There it is! Orange Tsai (@orange_8361) of DEVCORE Research Team was able to exploit Microsoft Exchange! If confirmed, they win a whooping $200,000 and 20 Master of Pwn points. Off to the disclosure room to explain how they did it and seal the deal. #Pwn2Own#P2OBerlin
the most low-effort / high reward thing you can do for security is installing the Russian language pack
(not even joking, it's ridiculous how often that prevents execution)
I visited a link https://t.co/XHGPdAO3SM. It site was HTTP. It asked me to complete a "CAPTCHA"
This is NOT a CAPTCHA. It copies a hidden PS script to your clipboard and runs it.
DON'T GO THE WEBSITE OR SOLVE THE CAPTCHA.
Did you do this intentionally?? @lostsec_
Hey I found a bug on your site!! 😃
Oh, it's just informative, no security impact 🙃
Alright then, please disclose it 🤝
Haha nope 😅 only resolved issues can be disclosed 🤭
...
whaw3532io523r9t8wf!!! 🤯🔥
Reward : 2000 $
IDOR in staging API due to missing object-level authorization
Endpoint:
GET https://example. com/api/workspace/{id}/latest
The {id} parameter is directly mapped to backend objects without any access control enforcement. Since IDs are sequential
bounty : 1,100$
Bug 1 : Debug Mode enabled
well i the api endpoint was expecting /api/v1/xyz?id=1 [INT] but instead of int i used string value which thrown errror with a lot of information
Bug 2 : User limit bypass
as per plan you can add only 2 user ,
@Arqam992 Thanks . I have been doing bug bounties since August 2024, but I haven’t been very consistent because I am a student. I also just turned 18 and joined university this month