<![CDATA[Bug Bounty Tips on Medium]]> https://medium.com/tag/bug-bounty-tips/latest?source=rss------bug_bounty_tips-5 https://cdn-images-1.medium.com/proxy/1*TGH72Nnw24QL3iV9IOm4VA.png Bug Bounty Tips on Medium https://medium.com/tag/bug-bounty-tips/latest?source=rss------bug_bounty_tips-5 Medium Wed, 06 May 2026 15:33:30 GMT <![CDATA[How Secure Password Hashing Can Take Down Your Server]]>

Your login endpoint might be the most expensive API you run, and you probably don’t treat it that way.

Continue reading on InfoSec Write-ups »

]]> https://infosecwriteups.com/how-secure-password-hashing-can-take-down-your-server-78a51535a6b0?source=rss------bug_bounty_tips-5 https://medium.com/p/78a51535a6b0 Tue, 05 May 2026 19:15:54 GMT 2026-05-05T19:15:54.441Z <![CDATA[Unauthenticated Access to AWS via Cognito Identity Pool ID]]>

Exploiting temporary credentials giving access to AWS

Continue reading on Medium »

]]> https://saurabh-jain.medium.com/unauthenticated-access-to-aws-via-cognito-identity-pool-credentials-dc7fd5e01ec7?source=rss------bug_bounty_tips-5 https://medium.com/p/dc7fd5e01ec7 Tue, 05 May 2026 09:17:36 GMT 2026-05-05T13:36:45.945Z <![CDATA[Bug Hunter Notebook (CHAPTER — 1)]]>

The complete Field Guide — 2025 | 2026 Edition

Continue reading on Medium »

]]> https://spidergk.medium.com/bug-hunter-notebook-chapter-1-3fef97bc9367?source=rss------bug_bounty_tips-5 https://medium.com/p/3fef97bc9367 Mon, 04 May 2026 18:26:59 GMT 2026-05-04T18:26:59.083Z <![CDATA[The Ghost Email: How Weak Validation Broke Authentication]]>

Hey Hackers, I am Parth Narula. A penetration tester, bug hunter, red teamer and overall a security researcher. I live for those moments…

Continue reading on Medium »

]]> https://scriptjacker.medium.com/the-ghost-email-how-weak-validation-broke-authentication-b45774caae70?source=rss------bug_bounty_tips-5 https://medium.com/p/b45774caae70 Mon, 04 May 2026 17:42:05 GMT 2026-05-04T17:42:05.099Z <![CDATA[CPDoS via Content Negotiation Mechanism]]>

Exploring how response format switching leads to CPDoS

Continue reading on Medium »

]]> https://medium.com/@bbcodejump/cpdos-via-content-negotiation-mechanism-4fdb438ad7d0?source=rss------bug_bounty_tips-5 https://medium.com/p/4fdb438ad7d0 Mon, 04 May 2026 07:35:39 GMT 2026-05-04T09:02:01.081Z http://creativecommons.org/publicdomain/zero/1.0/ <![CDATA[Chaining Logic Flaws: From KYC Bypass to Authenticated Time-Based SQLi and Mass IDOR]]>

1. Entry Point: Phone Verification (KYC) Bypass

Continue reading on Medium »

]]> https://medium.com/@xelcezeri/chaining-logic-flaws-from-kyc-bypass-to-authenticated-time-based-sqli-and-mass-idor-0425f362dad5?source=rss------bug_bounty_tips-5 https://medium.com/p/0425f362dad5 Sun, 03 May 2026 16:47:45 GMT 2026-05-03T16:47:45.062Z <![CDATA[How I Broke a Travel Giant’s “Non-Refundable” Policy for a $12,000 Bounty]]>

If you’ve ever booked a “non-refundable” hotel room, you know that feeling of dread when your plans change. You’re locked in. The money is…

Continue reading on Medium »

]]> https://medium.com/@21bec131/how-i-broke-a-travel-giants-non-refundable-policy-for-a-12-000-bounty-04148200279a?source=rss------bug_bounty_tips-5 https://medium.com/p/04148200279a Sun, 03 May 2026 16:41:01 GMT 2026-05-03T16:41:01.428Z <![CDATA[Parameter Index Manipulation Leading to Unauthorized Field Injection]]>

Introduction

Continue reading on Medium »

]]> https://medium.com/@0xoroot/parameter-index-manipulation-leading-to-unauthorized-field-injection-7e830ecfad05?source=rss------bug_bounty_tips-5 https://medium.com/p/7e830ecfad05 Sun, 03 May 2026 11:01:27 GMT 2026-05-03T11:01:27.993Z <![CDATA[The Ghost in the Machine: A Bug Bounty Short Story]]>

It was 2:00 AM, and my terminal was a blur of scrolling green text. I was deep into a private bug bounty program for a massive corporate…

Continue reading on Medium »

]]> https://abdelaalx2000.medium.com/the-ghost-in-the-machine-a-bug-bounty-short-story-58f2367705a6?source=rss------bug_bounty_tips-5 https://medium.com/p/58f2367705a6 Sun, 03 May 2026 09:14:45 GMT 2026-05-03T09:14:45.338Z <![CDATA[Proving Grounds |Pelican | OSCP Preparation]]>

As part of my OSCP preparation series; I will be covering walk throughs for all the boxes on the TJ null list. Today we are looking at…

Continue reading on Medium »

]]> https://medium.com/@SilentExploit/proving-grounds-pelican-oscp-preparation-37e94deee7dc?source=rss------bug_bounty_tips-5 https://medium.com/p/37e94deee7dc Sat, 02 May 2026 18:54:51 GMT 2026-05-02T18:54:51.807Z