Daily Bug Bounty Reports

Decoding bug bounty reports from internet

[Daily Bug Bounty Reports @Bug_Breakdown]

Read the full $8,000 write-up by Asad Mohsin here: https://t.co/BcQyVN2Miq

[Daily Bug Bounty Reports @Bug_Breakdown]

An $8,000 payout for looking past the usual SSRF payloads! Here is how a researcher escalated a basic SSRF into full Kubernetes infrastructure exposure just by reading the HTTP response headers,

🚨 BUG: Server-Side Request Forgery (SSRF) / Information Disclosure

THE FLAW:

• The researcher found an SSRF vulnerability but hit a wall—standard cloud metadata endpoints (AWS/GCP) and localhost payloads returned nothing useful.

• The breakthrough came from a single, overlooked HTTP response header.

• This hidden header leaked internal Kubernetes infrastructure details, including Pod IPs, workload identifiers, and internal service names.

THE EXPLOIT:

• Realizing the target wasn't a standard cloud instance but a containerized Kubernetes environment with a service mesh, the researcher pivoted.

• Using the leaked naming conventions from the header, they routed the SSRF to hit internal Kubernetes services.

• They discovered exposed internal monitoring interfaces and administrative endpoints, including one that could potentially shut down running service components.

• Instead of taking down production (which is out of bounds), they documented the exposed destructive capability, proving severe impact across Confidentiality, Integrity, and Availability.

STRATEGIC TAKEAWAY:

• Stop blindly throwing AWS metadata payloads at every SSRF.

• A failed metadata request doesn't mean the SSRF is useless; it usually means the target is using a different architecture, like Kubernetes. Always analyze the complete HTTP response, especially the headers, to fingerprint the internal network before you start firing payloads.

Link to the full write-up in the replies 👇

#BugBounty #AppSec #CyberSecurity #InfoSec #BugBountyTips #BugBountyReports

[Daily Bug Bounty Reports @Bug_Breakdown]

Read the full $3,000 write-up by 0xSADAT here: https://t.co/TrB6m0GPji

[Daily Bug Bounty Reports @Bug_Breakdown]

A $3,000 payout for manipulating a single API request! Here is how a researcher exploited a critical business logic flaw to infinitely top-up their account balance without ever completing a payment:

🚨 BUG: Business Logic Flaw / Unauthorized Balance Top-up

THE FLAW:

• The researcher was testing a newly added asset for a private bug bounty program.

• After adding a credit card in the Billing section to access API services, they started monitoring the HTTP traffic.

• They discovered a specific API endpoint (POST /api/credits/top-up) that handled the account recharging process.

• The backend was explicitly trusting the amount and threshold parameters sent directly by the client, instead of securely validating the transaction status from the payment gateway.

THE EXPLOIT:

• The researcher intercepted the top-up request using Burp Suite.

• They modified the amount parameter to a significantly larger value (e.g., 40000) and forwarded the request, completely bypassing the actual payment process.

• The server accepted the tampered values and immediately updated the account balance with the requested credits.

• This allowed any authenticated user to arbitrarily increase their balance and consume paid API services for free, posing a massive financial risk to the company.

STRATEGIC TAKEAWAY:

• Never trust client-side data for financial transactions.

• When hunting, always intercept the exact moment a payment or credit allocation is initiated. If the application is passing the expected top-up amount within the request body, tamper with it—if the backend lacks a secondary payment gateway validation check, you have a critical business logic flaw.

Link to the full write-up in the replies 👇

#BugBounty #AppSec #CyberSecurity #InfoSec #BugBountyTips #BugBountyReports

[Daily Bug Bounty Reports @Bug_Breakdown]

Read the full $1,500 write-up by tinopreter here: https://t.co/OpaXUaWVQ8

[Daily Bug Bounty Reports @Bug_Breakdown]

A $1,500 bounty for changing one Burp Suite setting! Here is how a researcher found an unguessable endpoint leaking AI system prompts and employee PII just by turning off their scope filter,

🚨 BUG: Information Disclosure / System Prompt Leak

THE FLAW:

• The target application featured a complex AI chatbot.

• When testing, many hunters use Burp Suite's "Advanced Scope Control" and filter HTTP history to only show in-scope traffic to reduce noise.

• This creates a massive blind spot: you miss discoveries happening in background requests sent to third-party domains.

THE EXPLOIT:

• The researcher temporarily disabled their Burp scope filter and spotted a strange API request going to an external domain.

• The endpoint path looked like a hash followed by an incomplete JWT, meaning no standard fuzzing wordlist would have ever found it.

• The Server-Sent Events (SSE) response was leaking the company's complete AI model system prompts alongside internal employee emails and UUIDs.

STRATEGIC TAKEAWAY:

• Filtering your proxy history exclusively to the target domain is a dangerous habit.

• Modern applications heavily rely on external integrations. Always periodically toggle your scope filter OFF to check what traffic is being routed to unguessable third-party endpoints.

Link to the full deep dive in the replies 👇

#BugBounty #AppSec #CyberSecurity #InfoSec #BugBountyTips #BugBountyReports

[Daily Bug Bounty Reports @Bug_Breakdown]

Read the full technical deep dive and see the parsing simulation code by t4nv1 here: https://t.co/hQ1DUAOjDG

[Daily Bug Bounty Reports @Bug_Breakdown]

A $6,500 bounty for mass account takeover without ever touching the victim’s browser! Here is how a researcher exploited HTTP Request Smuggling (CL.TE) on a Slack domain to silently steal other users' session cookies,

🚨 BUG: HTTP Request Smuggling (CL.TE) / Session Hijacking

THE FLAW:

• Modern web infrastructure uses a front-end (like a load balancer) that reuses long-lived connections to a back-end server.

• The researcher found that https://t.co/UkVzTvKrUw suffered from an HTTP parsing disagreement: the front-end prioritized the Content-Length (CL) header, while the back-end prioritized Transfer-Encoding: chunked (TE).

THE EXPLOIT:

• By sending a crafted request with both headers, the attacker tricked the front-end into forwarding a payload that the back-end interpreted as ending early.

• This left a malicious, incomplete request fragment sitting in the back-end's connection buffer.

• When an innocent Slack user's request arrived next on that same connection, it was appended to the attacker's fragment.

• The attacker's fragment forced a 301 redirect to their own server, seamlessly capturing the victim's Slack session cookies as they were redirected.

STRATEGIC TAKEAWAY:

• The scariest part of request smuggling is that the attacker doesn't choose the victim; the network does. Whoever's request is next in the pipeline gets hijacked.

• Because this bug lives in the infrastructure plumbing between servers, not the application logic, standard app-level scanners will never catch it. Always test auxiliary domains for parsing disagreements.

Link to the full deep dive in the replies 👇

#BugBounty #AppSec #CyberSecurity #InfoSec #BugBountyTips #BugBountyReports

[Daily Bug Bounty Reports @Bug_Breakdown]

Read the full write-up by yOnly here: https://t.co/Od278NukA8

[Daily Bug Bounty Reports @Bug_Breakdown]

A $400 bounty for chaining a weak JWT signature into a DOM XSS on a KYC verification page! Here is how a researcher exploited an alg:none misconfiguration to hijack an iframe,

🚨 BUG: JWT alg:none to DOM XSS

THE FLAW:

• While testing a KYC verification flow, the researcher examined the JWT used by the application.

• The JWT header specified {"alg": "none"}, meaning the application processed the token without verifying any cryptographic signature.

• The JWT payload contained a "url" field (e.g., "url": "[https://t.co/nTMbiVAZqL](https://t.co/nTMbiVAZqL)").

• This URL was trusted by the KYC verification SDK to dynamically load an external resource directly into an iframe on the page.

THE EXPLOIT:

• Because the JWT lacked a signature, the researcher modified the "url" claim to point to an attacker-controlled server (e.g., "url": "[https://attacker.example/poc.html#](https://attacker.example/poc.html#)").

• They discovered that appending a # fragment to the URL prevented the application's additional path appendages from breaking the request.

• They re-encoded the token and submitted it.

• The application accepted the unsigned token and rendered the attacker's custom HTML page inside the legitimate KYC verification iframe, achieving DOM XSS.

• To demonstrate impact, the researcher built a fake login form on their hosted page that successfully exfiltrated entered credentials to an external webhook, proving a critical phishing vector.

STRATEGIC TAKEAWAY:

• A JWT misconfiguration isn't always just about account takeover. When you find an alg:none vulnerability or a weak secret, map out exactly what the application trusts from the payload.

• In modern applications, claims in a JWT are often used to configure frontend SDKs, dictate redirect URIs, or set resource paths. Following the data flow from the token to the DOM is how you escalate a cryptographic flaw into a client-side compromise.

Link to the full write-up in the replies 👇

#BugBounty #AppSec #CyberSecurity #InfoSec #BugBountyTips #BugBountyReports

[Daily Bug Bounty Reports @Bug_Breakdown]

Read the full $25,000 HackerOne report by Mega7 here: https://t.co/Wd3r5bErbd

[Daily Bug Bounty Reports @Bug_Breakdown]

A massive $25,000 bounty from HackerOne for hacking HackerOne! Here is how a researcher found a Critical Server Side Request Forgery (SSRF) that exposed internal AWS credentials,

🚨 BUG: Server Side Request Forgery (SSRF) via Analytics Reports

THE FLAW:

• The application generated PDF analytics reports but failed to properly sanitize output in error messages.

• Specifically, if a template element was missing, the application returned a "Missing template for element" error that reflected the unsanitized element name directly into the PDF generation library.

THE EXPLOIT:

• The researcher injected a malicious <iframe> tag into the template element parameter.

• Because the PDF generation library processed the HTML (including the iframe) server-side, it triggered an internal request.

• The researcher pointed the iframe to the AWS metadata endpoint (169.254.169.254) and successfully extracted internal AWS AccessKeyId and SecretAccessKey credentials.

• The HackerOne team fixed the bug, verified no prior exploitation occurred, and paid out $25,000 within days.

STRATEGIC TAKEAWAY:

• PDF generation libraries are historically notorious for parsing and executing HTML blindly.

• Even if an endpoint just looks like an error message reflection, if that error text is eventually fed into a backend PDF or rendering engine, you have a high-probability vector for SSRF. Always test HTML injection on export/report features.

Link to the full write-up in the replies 👇

#BugBounty #AppSec #CyberSecurity #InfoSec #BugBountyTips #BugBountyReports

[Daily Bug Bounty Reports @Bug_Breakdown]

Read the full write-up by Ashar Mahmood here: https://t.co/VfFFpIKu2h

[Daily Bug Bounty Reports @Bug_Breakdown]

A €1,500 bounty for completely bypassing 2FA without ever entering a code! Here is how a researcher exploited a broken mid-challenge session to turn off two-factor authentication from the outside,

🚨 BUG: 2FA Bypass / Broken Authentication

THE FLAW:

• When a user passes the initial password check, the application assigns a "half-authenticated" session cookie while presenting the SMS challenge.

• This session is supposed to be heavily restricted, but the backend failed to properly isolate it from the account's security settings.

THE EXPLOIT:

• The researcher logged in with a valid password and stopped at the SMS 2FA prompt.

• Instead of entering a code, they opened a second tab and navigated directly to the application's 2FA settings page.

• The settings page loaded perfectly using the mid-challenge session.
• From there, the researcher simply flipped their security preference to "Never use when I log in", saved it, and landed inside the account fully authenticated.

STRATEGIC TAKEAWAY:

• The most dangerous state in any authentication flow is the "in-between" phase. Developers heavily harden the logged-in and logged-out states, but often treat partial sessions as a mere formality.

• A valid session cookie is not the same as a completed login. Whenever you hit a multi-step gate, always check what a half-authenticated session is allowed to access, especially the switch that controls the gate itself.

Link to the full write-up in the replies 👇

#BugBounty #AppSec #CyberSecurity #InfoSec #BugBountyTips #BugBountyReports

[Daily Bug Bounty Reports @Bug_Breakdown]

Read the full write-up by Pradeep J. here: https://t.co/wF4HL5cj8A

[Daily Bug Bounty Reports @Bug_Breakdown]

P1 on a major target using classic mechanics! Here is how a researcher scored a critical Blind SQL Injection on a new Red Bull subdomain just by paying attention to boolean JSON responses,

🚨 BUG: Unauthenticated Blind Boolean SQLi

THE FLAW:

• The researcher focused their recon on newly appeared subdomains, specifically targeting a Red Bull F1 portal.

• Intercepting a password reset request revealed a JSON endpoint returning simple {"error":false, "data":true} responses.

• Injecting a single quote altered the behavior. Testing with ' AND '1'='1 returned true, while ' AND '1'='2 returned false.

THE EXPLOIT:

• Because the endpoint dynamically reflected true/false states, noisy time-based payloads weren't even necessary.

• The researcher used substring queries to extract the MS-SQL @@version character by character.

• This cleanly proved the ability to extract full database contents and potentially achieve RCE via xp_cmdshell.

STRATEGIC TAKEAWAY:

• The most profitable recon strategy right now isn't brute-forcing massive wordlists; it is monitoring infrastructure for newly spun-up subdomains. Developers often push unhardened APIs to new assets before WAF rules are applied.

• JSON endpoints are heavily overlooked for SQLi because people falsely assume modern ORMs are always in place. When you see a binary true/false response in an API, always test for boolean SQLi to avoid the timeouts associated with sleep() payloads.

Link to the full write-up in the replies 👇

#BugBounty #AppSec #CyberSecurity #InfoSec #BugBountyTips #BugBountyReports

[Daily Bug Bounty Reports @Bug_Breakdown]

Read the full write-up by Gaurav Jain in the original article here: https://t.co/lzr1qSXZE5

[Daily Bug Bounty Reports @Bug_Breakdown]

From a simple profile picture upload to full Remote Code Execution (RCE)! Here is how a researcher compromised an ASP-NET/IIS server by completely bypassing client-side validation:

🚨 BUG: Stored XSS & RCE via File Upload

THE FLAW:

• A profile picture upload form relied on client-side JavaScript to restrict files to JPEG/PNG formats.

• The backend server failed to independently validate the actual file extension or content.

• Most critically, the public directory where uploads were stored was configured by IIS to process executable server-side code.

THE EXPLOIT:

• The researcher bypassed the browser checks and uploaded an HTML file, which executed in the browser to confirm Stored XSS.

• Knowing the target ran Microsoft IIS and ASP-NET, they recognized that standard PHP payloads would just return a 404 error.

• They crafted an ASP-NET HTTP Handler (.ashx) file and pushed it through the intercepted upload request.

• When the uploaded file was accessed, the server processed the handler instead of serving it as an image, granting full command execution (RCE)!

METHODOLOGY TIP:

• Client-side validation is never a security boundary.

• Always fingerprint your target's technology stack; throwing PHP shells at an ASP-NET server is a waste of time.

• A file upload is only an RCE if the destination directory has execution permissions.

Full details in the replies 👇

#BugBounty #AppSec #CyberSecurity #InfoSec #BugBountyTips #BugBountyReports

[Daily Bug Bounty Reports @Bug_Breakdown]

Read the full write-up by Miguel Angel in the orginal link below -
https://t.co/Lun2YvmZrm

[Daily Bug Bounty Reports @Bug_Breakdown]

Bypassing a hidden WordPress login page on a NASA subdomain! 🚀 Here is how an attacker chained a known vulnerability with URL manipulation to access a restricted authentication portal:

Bug - Broken Access Control / 403 Bypass (CVE-2023-5089)

THE FLAW:

• The Defender Security plugin for WordPress (versions prior to 4.1.0) includes a "Hide Login Page" feature.

• This feature fails to properly restrict access when an attacker abuses the WordPress auth_redirect function.

THE EXPLOIT:

• The researcher targeted a NASA subdomain and appended ?gf_page=randomstring to the initial URL.

• This forced the application to trigger an automatic redirect to the hidden authentication endpoint.

• The redirected page initially returned a 403 Forbidden error, blocking access.

• By manipulating the URL path through GET parameters, the researcher successfully bypassed the 403 restriction.

• The WordPress login interface became fully accessible, allowing the attacker to process credential validation and enabling further attacks like credential stuffing or brute-forcing.

METHODOLOGY TIP:

• Security through obscurity is not a boundary.

• When testing WordPress targets with hidden logins, check if functions like auth_redirect can route you to the protected endpoint.

• If you hit a 403 Forbidden on that endpoint, always test URL path manipulation to see if the restriction can be dropped.

Full details in the replies 👇

#BugBounty #AppSec #CyberSecurity #InfoSec #BugBountyTips #BugBountyReports