Series

Bugbounty Writeups

From Editor to Owner: One Writable Field Was Enough to Take Over an Organization
Severity: HighBounty: ~$315Platform: Standoff365 This one came down to a single field that should never have been writable by an editor: Firm[user_id] The application had a clear permission model. An
Aug 17, 202612 min read22
A $2,000 API Key: Unauthorized Access to Paid Medical Transcription
Severity: HighBounty: $2,000Retest Reward: $150Total Awarded: $2,150Program: Private ProgramPlatform: HackerOne This finding started with a familiar Android testing problem: What secrets were shipped
Aug 7, 202612 min read9
From Profile IDOR to Zero-Click Account Takeover: Changing One userid Parameter Was Enough
Severity: CriticalBounty: $1,805Program: Private Bug BountyPlatform: Bugbounty.sa This started as a straightforward profile IDOR. An authenticated user could change a userid parameter and load another
Jul 30, 202613 min read10
IDOR in Government Ownership API Exposed Private Business Owner PII via CR Number Enumeration
Severity: HighBounty Awarded: $1,506Program: Private Bug BountyPlatform: Bugbounty.sa Some IDORs are obvious immediately. You change an ID. Someone else’s data appears. Easy. Others look harmless at f
May 21, 20266 min read34
Zero-Click Stored XSS in Chat: When “Just Open the Window” Is Enough
Severity: HighBounty Awarded: $394Program: Private Bug BountyPlatform: Bugbounty.sa Most chat XSS bugs are noisy. You send a payload. The victim has to click something. Refresh the page. Open the mes
May 18, 20269 min read26
From Username Enumeration to Subscriber PII: Chaining 3 Weak Findings in a Telecom Ecosystem
Severity: MediumBounty Awarded: $560Program: Private Bug Bounty Most hunters have encountered login enumeration and immediately deprioritized it. Different response. Different redirect. Different word
May 15, 20268 min read69

Command Palette