Skip to content

Bergee's Stories on Bug Hunting

hacking, cyber security and programming

Menu
  • Blog
  • About Me
  • Contact
  • Resources
  • Side projects
Menu

About me

My name is Bartłomiej Bergier aka “Bergee” or “Berdzi“. I’ve been playing with computers since I was 8. Initially, it was mainly playing games on my Commodore PET, which eventually turned into programming BASIC. Then I moved to ZX SPECTRUM 48K where I also tried some Z80 assembler. My last piece of hardware before the PC era was the Amiga 500 – lots of good gaming, ripping out music 🙂 and playing with AMOS BASIC. In 1995 I convinced my dad to buy our first PC – AMD 486 DX4/100. That was a decent piece of hardware back then. Besides gaming Wolfenstein 3D, Doom and Quake I also learned Turbo Pascal and Delphi, then C Language in college, and started doing some web apps using PHP and MySQL.

Back then we had a small LAN and a shared leased line called SDI, all based on Linux routers. First I chose RedHat 6 and then moved to Slackware which became my favorite distro for years. I learned a lot about the Unix system, network protocols, and security. I set up my own DNS, mail server, website, etc., and was still learning new stuff. I am interested even more in web apps and security and started to write my own exploits and develop web apps. Eventually started the job as a web developer and became a full-stack developer. In the meantime, I still like to play with computers, new technologies, and security stuff. In 2018 I started hunting bugs for fun and profit in Bug Bounty programs :).

I started this blog to share my bug bounty findings and hopefully some more interesting stories with you…

  • A Little Break from Bug Bounty – I Made a Word Search Game!
  • How I hacked XXXX for fun and !profit
  • Accessing admin panel with fuzzing, digging and guessing
  • From AngularJS CSTI to credentials theft
  • The story of exposed service, SSRF, CSP bypass and credentials stealing via XSS
  • “Hacking” the hotel room TV
  • Broken links hijacking and CDN takeover
  • How I found multiple critical bugs in Red Bull
  • Chaining multiple vulnerabilities for credential stealing
  • Blind account takeover
  • Turning cookie based XSS into account takeover
  • Blind os command injection
  • Five-minute hunting for hidden XSS
  • URL filter bypass, RFI and XSS
  • The forgotten API and XSS filter bypass
  • XSS via Angular Template Injection
  • Breaking things legally for fun and profit

Hackers' playground


https://www.tryhackme.com
https://www.pentesterlab.com
https://www.hackthebox.com
https://portswigger.net/web-security/all-labs
© 2025 Bergee's Stories on Bug Hunting