bug bounty writeups

A list of available Bug Bounty & Disclosure Programs and Write-ups.

Table of Contents

• Cross Site Scripting (XSS)
• Cross Site Request Forgery (CSRF)
• Clickjacking (UI Redressing Attack)
• Local File Inclusion (LFI)
• Subdomain Takeover
• Denial of Service (DOS)
• Authentication Bypass
• SQL injection
• Insecure Direct Object Reference (IDOR)
• 2FA bypass
• Server Side Request Forgery (SSRF)
• Race Condition
• Remote Code Execution (RCE)
• External XML Entity Attack (XXE)
• Insecure Deserialization
• Business Logic Flaw
• HTTP Header Injection
• Server-Side Template Injection (SSTI)
• Broken link hijacking (BLH)
• DOM-based vulnerabilities
• Cross-origin resource sharing (CORS)
• HTTP request smuggling
• OS command injection
• Directory traversal
• WebSockets Attack
• Web cache poisoning
• Information disclosure
• CRLF injection

Cross Site Scripting (XSS)

Cross Site Request Forgery (CSRF)

Clickjacking (UI Redressing Attack)

Local File Inclusion (LFI)

Subdomain Takeover

Denial of Service (DOS)

Authentication Bypass

SQL injection

• Fun sql injection — mod_security bypass
• How I Found Sql Injection on 8x8 , Cengage,Comodo,Automattic,20 company
• Admin Panel Accessed Via SQL Injection…
• Sql Injection via hidden parameter
• Time Based Blind SQL Injection
• How i got easy $$$ for SQL Injection Bug
• Turning Blind Error Based SQL Injection into Exploitable Boolean One
• SQL Injection & Remote Code Execution - Double P1
• double qoute injection
• Akamai Web Application Firewall Bypass Journey: Exploiting “Google BigQuery” SQL Injection Vulnerability
• Blind (time-based) SQLi - Bug Bounty
• SQL injection through User-Agent
• Comma is forbidden! No worries!! Inject in insert/update queries without it
• Hey WAF! Better Luck Next Time! 👽

Insecure Direct Object Reference (IDOR)

• How I made it to Google HOF?
• An Interesting Account Takeover!!
• IDOR Vulenebility with empty response still exposing sensitive details of customers!
• Exploiting CORS to perform an IDOR Attack leading to PII Information Disclosure
• Story of a very lethal IDOR.
• Full account takeover worth $1000 Think out of the box
• IDOR via Websockets allow me to takeover any users account
• An Interesting Account Takeover Vulnerability
• The YouTube bug that allowed unlisted uploads to any channel
• My first bug on Google
• Accidental Observation to Critical IDOR

2FA bypass

• How I Might Have Hacked Any Microsoft Account
• Is Math.random() Safe? from missing rate limit to bypass 2fa and possible sqli
• Cracking the 2FA
• How I bypassed 2fa in a 3 years old private program!
• Bypass 2FA like a Boss
• Two Factor Authentication Bypass $5
• 2 FA Bypass via CSRF Attack
• How to bypass a 2FA with a HTTP header
• Bypass HackerOne 2FA requirement and reporter blacklist
• 2FA Bypass via Forced Browsing

Server Side Request Forgery (SSRF)

Race Condition

Remote Code Execution (RCE)

External XML Entity Attack (XXE)

Insecure Deserialization

• How i found a 1500$ worth Deserialization vulnerability
• Remote code execution through unsafe unserialize in PHP

Business Logic Flaw

HTTP Header Injection

Server-Side Template Injection (SSTI)

Broken link hijacking (BLH)

DOM-based vulnerabilities

Cross-origin resource sharing (CORS)

HTTP request smuggling

OS command injection

Directory traversal

WebSockets Attack

Web cache poisoning

• Breaking GitHub Private Pages for $35k
• Automate Cache Poisoning Vulnerability - Nuclei
• Poisoning your Cache for 1000$ - Approach to Exploitation Walkthrough
• Cache Poisoning DoS
• EN | Account Takeover via Web Cache Poisoning based Reflected XSS
• Chaining Cache Poisoning To Stored XSS

Information disclosure

CRLF injection

Made By

kh4sh3i

License

CC0-1.0 License