--- title: "#bugbounty articles | Hashnode" description: "Explore 371 articles tagged #bugbounty on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/bugbounty" --- Tag # #bugbounty 371 posts · 308 followers [Ethical Hacker](https://hashnode.com/@usman4) · [16h ago](https://hashnode.com/posts/day-1-my-learning-broken-access-control-linux-file-system/6af4b3bd8c56dfc3ddd2162f) ### [Day 1 of my learning:](https://0xsec.hashnode.dev/day-1-my-learning-broken-access-control-linux-file-system?utm_source=hashnode&utm_medium=feed) My Day 1 learning covering BAC (Vertical/Horizontal), IDOR, session state, modern Linux File Systems (Inodes, Links, VFS) from standard sources. 3 min read · [0xsec.hashnode.dev](https://0xsec.hashnode.dev/day-1-my-learning-broken-access-control-linux-file-system?utm_source=hashnode&utm_medium=feed) [Sentinelleai](https://hashnode.com/@sentinelleai) · [3d ago](https://hashnode.com/posts/how-to-find-bug-bounty-and-disclosure-programs-and-get-a-report-accepted/6af1087623a483afa286aeda) ### [How to find bug bounty and disclosure programs, and get a report accepted](https://sentinelleai.hashnode.dev/how-to-find-bug-bounty-and-disclosure-programs-and-get-a-report-accepted?utm_source=hashnode&utm_medium=feed) Originally published on sentinelleai.app. Programs are published in many places. The skill is knowing where to look, and reading the rules before you touch anything. If you search for "responsible d 13 min read · [sentinelleai.hashnode.dev](https://sentinelleai.hashnode.dev/how-to-find-bug-bounty-and-disclosure-programs-and-get-a-report-accepted?utm_source=hashnode&utm_medium=feed) [chaitalisinghania](https://hashnode.com/@chaitali142) · [Oct 28](https://hashnode.com/posts/pentest-vs-bug-bounty-why-mature-security-teams-run-both/6ae1a49f1f92309c5801f84e) ### [Pentest vs Bug Bounty: Why Mature Security Teams Run Both](https://cybersecuritydigest.hashnode.dev/pentest-vs-bug-bounty-why-mature-security-teams-run-both?utm_source=hashnode&utm_medium=feed) Discover key differences between pentesting vs bug bounty programs and learn why mature security teams use both to strengthen application security. 5 min read · [cybersecuritydigest.hashnode.dev](https://cybersecuritydigest.hashnode.dev/pentest-vs-bug-bounty-why-mature-security-teams-run-both?utm_source=hashnode&utm_medium=feed) [Dimakatso Sebatane](https://hashnode.com/@ovawatch-security) · [Oct 18](https://hashnode.com/posts/case-study-cross-tenant-data-exfiltration-via-backup-restore/6ad6108301bf51809c3a6b0f) ### [Case Study: Cross-Tenant Data Exfiltration via Backup Restore](https://ovawatch-security.hashnode.dev/case-study-cross-tenant-data-exfiltration-via-backup-restore?utm_source=hashnode&utm_medium=feed) How broken tenant isolation and missing authorization checks in backup restoration can allow attackers to access sensitive data belonging to other organizations. Full video at : https://youtu.be/AshvGLWsclw 9 min read · [ovawatch-security.hashnode.dev](https://ovawatch-security.hashnode.dev/case-study-cross-tenant-data-exfiltration-via-backup-restore?utm_source=hashnode&utm_medium=feed) [Dimakatso Sebatane](https://hashnode.com/@ovawatch-security) · [Oct 10](https://hashnode.com/posts/case-study-pre-account-takeover-via-oauth-misconfiguration/6ad60608308bcb754693225b) ### [Case Study: Pre-Account Takeover via OAuth Misconfiguration](https://ovawatch-security.hashnode.dev/case-study-pre-account-takeover-via-oauth-misconfiguration?utm_source=hashnode&utm_medium=feed) How weaknesses in OAuth account linking and authentication flows can allow attackers to compromise user accounts before legitimate registration. Full video at : https://youtu.be/tDXNoB5-\_2o 12 min read · [ovawatch-security.hashnode.dev](https://ovawatch-security.hashnode.dev/case-study-pre-account-takeover-via-oauth-misconfiguration?utm_source=hashnode&utm_medium=feed) [samineni nikhil](https://hashnode.com/@nikhilsamineni) · [Oct 5](https://hashnode.com/posts/i-observed-a-session-management-behavior-after-password-reset-what-i-learned-about-cwe-613/6ac3dc8e1f21bb8b39820cd8) ### [I Observed a Session Management Behavior After Password Reset — What I Learned About CWE-613](https://nikhilsamineni.hashnode.dev/i-observed-a-session-management-behavior-after-password-reset-what-i-learned-about-cwe-613?utm_source=hashnode&utm_medium=feed) Introduction While learning Web Application Security and Bug Bounty, I wanted to understand how applications handle existing authenticated sessions when a user changes or resets their password. I test 7 min read · [nikhilsamineni.hashnode.dev](https://nikhilsamineni.hashnode.dev/i-observed-a-session-management-behavior-after-password-reset-what-i-learned-about-cwe-613?utm_source=hashnode&utm_medium=feed) [Dimakatso Sebatane](https://hashnode.com/@ovawatch-security) · [Oct 3](https://hashnode.com/posts/case-study-from-html-injection-to-credential-theft/6ad5f939ac782aad2c7b8a5d) ### [Case Study: From HTML Injection to Credential Theft](https://ovawatch-security.hashnode.dev/case-study-from-html-injection-to-credential-theft?utm_source=hashnode&utm_medium=feed) Examining how insufficient HTML sanitization enables credential phishing through attacker-controlled content Full video at https://youtu.be/XDD-hwdWJjY 11 min read · [ovawatch-security.hashnode.dev](https://ovawatch-security.hashnode.dev/case-study-from-html-injection-to-credential-theft?utm_source=hashnode&utm_medium=feed) [Ashitesh](https://hashnode.com/@ashitesh) · [Sep 30](https://hashnode.com/posts/responsible-disclosure-how-a-single-mobile-flaw-exposed-million-student-parent-teacher-records-across-india/6abcdf04c057a17fe75b56ab) ### [Responsible Disclosure: How a Single Mobile Flaw Exposed Million+ Student, Parent & Teacher Records Across India](https://ashitesh.me/responsible-disclosure-how-a-single-mobile-flaw-exposed-million-student-parent-teacher-records-across-india?utm_source=hashnode&utm_medium=feed) How an insecure client cache in an Indian school ERP exposed 5M+ student records and 12TB+ cloud data. Remediated & acknowledged by CERT-In. 9 min read · [ashitesh.me](https://ashitesh.me/responsible-disclosure-how-a-single-mobile-flaw-exposed-million-student-parent-teacher-records-across-india?utm_source=hashnode&utm_medium=feed) [Abdulaziz Saad](https://hashnode.com/@b4zb0z) · [Sep 19](https://hashnode.com/posts/from-establishment-idor-to-account-takeover-changing-one-number-was-enough/6aaf2138451ac0e94d0e970c) ### [From Establishment IDOR to Account Takeover: Changing One Number Was Enough](https://blog.abdulaziz-d.com/from-establishment-idor-to-account-takeover-changing-one-number-was-enough?utm_source=hashnode&utm_medium=feed) Severity: HighBounty: ~$1145Program: Private Bug BountyPlatform: Bugbounty.sa Some account takeovers start with stolen passwords, leaked tokens, or complicated OAuth chains. This one started with chan 10 min read · [blog.abdulaziz-d.com](https://blog.abdulaziz-d.com/from-establishment-idor-to-account-takeover-changing-one-number-was-enough?utm_source=hashnode&utm_medium=feed) [samineni nikhil](https://hashnode.com/@nikhilsamineni) · [Sep 15](https://hashnode.com/posts/social-engineering-phishing-attack-a-hands-on-cybersecurity-lab/6aa9b6cd27903d0dfb5d4835) ### [Social Engineering & Phishing Attack — A Hands-on Cybersecurity Lab](https://nikhilsamineni.hashnode.dev/social-engineering-phishing-attack-a-hands-on-cybersecurity-lab?utm_source=hashnode&utm_medium=feed) Introduction When we talk about cybersecurity, we usually think about hackers attacking computers, servers, or networks. But there is another important target: people. An attacker does not always need 10 min read · [nikhilsamineni.hashnode.dev](https://nikhilsamineni.hashnode.dev/social-engineering-phishing-attack-a-hands-on-cybersecurity-lab?utm_source=hashnode&utm_medium=feed)