Tag feed

#bug-bounty

90 posts176 followers

Explore Hashnode

Alternatives

Trending tags this week

BB0dj0xb0dj0x.hashnode.dev6d ago · 6 min read

How to Start Bug Bounty Hunting in 2026: The Complete Beginner's Guide

Everything you need to know to find your first vulnerability, get paid, and build a real reputation in cybersecurity — without breaking any laws. If you've typed "how to start bug bounty hunting" int

0

YPYogeshwar Peelaexploitnotes.hashnode.devJul 18 · 7 min read

FAM CTF : The Cloud writeup

Summary The target exposed a webhook endpoint (/internal/webhook) meant to act as an internal-only proxy, blocking direct requests to private and link-local IP ranges. That blocklist checked resolved

0

YPYogeshwar Peelaexploitnotes.hashnode.devJul 17 · 4 min read

HackTheBox : Void Whispers Writeup

Summary The "Void Whispers" mail-settings panel passes the user-supplied sendMailPath field directly into shell_exec("which $sendMailPath") with no escaping. The app only filters literal whitespace, w

0

Ssecurity_researchersecurity11.hashnode.devJul 3 · 5 min read

Breaking Through the Invisible Walls: How JS Recon and Parameter Pollution Exposed Sensitive KYC Data

Some of the best vulnerabilities are hidden not in plain sight, but in the dark, forgotten corners of an application. This writeup details the discovery of a logical flaw chain within a project manage

0

TVThuriaanandh Vthuriaanandh-sec.hashnode.devJun 13 · 6 min read

Path Traversal: 6 Labs, 6 Times I Was Wrong Before I Was Right

I just finished all six Path Traversal labs on PortSwigger's Web Security Academy, going from Apprentice to Practitioner level. Going in, I thought path traversal was simple — just throw ../../../etc/

0

RRenganathanrptl.hashnode.devJun 12 · 6 min read

How a Misconfigured API Exposed Founder, Investor, and Employee Data at a Leading Venture Capital Firm

A globally leading early-stage venture capital firm, known for backing high-growth technology and AI startups, was found exposing sensitive internal and ecosystem data through a misconfigured Algolia

0

JWJustin Waltersexegy.todayMay 12 · 4 min read

The Silence of the Gatekeepers: Why Selective Security is a Risk to Critical Infrastructure

In the world of high-frequency trading and live stock exchange data, security isn't just a feature—it is the foundation of market integrity. Yet, as exegy.today continues its investigation into the vu

0

MBMouhamed Ben Abdallaherinmin-writeups.hashnode.devMay 12 · 8 min read

Unprotected Admin Functionality

Platform: PortSwigger Web Security Academy Category: Access Control / Vertical Privilege Escalation Difficulty: Apprentice Tool(s): Browser only Date: 12/05/2026 Overview This lab demonstrates a ver

0

MEMr Elitesecurityelites.hashnode.devMay 2 · 5 min read

2026 LLM Jailbreak Landscape

📰 Originally published on Securityelites — AI Red Team Education — the canonical, fully-updated version of this article. The 2026 LLM Jailbreak Landscape — A Working Pentester’s Synthesis of Public Research By Lokesh Singh (Mr Elite) — Founder, Se...

0

Oosint78shemkar.hashnode.devApr 26 · 6 min read

One Extra JSON Key: How a Harmless Profile Endpoint Became an ATO Candidate

The harmless profile endpoint that taught me how real bugs work Early in my bug bounty journey, I found a bug that looked simple from the outside, but it changed the way I think about web security. At

0

#bug-bounty

Search Hashnode

#bug-bounty

Explore Hashnode

Trending tags this week

How to Start Bug Bounty Hunting in 2026: The Complete Beginner's Guide

FAM CTF : The Cloud writeup

HackTheBox : Void Whispers Writeup

Breaking Through the Invisible Walls: How JS Recon and Parameter Pollution Exposed Sensitive KYC Data

Path Traversal: 6 Labs, 6 Times I Was Wrong Before I Was Right

How a Misconfigured API Exposed Founder, Investor, and Employee Data at a Leading Venture Capital Firm

The Silence of the Gatekeepers: Why Selective Security is a Risk to Critical Infrastructure

Unprotected Admin Functionality

2026 LLM Jailbreak Landscape

One Extra JSON Key: How a Harmless Profile Endpoint Became an ATO Candidate