Venom_19

Bug bounty Hunter | Cybersecurity enthusiast | Free Palestine 🇩🇿🇵🇸

[Venom_19 @Venom_19_py]

Alhamdulillah, I got my first bounty on @Bugcrowd after many duplicates and N/A’s 😁.

#bugbounty #CyberSecurity

[Venom_19 @Venom_19_py]

@itsQatada congrats bro, it's time to crush it with bounties 🔥

[Venom_19 @Venom_19_py]

@itsqatada @intigriti Congrats man, more success inshallah 👏

[Venom_19 @Venom_19_py]

@NandaDickson @qabrieladah the program has been suspended, too late for me :)

[Venom_19 @Venom_19_py]

I found a logic flaw that grants me free add-ons with the product, and confirmed there is no price check on the checkout!
They closed my report as N/A just because "most of the times purchases go through a manual review process".
That's unfair my role is to test WEB APPLICATIONS!

[Venom_19 @Venom_19_py]

@qabrieladah Well in my case the product is way too expensive and could be more than the bounty itself, also I wouldn’t benefit from it since it cannot be delivered to my region!

[Venom_19 @Venom_19_py]

@cyberx00t the front-end showed that product did not change, but the backed processed it changed.

[Venom_19 @Venom_19_py]

I got rewarded for a Business logic flaw + an IDOR triaged.

here's a quick overview:

IDOR : The application applies discounts for certain items only, by modifying the item ID directly in the request, I was able to bypass the restriction and benefit discounts on other items.

⬇️

[Venom_19 @Venom_19_py]

@DrlNoblemannnn No, there's a discount specific for certain items applied automatically, when selecting those items it makes a request different than for other items, and I saw that it contains the item ID in the request, so I used an ID of another item and got a discount on it.

[Venom_19 @Venom_19_py]

@gdlinux Thanks!
I usually don’t test email infrastructure directly, I focus on how applications handle email in authentication flows like insecure otp or password reset flows, race conditions and account linking flaws.

[Venom_19 @Venom_19_py]

@public___void Thank you brother ❤️

[Venom_19 @Venom_19_py]

@itsqatada Allah ysalmek khoya rabi yahfdek ❤️

[Venom_19 @Venom_19_py]

@Yau42684861 Thank you so much bro ❤️

[Venom_19 @Venom_19_py]

@MiniMjStar Thank you 🙏

[Venom_19 @Venom_19_py]

Logic Flaw : When topping up the account credit, the application provides standard options (e.g., 100, 200, ...) and it applies taxes to them, and by altering the credit value in the request to a random amount (e.g., 250) it failed to apply any taxes, allowing tax-free top-ups.

[Venom_19 @Venom_19_py]

@public___void @Bugcrowd good for you bro, that's the right thing to do, more to come InshaAllah.

[Venom_19 @Venom_19_py]

@public___void @Bugcrowd unfortunately this one was a duplicate, but know that so many more are coming. Keep it up bro 💪👏👏

[Venom_19 @Venom_19_py]

@r00ted_psycho @Bugcrowd focus on one type of vulnerabilities, give your targets more time, try to map out all the application and analyze it thoroughly, and don't stress about it you'll make it.

[Venom_19 @Venom_19_py]

Yay, I scored a reward on @Bugcrowd for an IDOR.

Quick overview:

While testing a shopping site I noticed a special offer that was intended for only one item, and by using another item’s ID in the request I got a juicy discount on it.

[Venom_19 @Venom_19_py]

@0xshii1 great job bro 👏

[Venom_19 @Venom_19_py]

@0xshii1 @tiktok congrats man, keep it up 👏🔥