Mahmoud Elsaidy·13h agoAccount Takeover via Password Reset Poisoning (X-Forwarded-Host)First, what is X-Forwarded-Host?
Muhammad Asim Shahzad·1d agoThe Phone Number That Unlocked Any Tinder AccountA 2018 bug bounty chain shows how a skipped OTP binding and an unchecked token audience added up to account takeover
InRadio HackersbySamadhan shimple·Nov 2I Found an Account Takeover Vulnerability Through Google DorkingSometimes, finding a security vulnerability is not about using advanced tools or running complicated scripts. Sometimes, it starts with a…
InCodeToDeploybyRaj Namdev·Oct 28Four Redirects, One URL, Full Account Takeover: An OAuth Chain AutopsyNot one sophisticated bug. Three string comparisons that were each almost right.
InCodeToDeploybyRaj Namdev·Oct 26An Open Redirect Isn’t a Phishing Bug. It’s a Token Delivery Failure.When the browser is carrying a credential, a redirect isn’t a redirect. It’s a delivery.
xlr9·Oct 23Insufficient Session Expiration leads to Account Takeover via Password ChangeHowdy fellers! During my recent bug hunting in VDP programs, I was analyzing a presentation platform and came across a vulnerability. At…
InCodeToDeploybyRaj Namdev·Oct 18I Analyzed 12 IDOR-to-ATO Reports. The Email-Change Endpoint Wins.Read-only IDORs get upvotes. Write-capable IDORs get accounts.
D4LT0N·Oct 13MIME-Type Confusion with S3 Bucket Content-Type Override lead to Stored-XSSThis write-up details a vulnerability chain combining an S3 response header override (response-content-type) and MIME-type confusion to…A response icon1A response icon1
egormajj·Oct 5The 9 Best Account Takeover Prevention Tools in 2026Nine tools for the login step, sorted by the layer they work on, with the prices I could confirm and the gaps each one leaves
Nourammar·Oct 4An Old Password Reset Link Was Enough to Take Back the Accountvideo url:https://youtu.be/LuLv2uRrTBc
