Justdoepichack

Find write-ups here:

[Justdoepichack @doepichack]

A bit disappointing considering the reward, but that’s bug bounty life.

[Justdoepichack @doepichack]

Reported a critical Blind XSS to Watson that could lead to user cookie theft on a WordPress-hosted asset. I was expecting a significant bounty given the impact, but the asset was later decided to Tier 5 and the final reward came out to just $138.

[Justdoepichack @doepichack]

@krishnsec real job is to explain them its critical 🤒 its really frustrating when your report get close informative it takes decades to explain them😪

[Justdoepichack @doepichack]

Multiple blind XSS reports, confirmed execution, even able to steal cookie and still zero clue which company actually got hit. This is frustrating.

[Justdoepichack @doepichack]

**I received only a $50 reward** its retest bounty so don't get misunderstood

[Justdoepichack @doepichack]

Hey @intigriti I reported a critical issue to a program, it’s now resolved and I completed retesting. I received only a $50 reward, but there’s no mention of the main bounty decision in the report, so I assumed it’s rewardable.

[Justdoepichack @doepichack]

I know some program may takes some time to reward but its been month no any update and even report archived so I just want to know about it

[Justdoepichack @doepichack]

Not sure what’s going on lately some reports get quick responses, but others sit for over a month with no bounty. Even after retesting, a few don’t get any reply at all. Just stuck in pending.

[Justdoepichack @doepichack]

@hackerspider1 @oppo I quit their program after reporting two critical blind XSS vulnerabilities, which were rewarded with $45 each.

[Justdoepichack @doepichack]

@rikeshbaniya @Hacker0x01 Well done, mate :)

[Justdoepichack @doepichack]

I am not sure why this happens, but I have noticed a consistent pattern whenever campaign is active on a program and I revisit it, I tend to find multiple valid issues. In contrast, when I visit the same program during normal periods, I often do not find any valid issues at all.

[Justdoepichack @doepichack]

@mugh33ra @coffinxp7 @GodfatherOrwa Try to find more endpoints

[Justdoepichack @doepichack]

@ReebootToInit5 @l0cpd Plenty of tweets say “bounty with just reading JS”. Fair enough. But what did you actually find that’s worth sharing

[Justdoepichack @doepichack]

@3nc0d3dGuY @zack0x01 also tried your version it’s fantastic. It captures all the GraphQL queries and mutations perfectly, and the output is super easy to explore. Amazing tool

[Justdoepichack @doepichack]

Bug hunters put in weeks of work to find real issues. Feels unfair when our effort isn’t rewarded.

[Justdoepichack @doepichack]

The company should’ve disclosed earlier that role enforcement wasn’t fully implemented on their GraphQL. After reporting 4–5 valid issues, they closed them as “duplicate/informative” and then marked the endpoint OOS. Now saying it’s a “global issue” and will be fixed at once.

[Justdoepichack @doepichack]

@XHackerx007 @bsidesahmedabad amazing mate very informative