
My First Accepted HackerOne Report: Finding Exposed Weglot API Keys Across 5 Targets
Good evening everyone. This writeup is about my first report accepted on HackerOne and how I found the same issue on 5 different targets.
❤34🔥9
Self hosted +Bug bounty programs⬇️
*.cleeng.com
security@cleeng.com
—————————————
*.redsift.com
security@redsift.com
—————————————
*.plain.com
security@plain.com
—————————————
*.linkdm.com
support@linkdm.com
—————————————
*.ory.com
security@ory.com
—————————————
*. aquanow.com
bugbounty@aquanow.com
—————————————
https://github.com/swisscom/bugbounty
—————————————
https://www.spendesk.com/.well-known/security.txt
—————————————
https://help.spreaker.com/en/articles/5123644-bug-bounty-program
—————————————
https://www.fjdynamics.com/jp/bug-bounty-program
—————————————
https://www.klook.com/bugbounty
—————————————
https://gobright.com/responsible-disclosure-policy/
—————————————
https://www.make.com/en/bounty
—————————————
https://www.pubnub.com/bug-bounty-policy/
—————————————
https://help.doit.com/docs/vendor-information/bug-bounty-program
—————————————
https://www.lenskart.com/vulnerability-disclosure-policy
—————————————
https://www.talentlms.com/vulnerabilitypolicy
—————————————
https://whatbox.ca/policies/security
—————————————
*.perlego.com
security@perlego.com
—————————————
https://support.playerauctions.com/hc/en-us/articles/49330305602585-PlayerAuctions-Bug-Bounty-Program
*.cleeng.com
security@cleeng.com
—————————————
*.redsift.com
security@redsift.com
—————————————
*.plain.com
security@plain.com
—————————————
*.linkdm.com
support@linkdm.com
—————————————
*.ory.com
security@ory.com
—————————————
*. aquanow.com
bugbounty@aquanow.com
—————————————
https://github.com/swisscom/bugbounty
—————————————
https://www.spendesk.com/.well-known/security.txt
—————————————
https://help.spreaker.com/en/articles/5123644-bug-bounty-program
—————————————
https://www.fjdynamics.com/jp/bug-bounty-program
—————————————
https://www.klook.com/bugbounty
—————————————
https://gobright.com/responsible-disclosure-policy/
—————————————
https://www.make.com/en/bounty
—————————————
https://www.pubnub.com/bug-bounty-policy/
—————————————
https://help.doit.com/docs/vendor-information/bug-bounty-program
—————————————
https://www.lenskart.com/vulnerability-disclosure-policy
—————————————
https://www.talentlms.com/vulnerabilitypolicy
—————————————
https://whatbox.ca/policies/security
—————————————
*.perlego.com
security@perlego.com
—————————————
https://support.playerauctions.com/hc/en-us/articles/49330305602585-PlayerAuctions-Bug-Bounty-Program
❤22
Critical Exposure of Algolia Admin API Key in Client-Side JavaScript:
https://medium.com/@zx10a/critical-exposure-of-algolia-admin-api-key-in-client-side-javascript-c41cacb4aed6
https://medium.com/@zx10a/critical-exposure-of-algolia-admin-api-key-in-client-side-javascript-c41cacb4aed6
❤22🔥5👍1