Bug Bounty

In my previous blog , I talk about how I wrote a script to bypass API restrictions. Would recommend everyone to go through the previous blog to understand the nuances and challenges of bypassing it before going forward. Recently the application got updated and the X-Api-Token field is no longer…

Hello everyone, Do you know about Graphite, a popular tool for monitoring metrics? If that’s the case, you’re probably also familiar with the Function Description tooltip, which gives useful information about various functions that may be used to edit metrics data. Nevertheless, you may be unaware that this seemingly harmless…

Hello Everyone, I am Ambush Neupane from Nepal. I hope you all are doing great. This is my first blog and in this blog I am going to explain how I found an interesting security issue in a dutch government site which could have allowed an attacker to gain unauthorized…

Cross-site scripting (XSS) is one of the most common web application vulnerabilities and can have serious consequences for both individuals and organizations. In this article, we’ll explore what XSS is, how it works, and what steps you can take to prevent and detect it. What is XSS? Cross-site scripting (XSS) is a type…

Hello everyone, I found a flaw that gave me access to user accounts by using Unicode normalization during my security analysis of the web application. Summary: A system security vulnerability that allows attackers to perform an account takeover attack.The problem comes as a result of the system’s absence of sufficient Unicode…

Hey folks, Today we are going to talk about the another basic vector called File inclusions. For the purpose of exploiting file inclusion vulnerabilities in an application first we need to understand what is file inclusion and how it occurs on an application. So that we can find and exploit…

Hello people of cyber security, I am ferreira, a random enthusiast of Information Security, I especially enjoy recon, and stuff related. …

Hi amazing researcher, Welcome to another review of the vulnerability discovery on ASDA. Today I want to discuss Host Header Poisoning leading to a one-click-to-account takeover BUT that wasn’t a normal one. technically I used open redirect and Port Poisoning to exploit this vulnerability. Be my guest… Let’s talk about…