Basic Web Enumeration.
https://r4vindra.medium.com/basic-web-enumeration-13ab72eaf8b2?source=rss------bug_bounty-5

This Write-up is all about the Basic and fast web enumeration while doing bug hunting web applications, Here, you will get to know the…Continue reading on Medium » (https://r4vindra.medium.com/basic-web-enumeration-13ab72eaf8b2?source=rss------bug_bounty-5)

Bug Bounty Hunters in Web3: How to Start and How Much You Can Make
https://medium.com/@JohnnyTime/bug-bounty-hunters-in-web3-how-to-start-and-how-much-you-can-make-e311fc0d5cb7?source=rss------bug_bounty-5

Security subject in Web3 is a big deal. In 2024, the Web3 ecosystem experienced a significant surge in cyberattacks, with hackers stealing…Continue reading on Medium » (https://medium.com/@JohnnyTime/bug-bounty-hunters-in-web3-how-to-start-and-how-much-you-can-make-e311fc0d5cb7?source=rss------bug_bounty-5)

The Origins of XSS (Cross-Site Scripting)
https://thexssrat.medium.com/the-origins-of-xss-cross-site-scripting-628dde3ac4b6?source=rss------bug_bounty-5

First of all, I heard you like free stuff so I made free stuff for you so you can enjoy your free stuff while you enjoy your free stuff ……Continue reading on Medium » (https://thexssrat.medium.com/the-origins-of-xss-cross-site-scripting-628dde3ac4b6?source=rss------bug_bounty-5)

Red Nexus CTF v1.0, and how we made it to first place!
https://medium.com/@shxsu1/red-nexus-ctf-v1-0-and-how-we-made-it-to-first-place-ca9f85502ead?source=rss------bug_bounty-5

Red Nexus — Hacking a Store Stuck in 2025Continue reading on Medium » (https://medium.com/@shxsu1/red-nexus-ctf-v1-0-and-how-we-made-it-to-first-place-ca9f85502ead?source=rss------bug_bounty-5)

Red Nexus CTF v1.0, and how we made it to first place!

Red Nexus — Hacking a Store Stuck in 2025Continue reading on Medium »
Read more...

LFI to RCE using file upload
https://www.reddit.com/r/Pentesting/comments/1kr03kv/lfi_to_rce_using_file_upload/

<!-- SC_OFF -->I found an LFI(absolute path), I'm able to download critical internal files like passwd, shadow etc. Its a java based application. There's a file upload where I'm able to upload a .jsp file but when i try to access the file it's getting downloaded(same LFI endpoint: file=/var/www/html/app/doc/timestamp_filename.jsp) not executed on the go any ideas how to access the file without downloading? <!-- SC_ON --> submitted by /u/PaleBrother8344 (https://www.reddit.com/user/PaleBrother8344)
[link] (https://www.reddit.com/r/Pentesting/comments/1kr03kv/lfi_to_rce_using_file_upload/) [comments] (https://www.reddit.com/r/Pentesting/comments/1kr03kv/lfi_to_rce_using_file_upload/)

Cloudflare Bug Bounty: First Old Password Does Not Expire After Password Change
https://medium.com/@iambuvanesh/cloudflare-bug-bounty-first-old-password-does-not-expire-after-password-change-b767a050d231?source=rss------bug_bounty-5

Hi Security World!
 Today, I’m sharing an interesting bug I discovered in Cloudflare’s dashboard involving password management — a…Continue reading on Medium » (https://medium.com/@iambuvanesh/cloudflare-bug-bounty-first-old-password-does-not-expire-after-password-change-b767a050d231?source=rss------bug_bounty-5)

Cloudflare Bug Bounty: First Old Password Does Not Expire After Password Change

Hi Security World! Today, I’m sharing an interesting bug I discovered in Cloudflare’s dashboard involving password management — a…Continue reading on Medium »
Read more...

From Recon to Root: A MongoDB NoSQL Injection Bug Bounty Journey

Exploiting NoSQL injection to extract admin credentials from a MongoDB-backed application using BurpSuite and Boolean-based payloads.Continue reading on InfoSec Write-ups »
Read more...

️ How I Found FTP Credentials in a Python Script on a NASA Subdomain

A real-world bug bounty story of how FTP credentials, internal IPs, and paths were discovered in a Python script hosted on a NASA…Continue reading on Medium »
Read more...

Full-Blown SSRF to Gain Access to Millions of Users’ Records and Multiple Internal Panels

This write-up details an SSRF vulnerability that allowed unauthorized access to millions of sensitive data and internal services.Continue reading on Medium »
Read more...