Multi-Tenant Authorization Bypass via Host Header Manipulation
Discovered a multi-tenant authorization bypass by manipulating the Host header, affecting tenant isolation in a private bug bounty program.
From Wayback Machine to AWS Metadata: Uncovering SSRF in a Production System Within 5 Minutes
How I leveraged Wayback Machine URLs to uncover a Server-Side Request Forgery vulnerability leading to internal file access in a production system.
S3 Bucket Takeover: Discovering a Bucket Inside a Bucket for $1000
How I used Wayback Machine to discover an SSRF vulnerability leading to AWS metadata exposure in a private program.
From Long-Term Hacking to Instant Rewards: Finding SQLi in 3 Minutes — $3125
How I found an SQL injection vulnerability by staying patient and focused on a long-term target.
Hacking For 20 Hours in a Private Bug Bounty Program
I dedicated 20 hours to a private bug bounty program and share my methodology, mindset and findings.
Attacking Misconfigured Spring Boot Actuators
How exposed Spring Boot Actuator endpoints can lead to critical vulnerabilities in real bug bounty programs.
Server Side Request Forgery in Company with €900M+ Revenue
An interesting and somewhat sad story involving LFI and SSRF chains found exactly one year into bug bounty.
Account Takeover via XSS in e-Signature Feature — $2500
Found a stored XSS in an HR application integrated system while testing name field parameters.
Server Side Request Forgery with Huge Impact in Production Application
A Server-Side Request Forgery (SSRF) I found on a large-scope program. Full recon process included.
Reflected XSS on pro.sony with Google Dork & Akamai WAF Bypass
My last reflected XSS write-up before moving on to more complex vulnerabilities.
Get Reflected XSS within 3 minutes
Found a reflected XSS on 8x8 within 3 minutes using subdomain enumeration and a simple payload.
Sony Bug Bounty — Stored XSS on Subdomain
My first bug bounty writeup. Found an XSS vulnerability on a Sony subdomain via subdomain enumeration and parameter fuzzing.