Tag feed

#bugbounty

361 posts308 followers

Explore Hashnode

Alternatives

Trending tags this week

SSangharshanoob6t5.hashnode.dev17h ago · 3 min read

Insecure Firestore Security Rules & PII Exposure

After poking with firebase R/W Realtime Database (Unauthenticated): https://[REDACTED].firebaseio.com/.json (Access Denied) Storage Bucket (Unauthenticated): https://firebasestorage.googleapis.com/v

0

ZZeroProtocolwebpentestingdeepdive.hashnode.dev1d ago · 6 min read

Mapping a Web App’s Attack Surface

Before any serious security testing begins, skilled penetration testers spend a surprising amount of time simply looking. Long before an exploit is fired off, an attacker is quietly reading URLs, para

0

CSChris Sheridanhalosecurityhasnodedev.hashnode.dev2d ago · 8 min read

When the Safety System Becomes the Threat Model: A Case Study in Classifier Drift

Field notes from 43 hours of legitimate security research, 35 false-positive blocks, and one support form. The setup I do authorized bug bounty work and CTF practice. My toolchain is unremarkable by d

0

ZZeroProtocolwebpentestingdeepdive.hashnode.dev2d ago · 4 min read

Web Fingerprinting & Tech Mapping

In web application security testing, the initial Reconnaissance & Mapping Phase sets the foundation for everything that follows. Before you can evaluate an application's attack surface, you need to un

0

AAAhmed Awad ( NullC0d3 )nullc0d3.hashnode.dev2d ago · 3 min read

🐺 HunterX v7.0.0 - Less Noise. More Verified Findings.

A few months ago, HunterX was an idea. Today, HunterX v7.0.0 is out — and people are actually using it. 🚀 2,200+ Docker pulls ⭐ 1,200+ GitHub stars 🌎 Listed across major cybersecurity communities An

0

ZZeroProtocolwebpentestingdeepdive.hashnode.dev3d ago · 5 min read

Analyzing the Application

In web application security testing, simply enumerating the application's content — finding all its pages and links — is only a small part of the job. Equally important is deeply analyzing the applica

0

ASAbdulaziz Saadblog.abdulaziz-d.com4d ago · 10 min read

The $1000 Ticket IDOR: One Number Exposed National IDs and Government Staff PII

Severity: HighBounty: ~$949Program: Private Bug BountyPlatform: Bugbounty.sa This finding started with a very simple endpoint: GET /api/tickets-management/portal/history-by-ticket/<ticket_id> The end

0

ZZeroProtocolwebpentestingdeepdive.hashnode.dev4d ago · 4 min read

Web App Recon (Part-3)

Finding Hidden Content and Functionality When assessing a web application's security, its visible structure alone isn't enough. Content and functionality that aren't linked from anywhere within the ap

0

ASAbdulaziz Saadblog.abdulaziz-d.com5d ago · 12 min read

From Editor to Owner: One Writable Field Was Enough to Take Over an Organization

Severity: HighBounty: ~$315Platform: Standoff365 This one came down to a single field that should never have been writable by an editor: Firm[user_id] The application had a clear permission model. An

0

ZZeroProtocolwebpentestingdeepdive.hashnode.dev5d ago · 3 min read

Application Mapping(PART-2)

Hidden Content Discovery & Intelligent Prediction 1. Conceptual Blueprint: Why Hidden Content Exists Leaving hidden files on a server is similar to having unmapped maintenance rooms in a physical buil

1

Z

#bugbounty

Search Hashnode

#bugbounty

Explore Hashnode

Trending tags this week

Insecure Firestore Security Rules & PII Exposure

Mapping a Web App’s Attack Surface

When the Safety System Becomes the Threat Model: A Case Study in Classifier Drift

Web Fingerprinting & Tech Mapping

🐺 HunterX v7.0.0 - Less Noise. More Verified Findings.

Analyzing the Application

The $1000 Ticket IDOR: One Number Exposed National IDs and Government Staff PII

Web App Recon (Part-3)

From Editor to Owner: One Writable Field Was Enough to Take Over an Organization

Application Mapping(PART-2)