// archive
Tag: HackerOne
BUG BOUNTY WRITEUPS
Stored XSS via Email Reply (H1C Private Site)
// TL;DR This is one of the trickier XSS bugs I’ve found. The target was an email-marketing platform, and the injection point wasn’t a web form…
BUG BOUNTY WRITEUPS
Sensitive Data Exposure via Forgot-Password (H1C Private Site)
// TL;DR On a HackerOne Challenge (H1C) private site, the forgot-password flow leaked far more than it should have. Triggering a password reset returned the account’s…
BUG BOUNTY WRITEUPS
Stored XSS via Form Submission (Jotform & an H1C Private Site)
// TL;DR I found a stored XSS that fires through the submission side of a form builder: an attacker fills out someone else’s form with a…
SECURITY FUNDAMENTALS
What Is a Bug Bounty?
// TL;DR A bug bounty program is a deal: a company invites hackers to find security flaws in its systems and rewards them for reporting those…