Bez kategorii, bug bounty, write-upChaining multiple vulnerabilities for credential stealing2022-10-250CommentsOnce upon a time in far, far hackalaxy.... there was a login form built with angular. This story is about how I managed to steal…
Bez kategorii, bug bounty, write-upBlind account takeover2022-09-250CommentsIn this story, I'm gonna tell you how I was able to take over an account due to a lack of server-side email verification. To…
Bez kategorii, bug bounty, write-upTurning cookie based XSS into account takeover2022-09-060CommentsThe cookie-based XSS One evening I started hunting on the Terrahost Bug Bounty program. I was testing the terrahost.no main domain. There was a functionality…
Bez kategorii, vdp, write-upBlind os command injection2022-08-210CommentsHi dear readers. This story is about how to find command injection, which leads to RCE getting "Thank you" in return :). I was hunting on…
Bez kategorii, vdp, write-upFive-minute hunting for hidden XSS2022-08-150CommentsOne night I was about to go to sleep, however, set the goal of finding the bug within a max of 15 minutes. I did…
Bez kategorii, vdp, write-upURL filter bypass, RFI and XSS2022-08-140CommentsIn this story, I tell you how I was able to bypass the URL filtering rule to inject my own files into the server and…
Bez kategorii, vdp, write-upThe forgotten API and XSS filter bypass2022-08-140CommentsOn one site I found the forum section. There was an option to join some groups and then create posts in the group. I created…
Bez kategorii, vdp, write-upXSS via Angular Template Injection2022-08-130CommentsThis time I have a story about several XSS bugs I found across several programs. This type of XSS is called CSTI XSS (Client Side…