Bug Bounty Hunting — Complete Guide (Part-163)
The Reporting-Endpoints HTTP response header is the current and recommended standard mechanism for defining named endpoints that receive…Continue reading on Medium »
Read more...
The Reporting-Endpoints HTTP response header is the current and recommended standard mechanism for defining named endpoints that receive…Continue reading on Medium »
Read more...
Medium
Bug Bounty Hunting — Complete Guide (Part-163)
The Reporting-Endpoints HTTP response header is the current and recommended standard mechanism for defining named endpoints that receive…
How I Check for Subdomain Takeovers Part 1
Subdomain takeovers is a high risk vulnerability that negatively impacts businesses, but if found, can result in big rewards for a bug…Continue reading on InfoSec Write-ups »
Read more...
Subdomain takeovers is a high risk vulnerability that negatively impacts businesses, but if found, can result in big rewards for a bug…Continue reading on InfoSec Write-ups »
Read more...
Medium
How I Check for Subdomain Takeovers Part 1
Subdomain takeovers is a high risk vulnerability that negatively impacts businesses, but if found, can result in big rewards for a bug…
How to Pick the Right Bug Bounty Target
With the thousands of Bug Bounty Programs currently hosted on Intigriti, HackerOne, Bugcrowd and other platforms, it is very easy to get paralyzed and waste time wondering which target to pick, instead of actually hunting for bugs. In this article, I will give you some valuable tips which will surely help you overcome this fear of not choosing the right target.The Scope This is probably the most important indicator of all. If you are great at doing recon, you are missing out on bugs by choosing a target with a very strict scope. There are plenty of programs which have wildcard domains, meaning that you can search for bugs in all the subdomains of that domain, which obviously expands your scope a lot, depending on how many subdomains that domain has.The Average Response/Decision Time Programs with high decision time not only demotivate the researchers by keeping them waiting for long periods of time, but they also increase the chances of your findings being duplicates. For that reason, you should aim for programs with lower decision times. I usually aim for programs with under 3 weeks decision time.How Many Bugs were Found This metric is quite useful if the scope is taken into context. Programs with large scopes will usually have more bugs submitted to them, whereas smaller programs might have only a few per month. If a program has a huge number of accepted submissions in the last few months this might mean that you are running a high risk of getting a duplicate. However, if a program lacks recently accepted submissions, this is a good indicator that the whole scope has been exhaustively scanned for vulnerabilities, so it might be a good idea to avoid a program like this altogether.Target’s Industry Even though it is not strictly necessary, it is advantageous that you like the industry of your target so it is less tiring when you are hunting. I, for example, do not enjoy bug hunting on crypto/trading related applications. With experience, you will start to notice which types of targets you enjoy the most.Program Age When a target is launched, your chances of finding a bug increase a lot. If a program is recent, it will almost surely have a huge amount of “low-hanging fruit”: simple bugs which are easy to spot. The same applies when new scope is added to an already existing program. The fewer hunters have inspected the target for bugs, the bigger chance you have of finding them.Conclusion As you can see, there are several factors that contribute to a target being a good fit for you or not. Wide (and fresh) scope, with a quick response time can massively increase your bug bounty results. If you have any doubts, do not forget to share them in the comments! If you don’t know which bugs to look for, you can check out this article where I present the easiest bug you can find in 2025. How to Pick the Right Bug Bounty Target was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
With the thousands of Bug Bounty Programs currently hosted on Intigriti, HackerOne, Bugcrowd and other platforms, it is very easy to get paralyzed and waste time wondering which target to pick, instead of actually hunting for bugs. In this article, I will give you some valuable tips which will surely help you overcome this fear of not choosing the right target.The Scope This is probably the most important indicator of all. If you are great at doing recon, you are missing out on bugs by choosing a target with a very strict scope. There are plenty of programs which have wildcard domains, meaning that you can search for bugs in all the subdomains of that domain, which obviously expands your scope a lot, depending on how many subdomains that domain has.The Average Response/Decision Time Programs with high decision time not only demotivate the researchers by keeping them waiting for long periods of time, but they also increase the chances of your findings being duplicates. For that reason, you should aim for programs with lower decision times. I usually aim for programs with under 3 weeks decision time.How Many Bugs were Found This metric is quite useful if the scope is taken into context. Programs with large scopes will usually have more bugs submitted to them, whereas smaller programs might have only a few per month. If a program has a huge number of accepted submissions in the last few months this might mean that you are running a high risk of getting a duplicate. However, if a program lacks recently accepted submissions, this is a good indicator that the whole scope has been exhaustively scanned for vulnerabilities, so it might be a good idea to avoid a program like this altogether.Target’s Industry Even though it is not strictly necessary, it is advantageous that you like the industry of your target so it is less tiring when you are hunting. I, for example, do not enjoy bug hunting on crypto/trading related applications. With experience, you will start to notice which types of targets you enjoy the most.Program Age When a target is launched, your chances of finding a bug increase a lot. If a program is recent, it will almost surely have a huge amount of “low-hanging fruit”: simple bugs which are easy to spot. The same applies when new scope is added to an already existing program. The fewer hunters have inspected the target for bugs, the bigger chance you have of finding them.Conclusion As you can see, there are several factors that contribute to a target being a good fit for you or not. Wide (and fresh) scope, with a quick response time can massively increase your bug bounty results. If you have any doubts, do not forget to share them in the comments! If you don’t know which bugs to look for, you can check out this article where I present the easiest bug you can find in 2025. How to Pick the Right Bug Bounty Target was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Medium
How to Pick the Right Bug Bounty Target
With the thousands of Bug Bounty Programs currently hosted on Intigriti, HackerOne, Bugcrowd and other platforms, it is very easy to get…
Deepfake Deception: How I Hacked Biometric Authentication with $ and a YouTube Video
Free Link 🎈Continue reading on InfoSec Write-ups »
Read more...
Free Link 🎈Continue reading on InfoSec Write-ups »
Read more...
Medium
Deepfake Deception: How I Hacked Biometric Authentication with $ and a YouTube Video 🤖
Free Link 🎈
How I Tricked an AI Into Spilling Its Secrets (And Made a Pretty Penny)
Free Link🎈Continue reading on InfoSec Write-ups »
Read more...
Free Link🎈Continue reading on InfoSec Write-ups »
Read more...
Medium
How I Tricked an AI Into Spilling Its Secrets (And Made a Pretty Penny)
Free Link🎈
Your Smart Speaker is Dumber Than You Think: How I Made Alexa’s Sister Spill the Tea
Free Link 🎈Continue reading on InfoSec Write-ups »
Read more...
Free Link 🎈Continue reading on InfoSec Write-ups »
Read more...
Medium
Your Smart Speaker is Dumber Than You Think: How I Made Alexa’s Sister Spill the Tea
Free Link 🎈
Top 3 tools for Bug Bounty/Pentesting (2025)
There are lots of web app security tools. Some of them are very well known, like BurpSuite, Nmap, Nuclei, ffuf, etc, whilst others, even though they are very good, have flown under the radar, or are not being used to the fullest of their potential by most hackers. I will share some tools/websites that will surely be very effective in your Bug Bounty adventures. All the tools mentioned have landed me bounties in the past.1. Waybackurls This tool, created by TomNomNom, fetches all the URLs of a domain in the Wayback Machine. Whilst this tool is not exactly new, a lot of hackers do not make the best use of it. The methodology I will sugggest is:Use waybackurls to fetch all URLs for a targetgrep the output file, so you’re searching for usually vulnerable parameters or paths (example: “redirect=”, “url=”, etc…)Test manually the results This way, you will become more time efficient and score more bugs.2.BreachCollection In breachcollection.com you can search for leaked credentials for your target. If your program allows it, you can try to log in with them, and if they are correct, you should report them. Here’s how to do it: 1. Register or Log in on BreachCollection.com 2. Make a query for your target. If you make a “Domain” query, you will receive all breached credentials that log you in on the target’s website. 3. If you make an “Email Domain” query, you will receive passwords whose corresponding email is associated with the target (for example, for “example.com”, you will receive all the results containing emails ending with “@example.com”) 4. Test these credentials, if you have permission to do so.Results page example for a “Email domain” query For Bug Bounty, credentials that lead access to admin panels, or employees’ credentials are the ones I recommend reporting the most. Some programs might not be very interested in user credentials (even though I have had luck reporting those in the past). Note: You should not perform these attacks on targets that do not allow Credential Spoofing Attacks, so be mindful of the Out of Scope rules. BreachCollection earns my recommendation because it offers a very complete database at a very affordable pricing, when compared to other alternatives. You can register and use it for free, but results will be censored, but it is good enough for you to have an idea of the size of the database.3. Crt.sh crt.sh is a Certificate Transparency Log Search Engine. It lets you search for SSL/TLS certificates issued for any domain, revealing subdomains, related domains, and more. You can leverage this tool to discover more subdomains on a target, helping you navigate through attack surface that many other hunters missed. You can combine this website with a tool like HTTPX to retrieve all responding subdomains, eliminating dead entries. Hope these tools help you. You can leave more suggestions in the comments! Top 3 tools for Bug Bounty/Pentesting (2025) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
There are lots of web app security tools. Some of them are very well known, like BurpSuite, Nmap, Nuclei, ffuf, etc, whilst others, even though they are very good, have flown under the radar, or are not being used to the fullest of their potential by most hackers. I will share some tools/websites that will surely be very effective in your Bug Bounty adventures. All the tools mentioned have landed me bounties in the past.1. Waybackurls This tool, created by TomNomNom, fetches all the URLs of a domain in the Wayback Machine. Whilst this tool is not exactly new, a lot of hackers do not make the best use of it. The methodology I will sugggest is:Use waybackurls to fetch all URLs for a targetgrep the output file, so you’re searching for usually vulnerable parameters or paths (example: “redirect=”, “url=”, etc…)Test manually the results This way, you will become more time efficient and score more bugs.2.BreachCollection In breachcollection.com you can search for leaked credentials for your target. If your program allows it, you can try to log in with them, and if they are correct, you should report them. Here’s how to do it: 1. Register or Log in on BreachCollection.com 2. Make a query for your target. If you make a “Domain” query, you will receive all breached credentials that log you in on the target’s website. 3. If you make an “Email Domain” query, you will receive passwords whose corresponding email is associated with the target (for example, for “example.com”, you will receive all the results containing emails ending with “@example.com”) 4. Test these credentials, if you have permission to do so.Results page example for a “Email domain” query For Bug Bounty, credentials that lead access to admin panels, or employees’ credentials are the ones I recommend reporting the most. Some programs might not be very interested in user credentials (even though I have had luck reporting those in the past). Note: You should not perform these attacks on targets that do not allow Credential Spoofing Attacks, so be mindful of the Out of Scope rules. BreachCollection earns my recommendation because it offers a very complete database at a very affordable pricing, when compared to other alternatives. You can register and use it for free, but results will be censored, but it is good enough for you to have an idea of the size of the database.3. Crt.sh crt.sh is a Certificate Transparency Log Search Engine. It lets you search for SSL/TLS certificates issued for any domain, revealing subdomains, related domains, and more. You can leverage this tool to discover more subdomains on a target, helping you navigate through attack surface that many other hunters missed. You can combine this website with a tool like HTTPX to retrieve all responding subdomains, eliminating dead entries. Hope these tools help you. You can leave more suggestions in the comments! Top 3 tools for Bug Bounty/Pentesting (2025) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Medium
Top 3 tools for Bug Bounty/Pentesting (2025)
There are lots of web app security tools. Some of them are very well known, like BurpSuite, Nmap, Nuclei, ffuf, etc, whilst others, even…
How I Turned a 403 Error into a $200 API Key Leak Bounty
Hello everyone, Today I’ll explain how I turned a 403 error into a $200 Supabase key leakThis is a detailed breakdown of the same finding I shared on LinkedIn: https://www.linkedin.com/posts/jeet-pal-22601a290_bugbounty-activity-7395416068464254976-DqA8 I had been testing the target for 5–6 days and had already reported multiple business logic and BAC issues. When I finished the main scope, I rechecked the domains to see if anything new appeared. One endpoint that previously returned a 500 error was now showing a 403, which caught my attention. I decided to test it further and started fuzzing the domain using SecListsffuf -w seclists/Discovery/Web-Content/directory-list-2.3-big.txt -u https://stage.mpc.Example.com/FUZZ I found a directory named demo-test-engine. Its page source contained an exposed Supabase key. I reported it, and after validation, the team fixed the issue and awarded a bounty.FixedBounty Connect with me LinkedIn: https://www.linkedin.com/in/jeet-pal-22601a290/ Instagram: https://www.instagram.com/jeetpal.2007/ X/Twitter: https://x.com/Mr_mars_hacker If you want to exchange program DM me on LinkedIn Join a community of 3,300+ security researchers on our Discord server, where we discuss Web3 vulnerabilities, audits, and much more! 🚀 👉 Join the server here: https://discord.gg/Y467qAFM4X How I Turned a 403 Error into a $200 API Key Leak Bounty was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Hello everyone, Today I’ll explain how I turned a 403 error into a $200 Supabase key leakThis is a detailed breakdown of the same finding I shared on LinkedIn: https://www.linkedin.com/posts/jeet-pal-22601a290_bugbounty-activity-7395416068464254976-DqA8 I had been testing the target for 5–6 days and had already reported multiple business logic and BAC issues. When I finished the main scope, I rechecked the domains to see if anything new appeared. One endpoint that previously returned a 500 error was now showing a 403, which caught my attention. I decided to test it further and started fuzzing the domain using SecListsffuf -w seclists/Discovery/Web-Content/directory-list-2.3-big.txt -u https://stage.mpc.Example.com/FUZZ I found a directory named demo-test-engine. Its page source contained an exposed Supabase key. I reported it, and after validation, the team fixed the issue and awarded a bounty.FixedBounty Connect with me LinkedIn: https://www.linkedin.com/in/jeet-pal-22601a290/ Instagram: https://www.instagram.com/jeetpal.2007/ X/Twitter: https://x.com/Mr_mars_hacker If you want to exchange program DM me on LinkedIn Join a community of 3,300+ security researchers on our Discord server, where we discuss Web3 vulnerabilities, audits, and much more! 🚀 👉 Join the server here: https://discord.gg/Y467qAFM4X How I Turned a 403 Error into a $200 API Key Leak Bounty was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Linkedin
#bugbounty | JEET PAL
Tip:Fuzz the demo endpoint
DM to exchange the program
#bugbounty
DM to exchange the program
#bugbounty
Reflected XSS in OAuth Callback Endpoint
Free Article Link: Click for free!Continue reading on InfoSec Write-ups »
Read more...
Free Article Link: Click for free!Continue reading on InfoSec Write-ups »
Read more...
Medium
Reflected XSS in OAuth Callback Endpoint
Free Article Link: Click for free!
When AI Gossips: How I Eavesdropped on a Federated Learning System
You know that feeling when you’re at a party, and you can piece together everyone’s drama just by listening to random conversation…Continue reading on InfoSec Write-ups »
Read more...
You know that feeling when you’re at a party, and you can piece together everyone’s drama just by listening to random conversation…Continue reading on InfoSec Write-ups »
Read more...
Medium
When AI Gossips: How I Eavesdropped on a Federated Learning System
You know that feeling when you’re at a party, and you can piece together everyone’s drama just by listening to random conversation…
How I Check for Subdomain Takeovers Part 1
Subdomain takeovers is a high risk vulnerability that negatively impacts businesses, but if found, can result in big rewards for a bug…Continue reading on InfoSec Write-ups »
Read more...
Subdomain takeovers is a high risk vulnerability that negatively impacts businesses, but if found, can result in big rewards for a bug…Continue reading on InfoSec Write-ups »
Read more...
Medium
How I Check for Subdomain Takeovers Part 1
Subdomain takeovers is a high risk vulnerability that negatively impacts businesses, but if found, can result in big rewards for a bug…
A new Tool for Silent Device Tracking
https://www.reddit.com/r/redteamsec/comments/1pn0ea2/a_new_tool_for_silent_device_tracking/
<!-- SC_OFF --> Hey everyone, I just released WaSonar, an WhatsApp reconnaissance tool that can enumerate how many devices are linked to an account (Desktop/Web/Phone), figure out when they come online using silent RTT probes, and remotely exhaust a target's battery, data, and performance with zero user interaction or alerts. Try it out (no setup needed): npx wasonar-cli login or install via npm install -g wasonar-cli Source: https://github.com/AjayAntoIsDev/wasonar <!-- SC_ON --> submitted by /u/Floopy1704 (https://www.reddit.com/user/Floopy1704)
[link] (https://github.com/AjayAntoIsDev/WaSonar) [comments] (https://www.reddit.com/r/redteamsec/comments/1pn0ea2/a_new_tool_for_silent_device_tracking/)
https://www.reddit.com/r/redteamsec/comments/1pn0ea2/a_new_tool_for_silent_device_tracking/
<!-- SC_OFF --> Hey everyone, I just released WaSonar, an WhatsApp reconnaissance tool that can enumerate how many devices are linked to an account (Desktop/Web/Phone), figure out when they come online using silent RTT probes, and remotely exhaust a target's battery, data, and performance with zero user interaction or alerts. Try it out (no setup needed): npx wasonar-cli login or install via npm install -g wasonar-cli Source: https://github.com/AjayAntoIsDev/wasonar <!-- SC_ON --> submitted by /u/Floopy1704 (https://www.reddit.com/user/Floopy1704)
[link] (https://github.com/AjayAntoIsDev/WaSonar) [comments] (https://www.reddit.com/r/redteamsec/comments/1pn0ea2/a_new_tool_for_silent_device_tracking/)
Your Browser Is Spying On You — Here’s Proof
Hi Vipul from The Hacker’s Log here 👋 Let me tell you a story that starts innocently… and ends with your browser knowing where you’ve…Continue reading on InfoSec Write-ups »
Read more...
Hi Vipul from The Hacker’s Log here 👋 Let me tell you a story that starts innocently… and ends with your browser knowing where you’ve…Continue reading on InfoSec Write-ups »
Read more...
Medium
Your Browser Is Spying On You 👀 — Here’s Proof
Hi Vipul from The Hacker’s Log here 👋 Let me tell you a story that starts innocently… and ends with your browser knowing where you’ve…
I Didn’t Hack Anything — The App Gave Me Admin Access by Itself
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Medium
🪜🔓 I Didn’t Hack Anything — The App Gave Me Admin Access by Itself
Hey there!😁
How I Bypassed Voucher Limits Using a Race Condition Vulnerability
So last night I played a CTF. Of course, it was free and with no prize. I know you are not here to listen my bla bla bla about my CTF…Continue reading on InfoSec Write-ups »
Read more...
So last night I played a CTF. Of course, it was free and with no prize. I know you are not here to listen my bla bla bla about my CTF…Continue reading on InfoSec Write-ups »
Read more...
Medium
How I Bypassed Voucher Limits Using a Race Condition Vulnerability
So last night I played a CTF. Of course, it was free and with no prize. I know you are not here to listen my bla bla bla about my CTF…
The Paradox of the 3.4 Million: Why You Can’t Find a Job in a “Desperate” Industry
If you scroll through LinkedIn or read the latest annual reports from (ISC)², you will see the same headline repeated ad nauseam: “The…Continue reading on InfoSec Write-ups »
Read more...
If you scroll through LinkedIn or read the latest annual reports from (ISC)², you will see the same headline repeated ad nauseam: “The…Continue reading on InfoSec Write-ups »
Read more...
Medium
The Paradox of the 3.4 Million: Why You Can’t Find a Job in a “Desperate” Industry
** Not a Member?? CLICK HERE to read Full-Story**
dig Command Explained: A Simple Guide to DNS Lookups for Networking & Cybersecurity
Learn what the dig command is, how DNS works, and how dig helps debug and investigate DNS in networking and cybersecurity.Continue reading on Medium »
Read more...
Learn what the dig command is, how DNS works, and how dig helps debug and investigate DNS in networking and cybersecurity.Continue reading on Medium »
Read more...
Medium
🔍 dig Command Explained: A Simple Guide to DNS Lookups for Networking & Cybersecurity
Learn what the dig command is, how DNS works, and how dig helps debug and investigate DNS in networking and cybersecurity.
Your Browser Is Spying On You — Here’s Proof
Hi Vipul from The Hacker’s Log here 👋 Let me tell you a story that starts innocently… and ends with your browser knowing where you’ve…Continue reading on InfoSec Write-ups »
Read more...
Hi Vipul from The Hacker’s Log here 👋 Let me tell you a story that starts innocently… and ends with your browser knowing where you’ve…Continue reading on InfoSec Write-ups »
Read more...
Medium
Your Browser Is Spying On You 👀 — Here’s Proof
Hi Vipul from The Hacker’s Log here 👋 Let me tell you a story that starts innocently… and ends with your browser knowing where you’ve…
How I Bypassed Voucher Limits Using a Race Condition Vulnerability
So last night I played a CTF. Of course, it was free and with no prize. I know you are not here to listen my bla bla bla about my CTF…Continue reading on InfoSec Write-ups »
Read more...
So last night I played a CTF. Of course, it was free and with no prize. I know you are not here to listen my bla bla bla about my CTF…Continue reading on InfoSec Write-ups »
Read more...
Medium
How I Bypassed Voucher Limits Using a Race Condition Vulnerability
So last night I played a CTF. Of course, it was free and with no prize. I know you are not here to listen my bla bla bla about my CTF…
The Paradox of the 3.4 Million: Why You Can’t Find a Job in a “Desperate” Industry
If you scroll through LinkedIn or read the latest annual reports from (ISC)², you will see the same headline repeated ad nauseam: “The…Continue reading on InfoSec Write-ups »
Read more...
If you scroll through LinkedIn or read the latest annual reports from (ISC)², you will see the same headline repeated ad nauseam: “The…Continue reading on InfoSec Write-ups »
Read more...
Medium
The Paradox of the 3.4 Million: Why You Can’t Find a Job in a “Desperate” Industry
** Not a Member?? CLICK HERE to read Full-Story**
Bug Bounty Burnout and the Boredom of Repetitive Tasks
Twitter highlights, leaderboard screenshots, five-figure payouts, and “first critical of the month” posts paint a picture of constant…Continue reading on Medium »
Read more...
Twitter highlights, leaderboard screenshots, five-figure payouts, and “first critical of the month” posts paint a picture of constant…Continue reading on Medium »
Read more...
Medium
Bug Bounty Burnout and the Boredom of Repetitive Tasks
Twitter highlights, leaderboard screenshots, five-figure payouts, and “first critical of the month” posts paint a picture of constant…