ASAbdulaziz Saadinblog.abdulaziz-d.com·20h ago · 12 min readFrom Editor to Owner: One Writable Field Was Enough to Take Over an OrganizationSeverity: HighBounty: ~$315Platform: Standoff365 This one came down to a single field that should never have been writable by an editor: Firm[user_id] The application had a clear permission model. An10
ASAbdulaziz Saadinblog.abdulaziz-d.com·Aug 7 · 12 min readA $2,000 API Key: Unauthorized Access to Paid Medical TranscriptionSeverity: HighBounty: $2,000Retest Reward: $150Total Awarded: $2,150Program: Private ProgramPlatform: HackerOne This finding started with a familiar Android testing problem: What secrets were shipped00
ASAbdulaziz Saadinblog.abdulaziz-d.com·Jul 30 · 13 min readFrom Profile IDOR to Zero-Click Account Takeover: Changing One userid Parameter Was EnoughSeverity: CriticalBounty: $1,805Program: Private Bug BountyPlatform: Bugbounty.sa This started as a straightforward profile IDOR. An authenticated user could change a userid parameter and load another21N
ASAbdulaziz Saadinblog.abdulaziz-d.com·May 21 · 6 min readIDOR in Government Ownership API Exposed Private Business Owner PII via CR Number EnumerationSeverity: HighBounty Awarded: $1,506Program: Private Bug BountyPlatform: Bugbounty.sa Some IDORs are obvious immediately. You change an ID. Someone else’s data appears. Easy. Others look harmless at f00
ASAbdulaziz Saadinblog.abdulaziz-d.com·May 18 · 9 min readZero-Click Stored XSS in Chat: When “Just Open the Window” Is EnoughSeverity: HighBounty Awarded: $394Program: Private Bug BountyPlatform: Bugbounty.sa Most chat XSS bugs are noisy. You send a payload. The victim has to click something. Refresh the page. Open the mes00
