// category
Bug Bounty Writeups
Writeups and tutorials filed under Bug Bounty Writeups.
24 writeups in this category
Content Spoofing in Microsoft Edge
// TL;DR After an earlier address-bar spoofing bug I reported in Edge was fixed as CVE-2018-8383, I found a related issue in the same area: Edge…
Address Bar Spoofing in Microsoft Edge (CVE-2018-8383)
// TL;DR Microsoft Edge decided what to show in the address bar before the page it was navigating to had actually loaded. By redirecting to a…
Stored XSS via Email Reply (H1C Private Site)
// TL;DR This is one of the trickier XSS bugs I’ve found. The target was an email-marketing platform, and the injection point wasn’t a web form…
Sensitive Data Exposure via Forgot-Password (H1C Private Site)
// TL;DR On a HackerOne Challenge (H1C) private site, the forgot-password flow leaked far more than it should have. Triggering a password reset returned the account’s…
Stored XSS via Form Submission (Jotform & an H1C Private Site)
// TL;DR I found a stored XSS that fires through the submission side of a form builder: an attacker fills out someone else’s form with a…
Open Redirect in fb.me: Shortening Arbitrary External URLs
// TL;DR fb.me is Facebook’s URL shortener, and by design it’s only supposed to shorten Facebook URLs. Using the Facebook-to-Twitter cross-posting integration, I found it was…
Missing Password Confirmation on Sensitive Actions (Facebook & Twitter)
// TL;DR Re-asking for the current password before a sensitive action is a basic account-security best practice — it’s the safety net that stops someone who…
The Risk Inside Tesla’s Brute-Force Protection: Locking Out Users
// TL;DR Tesla’s login had a brute-force protection that, on its face, is a good thing — too many wrong passwords and the account locks. The…
Stored XSS in Tumblr
// TL;DR Back when I started in bug bounty in 2017, I found a stored XSS vulnerability in Tumblr. I reported it, the security team patched…
HTML Injection, Cross-Frame Scripting & Reflected XSS in Magento Marketplace
// TL;DR I found three related client-side issues on Magento’s Marketplace, all stemming from the same unsanitised search parameter: HTML injection, cross-frame scripting (a clickjacking/UI-redressing class…