Bergee's Stories on Bug Huntinghacking, cyber security and programming

bug bounty

Hi there This time, a story of my first AI hacking adventure. Well, it all started when, on some private BB program, I found a domain,…

bug bounty, rce, tutorial, write-up, zip symlink

Two crits, one zip

2025-12-230Comments

Ho,ho, ho Merry Christmas everyone :) Xmas is coming, and I am bringing the write-up on the RCE I found in Zip upload functionality. I tested the…

Bez kategorii, bug bounty, csp, write-up

WAF bypass and credential theft with XSS and Google Analytics

2025-10-310Comments

Hello In this post, I will tell you how I was able to escalate the bug from HTML injection to stealing credentials via Google Analytics... well,…

Bez kategorii, bug bounty, write-up

Subdomain takeover – easy $150 for five minutes of work

2025-08-070Comments

Hello The title might have been clickbait but it is not. I started from recon and discovered as many subdomains as possible of the target.com company.…

Bez kategorii, bug bounty, write-up

Accessing admin panel with fuzzing, digging and guessing

2024-10-160Comments

Hello folks This time I want to tell you the story how I gained access to some admin functionalities and leaked some sensitive info using FUFF,…

Bez kategorii, bug bounty, csp, ssrf, write-up

The story of exposed service, SSRF, CSP bypass and credentials stealing via XSS

2024-03-200Comments

Hello there Another day, another bug :) I started looking at the portal at redacted.com. The portal was written with PHP so I started fuzzing it…

bug bounty, write-up

Broken links hijacking and CDN takeover

2023-02-280Comments

Hello again This time I want to tell you about the broken links hijacking technique which I decided to give a chance after reading some blog…

Bez kategorii, bug bounty, write-up

Chaining multiple vulnerabilities for credential stealing

2022-10-250Comments

Once upon a time in far, far hackalaxy.... there was a login form built with angular. This story is about how I managed to steal…

Bez kategorii, bug bounty, write-up

Blind account takeover

2022-09-250Comments

In this story, I'm gonna tell you how I was able to take over an account due to a lack of server-side email verification. To…

Bez kategorii, bug bounty, write-up

Turning cookie based XSS into account takeover

2022-09-060Comments

The cookie-based XSS One evening I started hunting on the Terrahost Bug Bounty program. I was testing the terrahost.no main domain. There was a functionality…