EEthical Hacker·16h agoDay 1 of my learning:My Day 1 learning covering BAC (Vertical/Horizontal), IDOR, session state, modern Linux File Systems (Inodes, Links, VFS) from standard sources.3 min read·0xsec.hashnode.dev
SSentinelleai·3d agoHow to find bug bounty and disclosure programs, and get a report acceptedOriginally published on sentinelleai.app. Programs are published in many places. The skill is knowing where to look, and reading the rules before you touch anything. If you search for "responsible d13 min read·sentinelleai.hashnode.dev
Cchaitalisinghania·Oct 28Pentest vs Bug Bounty: Why Mature Security Teams Run BothDiscover key differences between pentesting vs bug bounty programs and learn why mature security teams use both to strengthen application security.5 min read·cybersecuritydigest.hashnode.dev
DDimakatso Sebatane·Oct 18Case Study: Cross-Tenant Data Exfiltration via Backup RestoreHow broken tenant isolation and missing authorization checks in backup restoration can allow attackers to access sensitive data belonging to other organizations. Full video at : https://youtu.be/AshvGLWsclw9 min read·ovawatch-security.hashnode.dev
DDimakatso Sebatane·Oct 10Case Study: Pre-Account Takeover via OAuth MisconfigurationHow weaknesses in OAuth account linking and authentication flows can allow attackers to compromise user accounts before legitimate registration. Full video at : https://youtu.be/tDXNoB5-_2o12 min read·ovawatch-security.hashnode.dev
Ssamineni nikhil·Oct 5I Observed a Session Management Behavior After Password Reset — What I Learned About CWE-613Introduction While learning Web Application Security and Bug Bounty, I wanted to understand how applications handle existing authenticated sessions when a user changes or resets their password. I test7 min read·nikhilsamineni.hashnode.dev
DDimakatso Sebatane·Oct 3Case Study: From HTML Injection to Credential Theft Examining how insufficient HTML sanitization enables credential phishing through attacker-controlled content Full video at https://youtu.be/XDD-hwdWJjY11 min read·ovawatch-security.hashnode.dev
AAshitesh·Sep 30Responsible Disclosure: How a Single Mobile Flaw Exposed Million+ Student, Parent & Teacher Records Across IndiaHow an insecure client cache in an Indian school ERP exposed 5M+ student records and 12TB+ cloud data. Remediated & acknowledged by CERT-In.9 min read·ashitesh.me2
AAbdulaziz Saad·Sep 19From Establishment IDOR to Account Takeover: Changing One Number Was EnoughSeverity: HighBounty: ~$1145Program: Private Bug BountyPlatform: Bugbounty.sa Some account takeovers start with stolen passwords, leaked tokens, or complicated OAuth chains. This one started with chan10 min read·blog.abdulaziz-d.com
Ssamineni nikhil·Sep 15Social Engineering & Phishing Attack — A Hands-on Cybersecurity LabIntroduction When we talk about cybersecurity, we usually think about hackers attacking computers, servers, or networks. But there is another important target: people. An attacker does not always need10 min read·nikhilsamineni.hashnode.dev
