$2000 for a web cache deception bug. As always I share my methodology 👇
Identifying a deception bug is always easy but exploiting it can be hard due to SameSite restrictions on victims cookie
I bypassed this to steal victim JWT. Read about it here:
🔗 https://t.co/CAxfKAC0eP
@sw33tLie@ArmanSameer95 Could you provide any code samples or references? I saw your reply mentioning it's a JavaScript-based miner, so we should be able to locate it in the .js files. What kind of code or other indicators should we look for?
@TanmayLP7 If you are running automated scanners. This is about 95-98% of the things that are missed.
Also, if you want to make a name for yourself in BB or web app pentest world. Get really good at these.