🚨 New Bug Bounty Writeup
Clickjacking Bypass Techniques: A Practical Methodology for Security Testing by N0aziXss
Learn practical techniques to identify and bypass common clickjacking protections, understand real-world testing methodologies, and improve your ability to uncover impactful client-side security issues during bug bounty assessments.
🔗 Read the full writeup:
https://medium.com/@N0aziXss/clickjacking-bypass-techniques-a-practical-methodology-for-security-testing-26420009f361
Clickjacking Bypass Techniques: A Practical Methodology for Security Testing by N0aziXss
Learn practical techniques to identify and bypass common clickjacking protections, understand real-world testing methodologies, and improve your ability to uncover impactful client-side security issues during bug bounty assessments.
🔗 Read the full writeup:
https://medium.com/@N0aziXss/clickjacking-bypass-techniques-a-practical-methodology-for-security-testing-26420009f361
Medium
Clickjacking & Bypass Techniques: A Practical Methodology for Security Testing
Subtitle:
❤2
🚨 New Bug Bounty Writeup
How I Bypass Rate Limit via IP Rotation (Allow Restriction Bypass)
This writeup demonstrates how rotating IP addresses can bypass poorly implemented rate-limiting mechanisms. It highlights common misconfigurations, testing methodology, and key takeaways for identifying rate limit bypasses during bug bounty engagements.
🔗 Read the full writeup:
https://infosecwriteups.com/how-i-bypass-rate-limit-via-ip-rotation-allow-restriction-bypass-7af709f2d0fc
How I Bypass Rate Limit via IP Rotation (Allow Restriction Bypass)
This writeup demonstrates how rotating IP addresses can bypass poorly implemented rate-limiting mechanisms. It highlights common misconfigurations, testing methodology, and key takeaways for identifying rate limit bypasses during bug bounty engagements.
🔗 Read the full writeup:
https://infosecwriteups.com/how-i-bypass-rate-limit-via-ip-rotation-allow-restriction-bypass-7af709f2d0fc
Medium
How I bypass Rate limit via IP rotation allow restriction bypass
Hello,
🔥2
🚨 New Bug Bounty Writeup
How I Found a Critical Bug That Exposed Every User's PII With a Free Account
This writeup walks through the discovery of a critical vulnerability that exposed sensitive user information (PII) without requiring a paid account. Learn the testing approach, root cause, and key lessons for identifying high-impact authorization and data exposure flaws.
🔗 Read the full writeup:
https://medium.com/@Aacle/how-i-found-a-critical-bug-that-exposed-every-users-pii-with-a-free-account-47ee4294f440
How I Found a Critical Bug That Exposed Every User's PII With a Free Account
This writeup walks through the discovery of a critical vulnerability that exposed sensitive user information (PII) without requiring a paid account. Learn the testing approach, root cause, and key lessons for identifying high-impact authorization and data exposure flaws.
🔗 Read the full writeup:
https://medium.com/@Aacle/how-i-found-a-critical-bug-that-exposed-every-users-pii-with-a-free-account-47ee4294f440
Medium
How I Found a Critical Bug That Exposed Every User’s PII With a Free Account
A private pentest, one API call, and a lesson every Supabase (or RLS-backed) team needs to hear.
🔥2
🚨 New Bug Bounty Writeup
How I Got Full RCE by Accident and Skipped Two Flags Doing It (Hacker101 CTF)
An interesting Hacker101 CTF writeup showing how an unintended path led to full Remote Code Execution (RCE), allowing the author to bypass two challenge flags. A great read on thinking outside the box and spotting unexpected exploitation paths.
🔗 Read the full writeup:
https://medium.com/@kagancoskunn/how-i-got-full-rce-by-accident-and-skipped-two-flags-doing-it-hacker101-ctf-y2fuihlvdsbyzwnvbj8-d236520037f5
How I Got Full RCE by Accident and Skipped Two Flags Doing It (Hacker101 CTF)
An interesting Hacker101 CTF writeup showing how an unintended path led to full Remote Code Execution (RCE), allowing the author to bypass two challenge flags. A great read on thinking outside the box and spotting unexpected exploitation paths.
🔗 Read the full writeup:
https://medium.com/@kagancoskunn/how-i-got-full-rce-by-accident-and-skipped-two-flags-doing-it-hacker101-ctf-y2fuihlvdsbyzwnvbj8-d236520037f5
Medium
How I Got Full RCE (And Accidentally Skipped Two Flags Doing It) — Hacker101 CTF…
Hacker101 CTF Writeup — Y2FuIHlvdSByZWNvbj8
🔥2
Telegram Post
🚀 FREE Android Bug Bounty Course
The Complete Android Bug Bounty Course — From Zero to Paid Bounties (2026)
Looking to start Android bug bounty hunting without spending a dime? This FREE 7+ hour course covers lab setup, APK analysis, Frida, Objection, common Android vulnerabilities, and real-world bug bounty techniques to help you get started.
🎥 Watch for free: https://youtu.be/9STDmGIAJu4�
🚀 FREE Android Bug Bounty Course
The Complete Android Bug Bounty Course — From Zero to Paid Bounties (2026)
Looking to start Android bug bounty hunting without spending a dime? This FREE 7+ hour course covers lab setup, APK analysis, Frida, Objection, common Android vulnerabilities, and real-world bug bounty techniques to help you get started.
🎥 Watch for free: https://youtu.be/9STDmGIAJu4�
YouTube
Android Bug Bounty Masterclass — Find & Exploit Mobile App Vulnerabilities (2026)
TimeStamps:
00:00:00 Introduction Of B1scuit
00:00:30 My Journey
00:08:46 Before Starting This course
00:09:26 Physical Device VS Virtual Device
00:17:03 Available CPUABI Options in Android Studio & System Image Variants
00:22:24 API Level’s in Android Studio…
00:00:00 Introduction Of B1scuit
00:00:30 My Journey
00:08:46 Before Starting This course
00:09:26 Physical Device VS Virtual Device
00:17:03 Available CPUABI Options in Android Studio & System Image Variants
00:22:24 API Level’s in Android Studio…
❤1
🚨 New Bug Bounty Writeup
Server Side Template Injection (SSTI) Got Exploited
This writeup explains how to identify and exploit a Server-Side Template Injection (SSTI) vulnerability, from confirming the injection point and identifying the template engine to achieving Remote Code Execution (RCE) using Jinja2 payloads. A great practical guide for web security enthusiasts. �
mainekhacker.medium.com
🔗 Read the full writeup:
https://mainekhacker.medium.com/server-side-template-injection-ssti-got-exploited-e083fae95708�
Server Side Template Injection (SSTI) Got Exploited
This writeup explains how to identify and exploit a Server-Side Template Injection (SSTI) vulnerability, from confirming the injection point and identifying the template engine to achieving Remote Code Execution (RCE) using Jinja2 payloads. A great practical guide for web security enthusiasts. �
mainekhacker.medium.com
🔗 Read the full writeup:
https://mainekhacker.medium.com/server-side-template-injection-ssti-got-exploited-e083fae95708�
Medium
Server Side Template Injection (SSTI ) Got Exploited
What is Server Side Template Injection?
🔥2
🚨 New Bug Bounty Writeup
Stored XSS to Full Account Takeover: Chaining a Hybrid Markdown Parser Flaw with localStorage Token Theft
This writeup demonstrates how a Stored XSS vulnerability in a hybrid Markdown parser was chained with insecure token storage in localStorage to achieve full account takeover. A great example of vulnerability chaining and how seemingly minor issues can lead to critical impact.
🔗 Read the full writeup: https://medium.com/@alii76tt/stored-xss-to-full-account-takeover-chaining-a-hybrid-markdown-parser-flaw-with-localstorage-token-48768631980e
Stored XSS to Full Account Takeover: Chaining a Hybrid Markdown Parser Flaw with localStorage Token Theft
This writeup demonstrates how a Stored XSS vulnerability in a hybrid Markdown parser was chained with insecure token storage in localStorage to achieve full account takeover. A great example of vulnerability chaining and how seemingly minor issues can lead to critical impact.
🔗 Read the full writeup: https://medium.com/@alii76tt/stored-xss-to-full-account-takeover-chaining-a-hybrid-markdown-parser-flaw-with-localstorage-token-48768631980e
Medium
Stored XSS to Full Account Takeover: Chaining a Hybrid Markdown Parser Flaw with localStorage Token Theft
During a red team engagement for a client, I was testing an internal messaging platform embedded in a corporate collaboration tool — a…
❤1
🚨 New Bug Bounty Writeup
How I Found a Bug Worth $3,500 in a Feature Nobody Was Watching
This writeup details the discovery of a high-impact vulnerability hidden in an overlooked feature. It walks through the reconnaissance process, testing methodology, exploitation steps, and key lessons that led to a $3,500 bug bounty reward.
🔗 Read the full writeup: https://infosecwriteups.com/how-i-found-a-bug-worth-3-500-in-a-feature-nobody-was-watching-6773df9fce72�
How I Found a Bug Worth $3,500 in a Feature Nobody Was Watching
This writeup details the discovery of a high-impact vulnerability hidden in an overlooked feature. It walks through the reconnaissance process, testing methodology, exploitation steps, and key lessons that led to a $3,500 bug bounty reward.
🔗 Read the full writeup: https://infosecwriteups.com/how-i-found-a-bug-worth-3-500-in-a-feature-nobody-was-watching-6773df9fce72�
Medium
How I Found a Bug Worth $3,500 — In a Feature Nobody Was Watching.
A storage-exhaustion flaw. A stored XSS that waited for an admin. Both hiding in the same “boring” file upload form that hadn’t been…
🔥2
🚨 New Bug Bounty Writeup
From Nothing to Full Admin Access: Chaining Broken Access Controls
This writeup demonstrates how multiple broken access control vulnerabilities were chained together to escalate privileges from a low-privileged user to full administrator access. A practical example of why combining seemingly low-severity issues can lead to critical impact.
🔗 Read the full writeup: https://infosecwriteups.com/from-nothing-to-full-admin-access-chaining-broken-access-controls-f0d5aa76a4c1�
From Nothing to Full Admin Access: Chaining Broken Access Controls
This writeup demonstrates how multiple broken access control vulnerabilities were chained together to escalate privileges from a low-privileged user to full administrator access. A practical example of why combining seemingly low-severity issues can lead to critical impact.
🔗 Read the full writeup: https://infosecwriteups.com/from-nothing-to-full-admin-access-chaining-broken-access-controls-f0d5aa76a4c1�
Medium
From Nothing to Full Admin Access: Chaining Broken Access Controls
Broken Access Controls are everywhere. In application security, they show up in many different ways. Sometimes they come from poorly…
🔥1
🚨 New Bug Bounty Writeup
Broken Access Control: Platform Misconfiguration & URL Override Headers
This writeup explores how platform misconfigurations and URL override headers can introduce broken access control vulnerabilities. Learn how these overlooked behaviors can be abused to bypass authorization checks and why testing alternative headers should be part of every bug bounty assessment.
🔗 Read the full writeup: https://medium.com/@anubhavbora40/broken-access-control-platform-misconfiguration-url-override-headers-5a8ac59ace15�
Broken Access Control: Platform Misconfiguration & URL Override Headers
This writeup explores how platform misconfigurations and URL override headers can introduce broken access control vulnerabilities. Learn how these overlooked behaviors can be abused to bypass authorization checks and why testing alternative headers should be part of every bug bounty assessment.
🔗 Read the full writeup: https://medium.com/@anubhavbora40/broken-access-control-platform-misconfiguration-url-override-headers-5a8ac59ace15�
Medium
Broken Access Control — Platform Misconfiguration (URL Override Headers)
The Core Problem
❤1
🚨 New Bug Bounty Writeup
Getting SQL Injection Past AWS WAF: Two Structural Inspection Gaps
This writeup explores two structural inspection gaps in AWS WAF that can allow SQL injection payloads to evade detection. Learn the techniques used to bypass WAF protections, understand the root cause, and improve your approach to testing modern web applications behind managed firewalls.
🔗 Read the full writeup:
https://prathameshbagul.medium.com/getting-sql-injection-past-aws-waf-two-structural-inspection-gaps-5c1148f2e49d
Getting SQL Injection Past AWS WAF: Two Structural Inspection Gaps
This writeup explores two structural inspection gaps in AWS WAF that can allow SQL injection payloads to evade detection. Learn the techniques used to bypass WAF protections, understand the root cause, and improve your approach to testing modern web applications behind managed firewalls.
🔗 Read the full writeup:
https://prathameshbagul.medium.com/getting-sql-injection-past-aws-waf-two-structural-inspection-gaps-5c1148f2e49d
Medium
Getting SQL Injection Past AWS WAF: Two Structural Inspection Gaps
How zlib-compressed URL tokens and request-body padding exposed gaps between AWS WAF inspection and application processing.
🔥2
🚨 New Bug Bounty Writeup
CVE-2026-69258: Flowise Patched OverrideConfig — I Found the Two Places the Patch Never Reached
This writeup analyzes the patch for CVE-2026-69258 in Flowise and reveals two overlooked code paths where the fix wasn't applied. It highlights the importance of verifying security patches thoroughly and demonstrates how incomplete fixes can leave applications vulnerable.
🔗 Read the full writeup:
https://medium.com/@aviral23/cve-2026-69258-flowise-patched-overrideconfig-i-found-the-two-places-the-patch-never-reached-cb907387cbbe
CVE-2026-69258: Flowise Patched OverrideConfig — I Found the Two Places the Patch Never Reached
This writeup analyzes the patch for CVE-2026-69258 in Flowise and reveals two overlooked code paths where the fix wasn't applied. It highlights the importance of verifying security patches thoroughly and demonstrates how incomplete fixes can leave applications vulnerable.
🔗 Read the full writeup:
https://medium.com/@aviral23/cve-2026-69258-flowise-patched-overrideconfig-i-found-the-two-places-the-patch-never-reached-cb907387cbbe
Medium
CVE-2026–69258: Flowise Patched overrideConfig. I Found the Two Places the Patch Never Reached.
An unauthenticated property injection into the flow execution context of any public chatflow. The gate was already in the codebase. It just…
❤1
🚨 New Bug Bounty Writeup
OAuth 2.0 Attack Surface: Redirect URIs, Token Leakage and Account Takeover Risks
Explore common OAuth 2.0 security weaknesses, including redirect URI issues and token leakage, and learn how these flaws can potentially be chained into account takeover scenarios. A useful guide for understanding and testing OAuth attack surfaces during bug bounty hunting.
🔗 Read the full writeup:
https://medium.com/@cybermindspace/oauth-2-0-attack-surface-redirect-uris-token-leakage-and-account-takeover-risks-7d0f0730168b
OAuth 2.0 Attack Surface: Redirect URIs, Token Leakage and Account Takeover Risks
Explore common OAuth 2.0 security weaknesses, including redirect URI issues and token leakage, and learn how these flaws can potentially be chained into account takeover scenarios. A useful guide for understanding and testing OAuth attack surfaces during bug bounty hunting.
🔗 Read the full writeup:
https://medium.com/@cybermindspace/oauth-2-0-attack-surface-redirect-uris-token-leakage-and-account-takeover-risks-7d0f0730168b
Medium
OAuth 2.0 Attack Surface: Redirect URIs, Token Leakage, and Account Takeover Risks
Apple paid $100,000 for this one. The researcher found it in an afternoon. The server issued OAuth tokens for any email address you asked…
👍1
🚨 New Bug Bounty Writeup
How I Landed My First $200 Bounty with One Unusual SSRF
A practical writeup about discovering an unusual Server-Side Request Forgery (SSRF) vulnerability and turning it into a successful $200 bug bounty. A great example of thinking beyond common attack paths and exploring unexpected SSRF behavior.
🔗 Read the full writeup:
https://meetcyber.net/how-i-landed-my-first-200-bounty-with-one-unusual-ssrf-9464df0720b1
How I Landed My First $200 Bounty with One Unusual SSRF
A practical writeup about discovering an unusual Server-Side Request Forgery (SSRF) vulnerability and turning it into a successful $200 bug bounty. A great example of thinking beyond common attack paths and exploring unexpected SSRF behavior.
🔗 Read the full writeup:
https://meetcyber.net/how-i-landed-my-first-200-bounty-with-one-unusual-ssrf-9464df0720b1
Medium
I Found an SSRF That Nobody Would Screenshot — So I Made It Screenshot Itself
$200 for one SSRF bug most hunters would've missed - a screenshot renderer leaking internal metrics. My first bounty, full breakdown.
❤2
🚨 New Bug Bounty Writeup
From File Upload to Remote Code Execution: How I Bypassed MIME Type Validation
This writeup explores how weak MIME type validation in a file upload feature can lead to serious security impact, including Remote Code Execution (RCE). A useful practical example of testing file upload functionality beyond basic extension checks.
🔗 Read the full writeup:
https://rootvuln.medium.com/from-file-upload-to-remote-code-execution-how-i-bypassed-mime-type-validation-d571e7c27645
From File Upload to Remote Code Execution: How I Bypassed MIME Type Validation
This writeup explores how weak MIME type validation in a file upload feature can lead to serious security impact, including Remote Code Execution (RCE). A useful practical example of testing file upload functionality beyond basic extension checks.
🔗 Read the full writeup:
https://rootvuln.medium.com/from-file-upload-to-remote-code-execution-how-i-bypassed-mime-type-validation-d571e7c27645
Medium
From File Upload to Remote Code Execution: How I Bypassed MIME Type Validation
Introduction
🔥2
🚨 New Bug Bounty Writeup
How a Single Unauthenticated GraphQL Request Compromised Mozilla Firefox CI — $12,000 Bounty
This writeup explores how a single unauthenticated GraphQL request led to the compromise of Mozilla Firefox CI, resulting in a $12,000 bug bounty. A great case study on GraphQL security, authentication flaws, and how a seemingly simple endpoint can have major impact.
🔗 Read the full writeup:
https://medium.com/@kenjisubagja/how-a-single-unauthenticated-graphql-request-compromised-mozilla-firefox-ci-12-000-bounty-b6b29bd0becb
How a Single Unauthenticated GraphQL Request Compromised Mozilla Firefox CI — $12,000 Bounty
This writeup explores how a single unauthenticated GraphQL request led to the compromise of Mozilla Firefox CI, resulting in a $12,000 bug bounty. A great case study on GraphQL security, authentication flaws, and how a seemingly simple endpoint can have major impact.
🔗 Read the full writeup:
https://medium.com/@kenjisubagja/how-a-single-unauthenticated-graphql-request-compromised-mozilla-firefox-ci-12-000-bounty-b6b29bd0becb
Medium
How a Single Unauthenticated GraphQL Request Compromised Mozilla Firefox CI — $12,000 Bounty
Overview
👍1
🚨 New Bug Bounty Writeup
How I Turned One Admin Account Into a Full Org Takeover
This writeup explores how a single compromised admin account was leveraged to escalate impact into a full organization takeover. A useful case study on privilege escalation, access control weaknesses, and vulnerability chaining in real-world bug bounty hunting.
🔗 Read the full writeup:
https://ameensec.medium.com/how-i-turned-one-admin-account-into-a-full-org-takeover-67f37c19a877
How I Turned One Admin Account Into a Full Org Takeover
This writeup explores how a single compromised admin account was leveraged to escalate impact into a full organization takeover. A useful case study on privilege escalation, access control weaknesses, and vulnerability chaining in real-world bug bounty hunting.
🔗 Read the full writeup:
https://ameensec.medium.com/how-i-turned-one-admin-account-into-a-full-org-takeover-67f37c19a877
Medium
How I Turned One Admin Account Into a Full Org Takeover
Note: The target’s name has been withheld and replaced with example.com, since this report is still under responsible disclosure / private…
👍1
🚨 New Bug Bounty Writeup
How I Chained an Unauthenticated OAuth Registration Endpoint into Full Account Takeover
This writeup explores how an unauthenticated OAuth registration endpoint was chained with other weaknesses to escalate the impact into full account takeover. A practical case study on OAuth security, authentication flaws, and vulnerability chaining.
🔗 Read the full writeup:
https://medium.com/@divakarvasani3938/how-i-chained-an-unauthenticated-oauth-registration-endpoint-into-full-account-takeover-a6bc41e93a62
How I Chained an Unauthenticated OAuth Registration Endpoint into Full Account Takeover
This writeup explores how an unauthenticated OAuth registration endpoint was chained with other weaknesses to escalate the impact into full account takeover. A practical case study on OAuth security, authentication flaws, and vulnerability chaining.
🔗 Read the full writeup:
https://medium.com/@divakarvasani3938/how-i-chained-an-unauthenticated-oauth-registration-endpoint-into-full-account-takeover-a6bc41e93a62
Medium
How I Chained an Unauthenticated OAuth Registration Endpoint into Full Account Takeover
A walkthrough of abusing RFC 7591 Dynamic Client Registration left open in production
❤1