ASAbdulaziz Saadinblog.abdulaziz-d.com·5d ago · 10 min readThe $1000 Ticket IDOR: One Number Exposed National IDs and Government Staff PIISeverity: HighBounty: ~$949Program: Private Bug BountyPlatform: Bugbounty.sa This finding started with a very simple endpoint: GET /api/tickets-management/portal/history-by-ticket/<ticket_id> The end30
ASAbdulaziz Saadinblog.abdulaziz-d.com·6d ago · 12 min readFrom Editor to Owner: One Writable Field Was Enough to Take Over an OrganizationSeverity: HighBounty: ~$315Platform: Standoff365 This one came down to a single field that should never have been writable by an editor: Firm[user_id] The application had a clear permission model. An10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 6 · 5 min readTryHackMe : The Hollow ShellOverview The Hollow Shell is a Flask app ("Shoreline Display - Room Service") that lets an authenticated concierge upload themed "shells" as .zip archives. Each archive must contain a shell.json manif10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 7 min readTryHackMe : CryptoCabana WriteupOverview CryptoCabana is a fake crypto-backup service hosted as an Azure Static Website. The attack path chains together four separate misconfigurations: A low-privilege Azure user with only Reader o10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 6 min readTryHackMe : Towel on the Sunbed WriteupTL;DR Ponzi Portfolio is a Node.js/Express "staking rewards" web app with a 24-hour cooldown on claiming a reward. The /claim endpoint has a classic check-then-act race condition: it checks whether th10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 5 min readTryHackMe : Overheard at BreakfastTL;DR A single artifact - a zipped screenshot of a Discord-style DM conversation is the entire challenge. Two "Byte Lotus Hotel" guests, Ponzi and Lambo!, chat about social media; Lambo! name-drops a10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 6 min readTryHackMe : Packed Light WriteupTL;DR A .pcapng capture shows a victim host on 192.168.1.141 downloading a Python keylogger (updates.py) from an attacker-controlled "hotel update server" at byte-lotus-hotel.thm:8080 (34.41.103.191).10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 7 min readTryHackMe : Beach Bar WriteupTL;DR Beach Bar is a Flask-based "DJ booth" web app for a beach bar jukebox. Default demo credentials (dj/dj) left enabled in an HTML comment get you into the dashboard, which exposes a YAML playlist 10
ASAbdulaziz Saadinblog.abdulaziz-d.com·Jul 30 · 13 min readFrom Profile IDOR to Zero-Click Account Takeover: Changing One userid Parameter Was EnoughSeverity: CriticalBounty: $1,805Program: Private Bug BountyPlatform: Bugbounty.sa This started as a straightforward profile IDOR. An authenticated user could change a userid parameter and load another21N
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 24 · 18 min readTryHackMe : Enterprise WriteupSummary Enterprise is an Active Directory box that starts as a classic external AD footprint (DNS, Kerberos, LDAP, SMB, RDP, WinRM) plus two extra web ports: an IIS site on 80 and a Bitbucket-branded 10
