Intro,
Hi, its me again.
In this write-up I will talk about my four bugs (one critical and three of medium severity) I discovered on a single web application two month ago. All vulnerabilities are API related, So I hope you like it.
I will try my bes...

Advanced Oauth secrets Leads To Bugs Critical With ScenarioS Lead To Account Takeover(ATO) , CSRF , Open Redirect

How a Loose Origin Check Opened the Door to Credential Theft on a Production Login Page

This write-up is about how I found that one line of JavaScript code was leading to an account takeover. The target has its own bug bounty…

Today, we will be discussing how to exploit DOM-based XSS through Misconfigured Postmessage function. Two sites can communicate with each…

What is PostMessage?

This month I found a rather peculiar bug, I found the following code fragment in an endpoint responsible for communicating with the main…

On July 24, 2021, @irisrumtub discovered it was possible to insert an XSS payload encoded in an SVG file by using `data:` url's in the admin's rich text editor.
Our engineers deployed a fix that...

Hi everybody, our story today will be about how I was able to get a Full account takeover on HubSpot Public Bug Bounty Program at Bugcrowd…

“Even the most routine endpoints can hide high-impact vulnerabilities.”

For Non-Members: Free-Link

Hi,

# Description

I've been researching new ways to steal OAuth codes and access-tokens using postMessage, and I found a way for me to steal the code and/or access-token from Apple-sign-in on...

Hi guy, I am a bug hunter, have 3–4 years of experience