<![CDATA[Bug Bounty Writeup on Medium]]> https://medium.com/tag/bug-bounty-writeup/latest?source=rss------bug_bounty_writeup-5 https://cdn-images-1.medium.com/proxy/1*TGH72Nnw24QL3iV9IOm4VA.png Bug Bounty Writeup on Medium https://medium.com/tag/bug-bounty-writeup/latest?source=rss------bug_bounty_writeup-5 Medium Wed, 06 May 2026 15:34:00 GMT <![CDATA[The “Infinite Discount” Glitch: How I Used a Race Condition to Buy a MacBook for -$300]]>

This is the story of how a “boring” e-commerce site turned into a playground for a Race Condition vulnerability. If you think hacking is…

Continue reading on Medium »

]]> https://medium.com/@21bec131/the-infinite-discount-glitch-how-i-used-a-race-condition-to-buy-a-macbook-for-300-4257a28e1946?source=rss------bug_bounty_writeup-5 https://medium.com/p/4257a28e1946 Tue, 05 May 2026 16:21:01 GMT 2026-05-05T16:21:01.827Z <![CDATA[Unauthorized Workspace Deletion via Broken Access Control]]>

Hello hunters, hope you all are crushing bugs 👋

Continue reading on Medium »

]]> https://medium.com/@sagar_kirola-G35638/unauthorized-workspace-deletion-via-broken-access-control-e7fbd4234581?source=rss------bug_bounty_writeup-5 https://medium.com/p/e7fbd4234581 Tue, 05 May 2026 14:54:31 GMT 2026-05-05T14:54:31.800Z <![CDATA[HackTheBox — TwoMillion: A Lesson in API Abuse and Privilege Escalation]]>

Difficulty: Easy | OS: Linux | Tags: API, Command Injection, CVE-2023–0386, OverlayFS

Continue reading on Medium »

]]> https://medium.com/@shxdowz/hackthebox-twomillion-a-lesson-in-api-abuse-and-privilege-escalation-0c66bd704070?source=rss------bug_bounty_writeup-5 https://medium.com/p/0c66bd704070 Tue, 05 May 2026 05:51:37 GMT 2026-05-05T05:51:37.609Z <![CDATA[From Directory Brute-Forcing to Real-Time GPS Tracking: Exploiting S3 Bucket Misconfigurations]]>

This isn’t just a story about a bug; it’s a story about the “Subdomain Graveyard” that dusty, forgotten corner of the internet where…

Continue reading on Medium »

]]> https://medium.com/@21bec131/from-directory-brute-forcing-to-real-time-gps-tracking-exploiting-s3-bucket-misconfigurations-f03b088a0a3d?source=rss------bug_bounty_writeup-5 https://medium.com/p/f03b088a0a3d Mon, 04 May 2026 19:15:10 GMT 2026-05-04T19:15:10.935Z <![CDATA[The Ghost Email: How Weak Validation Broke Authentication]]>

Hey Hackers, I am Parth Narula. A penetration tester, bug hunter, red teamer and overall a security researcher. I live for those moments…

Continue reading on Medium »

]]> https://scriptjacker.medium.com/the-ghost-email-how-weak-validation-broke-authentication-b45774caae70?source=rss------bug_bounty_writeup-5 https://medium.com/p/b45774caae70 Mon, 04 May 2026 17:42:05 GMT 2026-05-04T17:42:05.099Z <![CDATA[Chaining Logic Flaws: From KYC Bypass to Authenticated Time-Based SQLi and Mass IDOR]]>

1. Entry Point: Phone Verification (KYC) Bypass

Continue reading on Medium »

]]> https://medium.com/@xelcezeri/chaining-logic-flaws-from-kyc-bypass-to-authenticated-time-based-sqli-and-mass-idor-0425f362dad5?source=rss------bug_bounty_writeup-5 https://medium.com/p/0425f362dad5 Sun, 03 May 2026 16:47:45 GMT 2026-05-03T16:47:45.062Z <![CDATA[Real Estate CRM Pentest: Broken Auth + IDOR + Stored XSS — Full Attack Chain]]>

Author: Shikhali Jamalzade (@alisalive) Type: Authorized Black Box Penetration Test Target: Anonymized — Real Estate CRM Web Application…

Continue reading on Medium »

]]> https://alisalive.medium.com/real-estate-crm-pentest-broken-auth-idor-stored-xss-full-attack-chain-5ef610a57e49?source=rss------bug_bounty_writeup-5 https://medium.com/p/5ef610a57e49 Sun, 03 May 2026 16:31:12 GMT 2026-05-05T10:09:21.371Z <![CDATA[Parameter Index Manipulation Leading to Unauthorized Field Injection]]>

Introduction

Continue reading on Medium »

]]> https://medium.com/@0xoroot/parameter-index-manipulation-leading-to-unauthorized-field-injection-7e830ecfad05?source=rss------bug_bounty_writeup-5 https://medium.com/p/7e830ecfad05 Sun, 03 May 2026 11:01:27 GMT 2026-05-03T11:01:27.993Z <![CDATA[The Ghost in the Machine: A Bug Bounty Short Story]]>

It was 2:00 AM, and my terminal was a blur of scrolling green text. I was deep into a private bug bounty program for a massive corporate…

Continue reading on Medium »

]]> https://abdelaalx2000.medium.com/the-ghost-in-the-machine-a-bug-bounty-short-story-58f2367705a6?source=rss------bug_bounty_writeup-5 https://medium.com/p/58f2367705a6 Sun, 03 May 2026 09:14:45 GMT 2026-05-03T09:14:45.338Z <![CDATA[Find SQL injection with burp Suite scanner]]>

During a testing, we came across this situation:

Continue reading on Medium »

]]> https://awais0x1.medium.com/discovering-an-sql-injection-with-burps-scanner-41c6c5910d84?source=rss------bug_bounty_writeup-5 https://medium.com/p/41c6c5910d84 Sat, 02 May 2026 18:26:11 GMT 2026-05-02T18:31:12.351Z