Cross-Site Scripting (XSS) attacks are often associated with web applications, but they can also be critical in Android application…Continue reading on Medium » (https://medium.com/@anandrishav2228/earn-10-000-xss-in-android-apps-scratch-to-advance-cb3aa6c2b98f?source=rss------bug_bounty-5)
Correct Innerstanding + Overstanding
https://medium.com/@onelovemafia/correct-innerstanding-overstanding-8d3cfd9baa7d?source=rss------bug_bounty-5
https://medium.com/@onelovemafia/correct-innerstanding-overstanding-8d3cfd9baa7d?source=rss------bug_bounty-5
Bet on ⭕️Continue reading on Medium » (https://medium.com/@onelovemafia/correct-innerstanding-overstanding-8d3cfd9baa7d?source=rss------bug_bounty-5)
How I Earned My First Bug Bounty: A Beginner’s Story
https://medium.com/@kingstar75114/how-i-earned-my-first-bug-bounty-a-beginners-story-58e8a3023cc6?source=rss------bug_bounty-5
Beginner First Bounty with Reality Continue reading on Medium » (https://medium.com/@kingstar75114/how-i-earned-my-first-bug-bounty-a-beginners-story-58e8a3023cc6?source=rss------bug_bounty-5)
https://medium.com/@kingstar75114/how-i-earned-my-first-bug-bounty-a-beginners-story-58e8a3023cc6?source=rss------bug_bounty-5
Beginner First Bounty with Reality Continue reading on Medium » (https://medium.com/@kingstar75114/how-i-earned-my-first-bug-bounty-a-beginners-story-58e8a3023cc6?source=rss------bug_bounty-5)
Fix “Failed to load BApp” Burp Suite Extensions!
https://medium.com/@d3vilz50n/fix-failed-to-load-bapp-burp-suite-extensions-923efa10659d?source=rss------bug_bounty-5
https://medium.com/@d3vilz50n/fix-failed-to-load-bapp-burp-suite-extensions-923efa10659d?source=rss------bug_bounty-5
In this article I’ll make sure you fix the Failed to load BApp issueContinue reading on Medium » (https://medium.com/@d3vilz50n/fix-failed-to-load-bapp-burp-suite-extensions-923efa10659d?source=rss------bug_bounty-5)
How Two Hardcoded Credentials Led To Payment System Takeover, Exposed 20,000 Credit Cards & Enabled…
https://medium.com/@Berserker1337/how-two-hardcoded-credentials-led-to-payment-system-takeover-exposed-20-000-credit-cards-enabled-04b0ac232786?source=rss------bug_bounty-5
https://medium.com/@Berserker1337/how-two-hardcoded-credentials-led-to-payment-system-takeover-exposed-20-000-credit-cards-enabled-04b0ac232786?source=rss------bug_bounty-5
Earn $10,000 XSS in Android Apps Scratch to Advance.
Cross-Site Scripting (XSS) attacks are often associated with web applications, but they can also be critical in Android application…Continue reading on Medium »
Read more...
Cross-Site Scripting (XSS) attacks are often associated with web applications, but they can also be critical in Android application…Continue reading on Medium »
Read more...
Medium
Earn $10,000 XSS in Android Apps Scratch to Advance.
Cross-Site Scripting (XSS) attacks are often associated with web applications, but they can also be critical in Android application…
How I Earned My First Bug Bounty: A Beginner’s Story
Beginner First Bounty with Reality Continue reading on Medium »
Read more...
Beginner First Bounty with Reality Continue reading on Medium »
Read more...
Medium
How I Earned My First Bug Bounty: A Beginner’s Story
Beginner First Bounty with Reality
Fix “Failed to load BApp” Burp Suite Extensions!
In this article I’ll make sure you fix the Failed to load BApp issueContinue reading on Medium »
Read more...
In this article I’ll make sure you fix the Failed to load BApp issueContinue reading on Medium »
Read more...
Medium
Fix “Failed to load BApp” Burp Suite Extensions!
In this article I’ll make sure you fix the Failed to load BApp issue
How Two Hardcoded Credentials Led To Payment System Takeover, Exposed 20,000 Credit Cards & Enabled…
Introduction:Continue reading on Medium »
Read more...
Introduction:Continue reading on Medium »
Read more...
Medium
How Two Hardcoded Credentials Led To Payment System Takeover, Exposed 20,000 Credit Cards & Enabled…
Introduction:
The Story of How I Hacked an International University in Indonesia
My friend suggested I sign up for a university to get a degree (such a thoughtful friend 🫡). He even sent me the registration link. Being my usual curious self, I decided to check out the website’s vulnerabilities. I used temp-mail.org to get a temporary email for the registration process. After signing up, I got a verification link to activate my account. Once activated and logged in to the system, I opened the network panel, started analyzing the website’s requests, and stumbled upon some interesting URLs. I copied the request as a cURL command, ran it, and got the response in JSON format. and if I change the request and set the ID to 37 I get this response (Looks like I found an IDOR vulnerability before GTA 6 dropped 🙂↔️). Turns out the website has an IDOR vulnerability that lets me access everyone’s data in the database. The best part? I can see their NIK (citizenship number), email, and even their password reset tokens which could easily lead to an account takeover. Alright, let me cook folks. 👨🍳 I went back to the login page and navigated to the reset password page to request a new password As we can see, the link contains the user token, which we can access, thanks to the previous IDOR vulnerability. So, I decided to create a new user account just to hack myself 👻. I requested a password reset and sent it to my other account. Then, I checked the user reset password token, replaced it with the token I grabbed earlier, and boom 💥 I successfully changed my other account’s password. This same trick could work on any account on the website. After this little experiment, I reported the issue to their IT team and shared suggestions on how they could prevent this kind of attack in the future. 🛠️ What can we learn from this story?If you come across a website using a front-end framework, that’s a win, it makes it easier to analyze the APIs they’re sending.Find a friend who cares about your education ✌🏻; they might just send you a similar link 🥹And remember: never trust user input. Always validate and sanitize! Tools:https://curl.se/ The Story of How I Hacked an International University in Indonesia was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
My friend suggested I sign up for a university to get a degree (such a thoughtful friend 🫡). He even sent me the registration link. Being my usual curious self, I decided to check out the website’s vulnerabilities. I used temp-mail.org to get a temporary email for the registration process. After signing up, I got a verification link to activate my account. Once activated and logged in to the system, I opened the network panel, started analyzing the website’s requests, and stumbled upon some interesting URLs. I copied the request as a cURL command, ran it, and got the response in JSON format. and if I change the request and set the ID to 37 I get this response (Looks like I found an IDOR vulnerability before GTA 6 dropped 🙂↔️). Turns out the website has an IDOR vulnerability that lets me access everyone’s data in the database. The best part? I can see their NIK (citizenship number), email, and even their password reset tokens which could easily lead to an account takeover. Alright, let me cook folks. 👨🍳 I went back to the login page and navigated to the reset password page to request a new password As we can see, the link contains the user token, which we can access, thanks to the previous IDOR vulnerability. So, I decided to create a new user account just to hack myself 👻. I requested a password reset and sent it to my other account. Then, I checked the user reset password token, replaced it with the token I grabbed earlier, and boom 💥 I successfully changed my other account’s password. This same trick could work on any account on the website. After this little experiment, I reported the issue to their IT team and shared suggestions on how they could prevent this kind of attack in the future. 🛠️ What can we learn from this story?If you come across a website using a front-end framework, that’s a win, it makes it easier to analyze the APIs they’re sending.Find a friend who cares about your education ✌🏻; they might just send you a similar link 🥹And remember: never trust user input. Always validate and sanitize! Tools:https://curl.se/ The Story of How I Hacked an International University in Indonesia was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Medium
The Story of How I Hacked an International University in Indonesia
My friend suggested I sign up for a university to get a degree (such a thoughtful friend 🫡). He even sent me the registration link. Being…
How I Broke Into My Dev Friend’s Website in Less Than 24 Hour
You know what they say about ‘bulletproof’ websites? They never are. My dev friend swore his site was unhackable.Continue reading on InfoSec Write-ups »
Read more...
You know what they say about ‘bulletproof’ websites? They never are. My dev friend swore his site was unhackable.Continue reading on InfoSec Write-ups »
Read more...
Medium
How I Broke Into My Dev Friend’s Website in Less Than 24 Hour
You know what they say about ‘bulletproof’ websites? They never are. My dev friend swore his site was unhackable.
Firebase URL Exploitation: Taking Over Android Databases Like a Pro!
Free ReadContinue reading on InfoSec Write-ups »
Read more...
Free ReadContinue reading on InfoSec Write-ups »
Read more...
Medium
🚀 Firebase URL Exploitation: Taking Over Android Databases Like a Pro! 😎
Free Read
The Story of How I Hacked an International University in Indonesia
My friend suggested I sign up for a university to get a degree (such a thoughtful friend 🫡). He even sent me the registration link. Being…Continue reading on InfoSec Write-ups »
Read more...
My friend suggested I sign up for a university to get a degree (such a thoughtful friend 🫡). He even sent me the registration link. Being…Continue reading on InfoSec Write-ups »
Read more...
Medium
The Story of How I Hacked an International University in Indonesia
My friend suggested I sign up for a university to get a degree (such a thoughtful friend 🫡). He even sent me the registration link. Being…