Bugcrowd

Microsoft MSRC Quarterly Leaderboard from my security bug reports submitted. — Table of Contents — Part 0 — Whoami? — Part 1 — Selecting a program — Part 2 — Let the hunt begin! — Part 3 — Reporting — Part 4 — Claims the Rewards — Disclosure Timelines Part 0 — Whoami? Hello, I am Supakiad Satuwan, a Security Consultant from Thailand. In this article, I will…

This is for information only, and this scenario has been encountered more than once, but it must be noted I will explain everything in detail Well, first of all, we do the usual thing, but here I will be brief. I used a tool in the system and extracted the…

Whether you are a bug bounty hunter or a pentester you should avoid fundamental mistakes. It’s all about efficiency and professionalism while growing your skills and striving for better results. I’ve prepared a list of (5) the most common mistakes you should avoid when working on the bug bounty programs…

Tool Google Dork Explain I usually use google dork. like this site:example.com { Dork command } But if you use this It’s too much information like and it will be difficult to find sensitive data So I use this site:example.com { Dork command } -www www It’s the domain that Found it during a lot of searching such as site:.example.com { Dork Command} and result like test.example.com test.example.com test.example.com

Tool amass GitHub - OWASP/Amass: In-depth Attack Surface Mapping and Asset Discovery The OWASP Amass Project performs network mapping of attack surfaces and external asset discovery using open source…github.com Explain Honesty. At first I didn’t even know it was P1 hahahaha I think I found it with my recon process So I wanted to tell you how I recon it. so first I use amass command : amass enum -d {domain} -passive -norecursive -noalts -silent

Original post: https://nobugescapes.com/blog/blind-insecure-direct-object-reference-idor-leads-to-export-other-users-data/ Summary: The following write-up explains a vulnerability I found on Instagram. Due to an Instagram “Leads Submissions” flaw, I was able to export users’ data into a CSV file sent to my email. If you run a business Instagram account, you can collect information about your followers with…

Tool Google Dork Explain: I use Google Dork like site:example.com ext:pdf and this time I put specific after dork command like site:example.com ext:pdf “{keyword}” I did this one because I want to find specific word in pdf file such as password username ID Email And this time I found 3 Credentials Leak

OAUTH MISCONFIGURATION LEADS TO PRE ACCOUNT TAKEOVER Hello everyone!! ☺️ Hope you are doing good 😊 .This is my second write-up. If you have not gone through my first one, so do check it out here ->https://link.medium.com/pewrVK1RHtb .The second medium’s vulnerability is OAUTH MISCONFIGURATION LEADS TO PRE ACCOUNT TAKEOVER. . …