// category
Bug Bounty Writeups
Writeups and tutorials filed under Bug Bounty Writeups.
24 writeups in this category
Log4Shell (CVE-2021-44228): Blind RCE on a Major Retailer
// TL;DR Days after Log4Shell went public, I tested a private program’s attack surface for CVE-2021-44228. Using an obfuscated JNDI payload sprayed across multiple request headers…
Password-Reset Token Theft via Link Poisoning on Red Bull
// TL;DR Red Bull’s password-reset flow had a targetUrl parameter that controlled where the reset link pointed — and it accepted any Red Bull subdomain. That…
An Unusual CSRF: Changing the Method Wipes the Account
// TL;DR On a private program (I’ll call the target redacted.com), I went looking for an email-change CSRF. The email-change action was protected against CSRF on…
Email Spoofing via IDN Homograph Domains
// TL;DR This isn’t the usual email-spoofing bug — it has nothing to do with SPF, DKIM, or DMARC. Instead of forging a target’s domain, I…
XSS Like a Pro: Beating Filters Across a Private Program
// TL;DR A private Bugcrowd invite, one in-scope test site, and a set of provided credentials. It turned into eleven vulnerabilities in a single session —…
XSS in Zoho Mail via the Image Proxy
// TL;DR A finding that came from a stray thought rather than a methodical hunt. Zoho Mail — like most webmail — routes images in emails…
Email Spoofing: Why It Still Works, and How SPF/DMARC/DKIM Stop It
// TL;DR Email spoofing — sending mail that appears to come from someone else’s address — is old, simple, and still everywhere, because the core email…
Client-Side DoS on WAF-Protected Sites by Abusing Cookies
// TL;DR A logic bug I found across several sites, including Upwork. Many sites store the referrer in a cookie, and many sit behind a WAF…
A Tricky Open Redirect – Filter Bypass
// TL;DR One of my favourite little findings. A private Bugcrowd program had a login?nextUrl= redirect parameter that rejected the usual open-redirect payloads. A random test…
Tabnabbing in Microsoft Edge: When the Browser Ignores rel=”noopener”
// TL;DR Reverse tabnabbing has a well-known fix: a site adds rel=”noopener” to its outbound target=”_blank” links, which stops the opened page from controlling the original…