// archive
Tag: Account Takeover
Password-Reset Token Theft via Link Poisoning on Red Bull
// TL;DR Red Bull’s password-reset flow had a targetUrl parameter that controlled where the reset link pointed — and it accepted any Red Bull subdomain. That…
An Unusual CSRF: Changing the Method Wipes the Account
// TL;DR On a private program (I’ll call the target redacted.com), I went looking for an email-change CSRF. The email-change action was protected against CSRF on…
Sensitive Data Exposure via Forgot-Password (H1C Private Site)
// TL;DR On a HackerOne Challenge (H1C) private site, the forgot-password flow leaked far more than it should have. Triggering a password reset returned the account’s…
Stored XSS via Form Submission (Jotform & an H1C Private Site)
// TL;DR I found a stored XSS that fires through the submission side of a form builder: an attacker fills out someone else’s form with a…
Missing Password Confirmation on Sensitive Actions (Facebook & Twitter)
// TL;DR Re-asking for the current password before a sensitive action is a basic account-security best practice — it’s the safety net that stops someone who…
Stored XSS in Tumblr
// TL;DR Back when I started in bug bounty in 2017, I found a stored XSS vulnerability in Tumblr. I reported it, the security team patched…