Hi, you started your 30-day challenge in a public or private bbp and also was that a new asset? just curious.
The 2FA Bypass with Grant Access section is not very clear. The redirect must be victim@gmail.com. If the redirect is to victi.m@gmail.com, the user is a new user, and 2FA is not enabled
Same here, the struggle is real. Reported more than 20 bugs as of now, only 1 paid. All other duplicates and N/As. Also no response from program most of the time.
In "2FA bypass with GrantAccess" If an attacker sends the invitation to victim.m@gmail.com . The invitation mail will still be delivered to victim@gmail.com right? So how is the attacker able to access that link?
Redwanur Rahman
WHat_is_that?
brother I've submitted 12 vuln so far 5 min BBP and 7 in VDP all of them being N/A/ dup risk accepted, informative