T4nv1·1d agoThe Bouncer Who Waved Everyone In When the Scanner Broke: A $3,500 GitLab SSRFHow a correct DNS-rebinding defence was undone by one catch block, and what it teaches about fail-open security checks
Mahmoud_Elkholy·1d agoBroken Access Control Missing Server-Side Authorization Allows Member to Access Billing Data and…The Member Who Could Edit the Admin
T4nv1·2d agoHow I Chained a Stale CNAME Record with OAuth 2.0 Wildcards for a $6,000 Account Takeover (ATO)Introduction
T4nv1·3d agoHow I Turned a Single Packet Mismatch into a $10,000 Single-Packet Race Condition (H2/HTTP2 Window…Introduction
L4ZZ3RJ0D·3d agoHow a Login Token for a Forum Became a Login Token for OpenAI’s Internal CodeBack to AI for this round, and this one’s barely two months old at time of writing, which is rare for this series but worth making an…A response icon1A response icon1
Adarsh S Nair·3d agoHow a Browser Extension Check Led to Uncovering CVE-2021–44528 (Open Redirect)While browsing a target Web application, I clicked on the Shodan Browser Extension to view quick context on the server stack, open ports…
Mohamed Nowisar·4d agoHow I Bypassed 2FA by Changing One Request Parameter — and Earned a $$$ Bountyالحمد لله الذي عَلَّمَ بالقلم.. عَلَّمَ الإنسانَ ما لم يَعْلَم والصلاةُ والسلامُ على خيرِ مُعَلِّمي الناسِ الخير محمد أما بعدA response icon2A response icon2
T4nv1·4d agoTwo Rulers, One Wire: How an HTTP Desync Earned a First-Time Hunter $6,500 from SlackA technical deep dive into CL.TE request smuggling, why it turns “a parsing quirk” into mass session theft, and a toy parser you can run…
InOSINT TeambyMonika·4d agoIDOR: The Bug That Pays the Most in 2026A complete guide to finding, testing, and reporting Insecure Direct Object Reference bugs — the #1 most reported and highest paying…A response icon1A response icon1
