"$500 for a UUID Swap: I Almost Gave Up on This IDOR" by tinopreter 🤯🔥
👨💻 tinopreter (x/tinopreter)
🔗 https://t.co/bOYIuLHxVx
🔗 Join team 👉https://t.co/FeMz53HSN0
Auth bugs pay the most in bug bounty. Most hunters never touch them, because they never actually understood how auth works.
In this video, I break down web auth the way the developer who built it sees it. Sessions, JWTs, OAuth 2.0, the Authorisation Code Flow, PKCE, and OpenID Connect. Why each protection exists, what it defends, and the exact bug that shows up when it's missing.
Auth For Hackers https://t.co/RJ8gr7FkpS
#BugBounty #WebSecurity #EthicalHacking #AmrSec #OAuth #JWT #OIDC
They verify your login in client-side JavaScript, never on the server. So you can walk right in.
New write-up: Client-side Authentication Bypass. 4 real cases (one led to a $4,000 SQLi):
https://t.co/XYNTSx2t6q
#BugBounty#AppSec#InfoSec#BarracksArmy
$15,000 Facebook Bug Bounty 🤑
How a Simple GraphQL Query Exposed Facebook Page Admins and Their Personal Emails by Vivek PS 🤯🔥
👨💻 Vivek PS (x/vivekps143)
🔗 https://t.co/5w9lpVLcQE
🔗 Join team 👉https://t.co/FeMz53HSN0
We just dove into our shelf of archived bug bounty write-ups from the most notable hackers! 🤠
In this issue, we selected 5 compelling articles (that are still relevant today) to share with you, from which you can learn something new! 😎
🧵 👇
Quick reminder!
With or without AI, developers still accidentally push API keys, credentials, and any other types of secrets to public repositories every day! 🤠
Our complete guide shows how you can find them before anyone else using several techniques. 😎
Check it out! 👇
https://t.co/Jxe0FJC4pz
@asad0x01@wunderwuzzi23 Yeah, submitted on May 5, got initial eval on May 11. No further portal updates since then, but noticed it's completely fixed. It’s a core logical bypass with high revenue impact, so I guess they are taking time to fully assess the numbers.
Time for another giveaway!
We will pick 6 winners to win one of the following:
1x Annual VIP @hackthebox_eu Licence
5x @PentesterLab 3 Month Licences
To enter:
1️⃣ Follow us @BugBountyDefcon
2️⃣ Like this post ❤️
3️⃣ Re-tweet this post 🔁
Giveaway open until Monday June 15th! GOOD LUCK!
Selected as the 1st Write-up Winner for the @intigriti Challenge 0526!
Out of 33 submissions, they liked my documentation of 3 different solve paths (including an unintended one). Waiting for the SWAG!
Read it here: https://t.co/Csh6LD8W3l
#Intigriti#bugbountytips