// archive
Tag: Bug Bounty
Log4Shell (CVE-2021-44228): Blind RCE on a Major Retailer
// TL;DR Days after Log4Shell went public, I tested a private program’s attack surface for CVE-2021-44228. Using an obfuscated JNDI payload sprayed across multiple request headers…
Password-Reset Token Theft via Link Poisoning on Red Bull
// TL;DR Red Bull’s password-reset flow had a targetUrl parameter that controlled where the reset link pointed — and it accepted any Red Bull subdomain. That…
An Unusual CSRF: Changing the Method Wipes the Account
// TL;DR On a private program (I’ll call the target redacted.com), I went looking for an email-change CSRF. The email-change action was protected against CSRF on…
XSS Like a Pro: Beating Filters Across a Private Program
// TL;DR A private Bugcrowd invite, one in-scope test site, and a set of provided credentials. It turned into eleven vulnerabilities in a single session —…
XSS in Zoho Mail via the Image Proxy
// TL;DR A finding that came from a stray thought rather than a methodical hunt. Zoho Mail — like most webmail — routes images in emails…
Client-Side DoS on WAF-Protected Sites by Abusing Cookies
// TL;DR A logic bug I found across several sites, including Upwork. Many sites store the referrer in a cookie, and many sit behind a WAF…
A Tricky Open Redirect – Filter Bypass
// TL;DR One of my favourite little findings. A private Bugcrowd program had a login?nextUrl= redirect parameter that rejected the usual open-redirect payloads. A random test…
Stored XSS via Email Reply (H1C Private Site)
// TL;DR This is one of the trickier XSS bugs I’ve found. The target was an email-marketing platform, and the injection point wasn’t a web form…
Sensitive Data Exposure via Forgot-Password (H1C Private Site)
// TL;DR On a HackerOne Challenge (H1C) private site, the forgot-password flow leaked far more than it should have. Triggering a password reset returned the account’s…
Stored XSS via Form Submission (Jotform & an H1C Private Site)
// TL;DR I found a stored XSS that fires through the submission side of a form builder: an attacker fills out someone else’s form with a…