I was about to close Burp Suite when one API request caught my attention.
Booring --> PII leak it was that big transition
Go and read my new article and give your opinions
๐ Full write-up
https://t.co/455udBDy3b
#BugBounty #AppSec #WebSecurity #IDOR #API #SecurityResearch @theXSSrat
"Random" doesn't always mean "secure."
A UUID in a URL turned into a security finding that taught an important lesson about authentication design.
Wrote about the discovery process here ๐
https://t.co/q1HFjXqhtd
#BugBounty#SecurityResearch@theXSSrat@bugbountywizard
If you're in tech and don't understand OAuth 2.0 flow โ start now. It's the auth standard powering nearly every major company's login system. Non-negotiable knowledge. ๐งต
#appsec#bughunters
Finally I am publishing my first medium article pls go and read and give your thoughts on: โFrom Self-XSS to Account Takeover: How I Turned a Low-Severity Finding into a Criticalโฆโ by Kanishk dadhich on Medium: https://t.co/jct581TbHT
@theXSSrat
Broken Access Control is like hide and seek โ it can hide anywhere.
Found a case where a low-privileged user could access an admin-only export API and download org membership data containing PII + metadata.
No download button existed in the UI ๐
#bugbounty#appsec@theXSSrat
Thought I was testing a review feature.
Actually found a file upload issue that turned user-generated content into attacker-controlled content hosting.
Small feature. Bigger impact.
Lesson: Never underestimate file upload functionality.
#CyberSecurity#BugBounty#Security