// archive
Tag: Bug Bounty
Open Redirect in fb.me: Shortening Arbitrary External URLs
// TL;DR fb.me is Facebook’s URL shortener, and by design it’s only supposed to shorten Facebook URLs. Using the Facebook-to-Twitter cross-posting integration, I found it was…
The Risk Inside Tesla’s Brute-Force Protection: Locking Out Users
// TL;DR Tesla’s login had a brute-force protection that, on its face, is a good thing — too many wrong passwords and the account locks. The…
Stored XSS in Tumblr
// TL;DR Back when I started in bug bounty in 2017, I found a stored XSS vulnerability in Tumblr. I reported it, the security team patched…
Stored XSS in eBay’s Sell Page
// TL;DR I found a cross-site scripting vulnerability on eBay, in the “add photos” field of the Sell page. A simple image-based payload with an event…
Multiple Stored XSS in EmailMeForm
// TL;DR I found multiple stored XSS vulnerabilities in EmailMeForm, a popular online form and survey builder. The same root cause showed up in three different…
Content Injection in Instagram’s Password-Reset Page
// TL;DR I found a content injection (content spoofing) issue on Instagram’s password-reset confirmation page. A query parameter on the page was reflected directly into the…
My First XSS: Two Stored Bugs in Displaybit
// TL;DR Displaybit is a site that pays users for uploading and sharing images, and I found my first-ever XSS there in about two minutes —…
What Is a Bug Bounty?
// TL;DR A bug bounty program is a deal: a company invites hackers to find security flaws in its systems and rewards them for reporting those…