Skip to content

Bergee's Stories on Bug Hunting

hacking, cyber security and programming

Menu
  • Blog
  • About Me
  • Resources
  • Side projects
Menu

Author: bergee

Breaking things legally for fun and profit

Posted on 2022-08-122022-09-07 by bergee

Now and then we can hear that some company has been hacked. People think it’s black magic or something. No, it’s not. It usually means some evil dude found a way to break the system’s security mechanisms to get into the system. It might be either innocent such as a company’s website defacement to show…

Read more
  • Previous
  • 1
  • 2
  • 3
  • Two crits, one zip
  • Why do you need the VPS for bug bounty
  • WAF bypass and credential theft with XSS and Google Analytics
  • How two dollars and one zip file let me read the server files
  • Subdomain takeover – easy $150 for five minutes of work
  • How I hacked XXXX for fun and !profit
  • Accessing admin panel with fuzzing, digging and guessing
  • From AngularJS CSTI to credentials theft
  • The story of exposed service, SSRF, CSP bypass and credentials stealing via XSS
  • “Hacking” the hotel room TV
  • Broken links hijacking and CDN takeover
  • How I found multiple critical bugs in Red Bull
  • Chaining multiple vulnerabilities for credential stealing
  • Blind account takeover
  • Turning cookie based XSS into account takeover
  • Blind os command injection
  • Five-minute hunting for hidden XSS
  • URL filter bypass, RFI and XSS
  • The forgotten API and XSS filter bypass
  • XSS via Angular Template Injection
  • Breaking things legally for fun and profit

Hackers' playground


https://www.tryhackme.com
https://www.pentesterlab.com
https://www.hackthebox.com
https://portswigger.net/web-security/all-labs
© 2025 Bergee's Stories on Bug Hunting | Powered by Minimalist Blog WordPress Theme