Search for a command to run...
Articles tagged with #bugbountytips
Leaking a Cognito Identity Pool ID is often dismissed as a low-impact information disclosure. But when the IAM policy attached to the unauthenticated role is misconfigured, that "low-impact" leak becomes a direct path into the cloud infrastructure. W...
We all have those endpoints we instantly ignore in our HTTP history. You see GET /favicon.ico, you ignore it. You see GET /assets/logo.png, you ignore it. And usually, when you see GET /health, you ignore that too. Why? Because 99.9% of the time, the...
TL;DR ? I signed up using any unclaimed email on application_2 (e.g., [email protected]) due to no email verification, then logged into the victim's account on application_1 using the SSO feature that allowed me to log in using application_2. Introd...
Introduction Today, I want to share a thrilling adventure, a tale of how a few seemingly harmless bugs can snowball into a security nightmare. Through collaborative work with my friend DreyAnd back in April 2023, we managed to expose vulnerabilities ...
Introduction In this blog post, I will walk you through the discovery of a critical vulnerability in redacted.com. This vulnerability allowed me to take over any user's account by exploiting a subdomain takeover, which led to account takeovers due to...
