Apr 26 · 6 min read · The harmless profile endpoint that taught me how real bugs work Early in my bug bounty journey, I found a bug that looked simple from the outside, but it changed the way I think about web security. At
Join discussion
Apr 18 · 6 min read · Originally published on satyamrastogi.com Kamerin Stokes monetized DraftKings credentials through underground marketplaces post-plea, revealing systemic gaps in credential revocation and underground market monitoring. DraftKings Credential Traffick...
Join discussion
Apr 7 · 13 min read · Account takeover (ATO) is the fraud vector that breaks most traditional detection systems -- not because it is technically sophisticated, but because it uses entirely valid credentials. The attacker is not forging a card number or synthesizing a fake...
Join discussion
Feb 24 · 2 min read · In today’s digital-first world, most U.S. businesses rely on OAuth to make logging in easier for users. From Google and Microsoft to Slack and Dropbox, OAuth allows users to access apps without repeat
Join discussionFeb 8 · 6 min read · Most people think WhatsApp hacks look dramatic. A locked account.A warning message.A sudden logout. But what if the most dangerous WhatsApp attack does none of that? The Ghostpairing attack is a stealthy form of WhatsApp account takeover that doesn’t...
Join discussion
Jan 16 · 4 min read · When we talk about account takeover, we usually imagine a familiar story: an attacker steals credentials, hijacks a session, or abuses password reset flows to log in as someone else. This write-up is about something more subtle — and arguably more da...
Join discussion
Jan 16 · 2 min read · Overview During a penetration test of a Web Applications API, I discovered a vulnerability in the password reset functionality that allowed an attacker to intercept reset tokens and take over user accounts. By manipulating a user-controllable field i...
Join discussion
Jan 3 · 4 min read · Hey, yolo guys! Long time no chat! As we already know, bug bounty is a scam (just kidding 🙂). I recently started doing penetration testing for startups in my country. In this case, it was an online marketplace, where I discovered eight security vuln...
Join discussion
