Learn bug bounty
with real writeups
Vulnerabilities, techniques and bypasses explained with real cases and documented bounties (€500-€2,000+). Almost all free, with no made-up paywalls.
Start here
How to learn bug bounty from scratch — Complete 2026 guide
Step-by-step roadmap: requirements, tools, vulnerabilities, platforms and how to land your first bounty.
Quick answer
What is the Bug Bounty Academy?
A free academy to learn bug bounty and ethical hacking from scratch. It brings together step-by-step web vulnerability guides, cheatsheets with copy-paste payloads, a security dictionary with clear definitions and a guide to platforms so you can start reporting real bugs.
Guides
16
Cheatsheets
18
Terms
50
Platforms
6
Learn at your own pace
Three levels, almost all content free. Some articles require a free account and a few advanced chains are reserved for subscribers.
- Common web vulnerabilities (XSS, IDOR, Open Redirect, Information Disclosure)
- Real writeups with documented bounties (€500 — €1,200)
- Free tools (Burp Community, ZAP, DevTools)
17 articles published
- Account takeover (OTP brute force, email normalization)
- IDOR in APIs and functionality abuse
- Stored XSS in non-obvious contexts (SVG, attributes)
23 articles published
- GraphQL: enumeration and mass extraction
- postMessage: origin validation bypasses
- RCE in sandboxes (Python, JS)
32 articles published
Client-side admin bypass — boolean manipulation + BAC in a modern SPA
Real Quora report: SPA with an isAdmin boolean in localStorage that controls the UI + a backend that doesn't validate server-side. How to chain a boolean flip with BAC for admin takeover.
Search a topic or technique
72 articles about vulnerabilities, techniques, bypasses and real cases. Filter by level and access.
72 articles
Client-side admin bypass — boolean manipulation + BAC in a modern SPA
Real Quora report: SPA with an isAdmin boolean in localStorage that controls the UI + a backend that doesn't validate server-side. How to chain a boolean flip with BAC for admin takeover.
Cloudflare WAF — payload size bypass, oversized body, plan-specific limits
Bypassing the Cloudflare WAF by exploiting body size limits per plan (Free 100kb, Pro 100kb, Business 500kb, Enterprise 1mb): oversize payload trick + chunked transfer encoding.
Headless browsers — SSRF and RCE in endpoints that render URLs
Endpoints that accept URLs for screenshots/PDF (Puppeteer, Playwright, wkhtmltopdf) are an SSRF goldmine: cloud metadata, file://, gopher://, JS injection with XSS-to-RCE in the chromium sandbox.
HTTP request smuggling — H2→H1 desync, TE.CL, CL.TE and H2.CL in 2026
An updated catalog of HTTP smuggling: classic CL.TE, TE.CL, H2→H1 downgrade desyncs, HTTP/2 SETTINGS frame abuse, chunked extensions and HTTP/2 pseudo-headers.
LLM hacking — prompt injection, jailbreaks, indirect injection and data exfiltration
Vulnerabilities in systems with exposed LLMs: direct prompt injection, indirect injection via external sources (RAG poisoning), system prompt extraction, jailbreaks and data exfiltration.
Next.js attack surface 2026 — middleware bypass, internal SSRF, RSC abuse
Next.js 13-16 specific vulnerabilities: middleware bypass with manipulated headers, SSRF in API routes, RSC (React Server Components) data leak, image optimization SSRF.
API keys exposed in public HTML — $2,000 without a single bypass
A productivity platform shipped a third-party CMS token in window.CONFIG. Anyone with DevTools could download paid templates. How to hunt this pattern in any SPA app.
CSRF (Cross-Site Request Forgery) — fully explained with bypasses
CSRF: how it's exploited, common defenses (tokens, SameSite, Origin), bypasses (method change, JSON, double-submit, content-type) and where to hunt it in any app.
IDOR in a newsletter API — the UI hides it, the API hands it over
An endpoint with no server-side authorization check. A public parameter in the URL. Access to the subscriber list of any newsletter on a professional social network.
Basic recon methodology — from the domain to the vulnerable endpoints
The minimal recon pipeline for bug bounty: subdomain enum, live host discovery, URL collection, parameter discovery. Free tools and execution order.
What is bug bounty? A complete guide to understanding how it works
Bug bounty explained: programs, platforms, types of vulnerabilities, how you get paid, duplicate ratios and why some hunters make a living from it.
Stored XSS in template names — from the most boring field to domain takeover
A template title field, unsanitized, in a session with permissions over domains. A real €1,200 bounty. How to find XSS where nobody looks.
0-click Account Takeover — OTP brute force + Email Normalization
Two separate flaws look minor. Together, they hand you full ATO knowing only the email. Real bounty: €560 and 12 minutes of exploitation.
File Upload — extension, content-type and magic bytes bypasses
10 bypasses to upload webshells: double extension, null byte, content-type spoof, magic bytes, polyglots, race conditions and path traversal abuse.
JWT — vulnerabilities, bypasses and claim manipulation
alg=none, RS256→HS256 confusion, kid SQLi/path traversal, jku spoofing, secret cracking with hashcat. How to hunt poorly verified JWTs.
OAuth attacks — state CSRF, redirect_uri bypass, code/token leakage
The missing state parameter, poorly validated redirect_uri, response_type confusion. How to steal OAuth tokens and force account linking.
SQL Injection — complete methodology with time-based, UNION and RCE
Detection via isomorphic queries, time-based payloads for 4 engines, escalation to RCE (xp_cmdshell, INTO OUTFILE, UDFs) and cross-field bypasses.
Cloudflare WAF Bypass — oversized body, header stuffing and cache poisoning
Cloudflare's WAF has per-plan inspection limits (~8KB Free, 128KB Enterprise). Padding bypass, header stuffing >100 headers, IP origin disclosure.
DOM XSS — gadgets, postMessage handlers and CVE-2025-59840
DOM XSS isn't just innerHTML. Sources/sinks, gadget chains via toString(), postMessage handlers without origin checks, broken hash-based routing.
HTTP Request Smuggling — CL.TE, TE.CL, TE.TE and caching exploitation
When the frontend and the backend interpret the same request differently. Smuggling for auth bypass, cache poisoning, victim-aware attacks.
Mass PII Extraction via GraphQL — 93 real profiles in 1 hour
A contact-sync GraphQL endpoint with no rate limiting, no ownership verification and batching of 200 numbers per request. Phone → real identity resolution.
RCE in a Python sandbox — from the bot editor to the server shell
An AI platform's Python sandbox didn't block os.popen(). Two lines of Python to run system commands, read environment variables and fingerprint the runtime.
SSRF — complete bypasses: localhost, IPv6, decimal, DNS and cloud metadata
11 techniques to bypass SSRF validation: enclosed alphanumeric, decimal IP, dot bypass, DNS rebinding, parameter pollution. Cloud metadata AWS/GCP/Azure.
Zero-Click postMessage Origin Bypass — from the canvas to credit drain
The postMessage listener only validated a field of e.data — controlled by the attacker. e.origin was never checked. From an iframe loaded when opening a bot, messages injected as if the victim had written them.
HackerOne vs Bugcrowd vs YesWeHack vs Intigriti — practical 2026 comparison
Real differences between the 4 bug bounty platforms: payout speed, triage quality, reputation system, public vs private programs and where the money is.
Burp Suite — setup from scratch for bug bounty (Community + Professional)
Installation, proxy + CA cert setup, target scope, essential extensions and workflow to start hunting with Burp Suite today.
Client-side JavaScript analysis — endpoints, secrets and source maps
Extracting hidden endpoints from JS bundles, secret detection, source map analysis and dynamic instrumentation with Frida to audit client-side logic.
How to write a bug bounty report that gets accepted — structure and common mistakes
The ideal structure of a bug bounty report: title, summary, impact, steps to reproduce, PoC, remediation. The 10 mistakes that get your report rejected.
LFI — Local File Inclusion: payloads, filter bypass, log poisoning and RCE
Path traversal, null-byte injection, double encoding, PHP wrappers (filter, data, expect, phar), log poisoning and escalating LFI to RCE on PHP/Java/Node stacks.
Complete recon — subdomains, fingerprinting, ASN and origin IPs
A practical recon methodology for bug bounty: passive/active subdomain enumeration, fingerprinting, ASN mapping, origin IPs to bypass the WAF and git history mining.
Security headers checklist 2026 — CSP, HSTS, X-Frame, Referrer-Policy and more
A complete audit of the HTTP security headers every modern application should have: real examples, correct configuration, common mistakes and how to report them.
Services checklist — first touch on any target (SSH, FTP, SMB, NFS, Redis, Mongo, RDP)
A practical first-enumeration checklist for the 15 most common services in pentesting: ports, default credentials, typical exploits and misconfigurations.
2FA bypass — TOTP brute force, response manipulation, fallback abuse, race conditions
Real 2FA bypass techniques: TOTP brute force, response manipulation (status 200 with no valid token), fallback to email OTP, race conditions in setup.
Account enumeration via LinkedIn + phone — exposure of millions of users
Real case: API account enumeration combined with LinkedIn scraping + reverse phone lookups to correlate real identities with private accounts. Critical privacy impact.
CSRF advanced exploitation — SameSite bypass, JSON CSRF, Flash, file upload CSRF
Advanced CSRF techniques beyond the classic form submit: SameSite=Lax bypass via GET, JSON CSRF with Content-Type tricks, file upload CSRF and exploitation chains.
IDOR and BAC — manual methodology to find broken access control
How to identify IDOR (Insecure Direct Object Reference) and BAC (Broken Access Control) manually: dual-account testing, parameter swap, role escalation, hidden parameters.
OAuth attacks — state CSRF, redirect_uri bypass, token reuse, token IDOR
Vulnerabilities in OAuth 2.0 flows: missing state parameter, redirect_uri loose validation, cross-app token reuse, IDOR in token refresh endpoints.
Password reset — Puny code, header injection, email normalization, host header
Password reset bypass with Unicode confusables, Host header injection, email normalization (gmail + alias), token leakage in referer, response manipulation.
postMessage — common vulnerabilities: origin bypass, XSS sink, cross-window IDOR
How to identify and exploit vulnerabilities in window.postMessage(): listeners without origin validation, insecure JSON payloads that reach DOM XSS, cross-origin IDOR.
Race conditions in a marketplace — coupons applied N times, negative stock, double checkout
How to identify and exploit race conditions in e-commerce flows: discount coupons applied multiple times, products with 0 stock sold, double checkout for refunds.
Stored XSS €1200 — sanitizer bypass via SVG href javascript: with entity encoding
Walkthrough of a real €1200 report: stored XSS in POE bypassing a sanitizer fix via SVG with href=`javascript:` and HTML entity encoding over the filtered characters.
XSS contexts — payloads per context (HTML, attribute, JS, URL, CSS)
How to identify the exact context where your input is injected and the payloads that escape each one: HTML body, HTML attribute, JS string, JS event, URL, CSS, JSON.
ASP.NET — ViewState deserialization, machineKey leak, padding oracle
Classic and modern vulnerabilities in the ASP.NET stack: ViewState deserialization without signature validation, machineKey leak via web.config disclosure, padding oracle attacks against encrypted ViewState.
CloudFront cache deception — exfiltrate PII via other users' cached responses
How to abuse CloudFront cache rules with fake extensions (.css, .js, .png) to serve cached authenticated responses to other users. Real-world PII leakage.
CSP bypass + CORS misconfig + XSS — a complete exploitation chain
How to chain CSP misconfiguration (unsafe-inline, wildcard sources, whitelisted JSONP endpoints), CORS with credentials and XSS for unrestricted data exfiltration.
DOM clobbering — overriding global JS variables to bypass sanitizers
How to use DOM clobbering (name/id collisions) to overwrite global JS variables and bypass sanitizers like DOMPurify, achieving XSS where innerHTML is blocked by default.
DOM XSS — sources, sinks and gadgets to chain filter bypasses
A complete map of sources (location, postMessage, document.referrer, localStorage) and sinks (innerHTML, eval, document.write, jQuery $.html) + gadgets to build undetectable payloads.
DoS via WAF body size — exhausting the inspection budget on Cloudflare/Akamai
How to abuse the body inspection limit in WAFs (Cloudflare 100kb, Akamai 32kb) to drain the inspection budget and force a bypass — useful both for evasion and for controlled DoS.
OAuth open redirect — backslash bypass of redirect_uri (POE report walkthrough)
Walkthrough of the POE report: open redirect via `\` (backslash) in redirect_uri that POE's parser didn't normalize correctly. URL-based XSS chained for token theft.
PHP class pollution — the PHP equivalent of Prototype Pollution
How PHP class pollution (via recursive merge / object instantiation with user input) produces deserialization-like RCE in Laravel, Symfony, WordPress apps without needing gadget chains.
Android XSS — exported Activity via ContentActivity (POE/Quora real report)
Walkthrough of Android XSS exploitable via an exported Activity intent in POE: how a filter-less ContentActivity leaks the WebView to attacker-controlled sites.
Secondary context XSS — finding XSS where the primary parsing doesn't detect it
When the primary parsing escapes but a secondary context (markdown render, BBCode, a custom template engine) re-interprets, opening XSS hidden from traditional sanitizers.
SSRF — localhost bypasses, DNS rebinding, cloud metadata, gopher://
A complete catalog of SSRF bypasses in 2026: IP encodings (decimal, hex, octal, dword), DNS rebinding, IPv6 abuse, cloud metadata (AWS IMDSv2, GCP, Azure), gopher:// for chaining to Redis/Memcached RCE.
XS-Leaks — cross-site timing attacks, error-based leaks, frame-counting
XS-Leaks techniques 2026: timing attacks with performance.now(), error-based leaks via tag onerror/onload, frame-counting with CSP violations, ID-based leaks via element selector and storage timing.
XSS escalation — from Self-XSS to Account Takeover with real chains
How to turn a seemingly useless Self-XSS into a full takeover: clickjacking, login-CSRF + Self-XSS, cookie tossing, postMessage hijack, hash injection, OAuth flow abuse.
XSS WAF bypass — encoding, parser differentials, case-only mutations
WAF bypass techniques for XSS: HTML entities, hex/decimal/unicode encoding, parser differentials (browser vs WAF), comment injection, case variations, JS template literals.
Cookie flags — Secure, HttpOnly, SameSite and why they matter
HttpOnly blocks XSS-to-cookie, Secure forces HTTPS, SameSite kills CSRF. How they break and what to report when they're missing on sensitive cookies.
Information Disclosure — the 12 highest-paying patterns
API keys in HTML, debug endpoints, verbose errors, JS bundles with secrets, exposed .git, header leaks. How to find it and why it's fixed fast and paid.
IP leak via a chat GIF — Client-Side Request Forgery + Information Disclosure
A social network didn't validate the URL of a GIF sent in chat. Sending a GIF revealed the victim's IP, operating system, phone model and device ID.
Command Injection — bypasses with spaces, encoding and backticks
Command injection in endpoints that pass input to the shell. Filter bypasses: ${IFS}, $@, ;|&, encoded null bytes, output redirection to a file.
CORS misconfigurations — null origin, wildcard credentials and subdomain trust
When ACAO reflects any Origin with ACAC=true, when null is accepted, when subdomains are wildcarded — cross-site leak of authenticated data.
NoSQL Injection — MongoDB, Firebase and operator bypasses
How to inject into NoSQL queries: $ne/$gt/$regex in MongoDB, auth bypass, blind extraction and differences from classic SQLi.
Open Redirect via Backslash Bypass in the OAuth Login's redirect_url
The client-side validator checks //, : and /. The backslash slips through. Browsers normalize it to a slash and the victim ends up on evil.tld with an active session cookie.
URL shortener as a mass PII leak — extraction of ~300 people/hour
Low-entropy codes + no rate limiting + a ticket with no auth = enumeration of phone numbers, cards (BIN+last 4) and real customers' purchases.
Rate limit bypasses — IP rotation, header spoofing, casing and alternative endpoints
X-Forwarded-For, IP rotation with cloudfront IPs, path casing, encoding tricks, bucket race condition. How to find the gaps in throttling.
Stored XSS via SVG with href javascript: in chat — reclassification of Self-XSS
An SVG payload uploaded as an attachment. Filter bypassed. Rendered inline in the main context. Any chat participant is exposed on click.
XXE — XML External Entity injection and OOB exfiltration
How to abuse misconfigured XML parsers: read server files, internal SSRF, blind XXE via external DTD. Typical endpoints: SAML, SOAP, configuration parser.
CSP Bypass — JSONP, base-uri, AngularJS gadgets, dangling markup
Content-Security-Policy broken with strict-dynamic + JSONP, missing base-uri, AngularJS sandbox escapes, JSON hijacking. How to escalate XSS when the CSP theoretically blocks it.
Mutation XSS — when the HTML changes between sanitizing and rendering
The sanitizer sees A but the browser renders B. SVG namespace tricks, badly-closed comments, MathML, the template element. How to find mXSS against DOMPurify and homemade sanitizers.
Prototype Pollution — from malicious JSON to XSS, RCE and auth bypass
How an attacker pollutes Object.prototype and breaks the code's assumptions. Client-side and server-side vectors, gadgets in lodash/jQuery/Angular.
Reflected XSS on a 429 page via Google Analytics — the tracking snippet as vector
The Google Analytics snippet took part of the URL as unsanitized input. A string-literal breakout inside the script itself: the injection was already in JavaScript context.
SSTI — Server-Side Template Injection in Jinja2, Twig, Velocity and Freemarker
Detection with polyglots, engine identification, escalation to RCE in Jinja2/Python, Twig/PHP, Velocity/Java. Patterns where user input reaches templates.
Explore by topic
179 indexed topics. Each one groups the articles that cover it.
Latest articles
Client-side admin bypass — boolean manipulation + BAC in a modern SPA
Real Quora report: SPA with an isAdmin boolean in localStorage that controls the UI + a backend that doesn't validate server-side. How to chain a boolean flip with BAC for admin takeover.
Cloudflare WAF — payload size bypass, oversized body, plan-specific limits
Bypassing the Cloudflare WAF by exploiting body size limits per plan (Free 100kb, Pro 100kb, Business 500kb, Enterprise 1mb): oversize payload trick + chunked transfer encoding.
Headless browsers — SSRF and RCE in endpoints that render URLs
Endpoints that accept URLs for screenshots/PDF (Puppeteer, Playwright, wkhtmltopdf) are an SSRF goldmine: cloud metadata, file://, gopher://, JS injection with XSS-to-RCE in the chromium sandbox.
HTTP request smuggling — H2→H1 desync, TE.CL, CL.TE and H2.CL in 2026
An updated catalog of HTTP smuggling: classic CL.TE, TE.CL, H2→H1 downgrade desyncs, HTTP/2 SETTINGS frame abuse, chunked extensions and HTTP/2 pseudo-headers.
LLM hacking — prompt injection, jailbreaks, indirect injection and data exfiltration
Vulnerabilities in systems with exposed LLMs: direct prompt injection, indirect injection via external sources (RAG poisoning), system prompt extraction, jailbreaks and data exfiltration.
Next.js attack surface 2026 — middleware bypass, internal SSRF, RSC abuse
Next.js 13-16 specific vulnerabilities: middleware bypass with manipulated headers, SSRF in API routes, RSC (React Server Components) data leak, image optimization SSRF.
01 · Guides
Web vulnerabilities
16 guides · 153+ payloadsPor tipo de vulnerabilidad(10)
Cross-Site Scripting
Inyección de código en el navegador de la víctima
IDOR & Broken Access Control
Acceso a recursos de otros usuarios manipulando identificadores
Authentication Bypass
Bypasses en JWT, 2FA, OTP y mecanismos de login
Server-Side Request Forgery
Hacer que el servidor realice requests a destinos internos
SQL & NoSQL Injection
Inyección de consultas en bases de datos
File Upload Vulnerabilities
Subida de archivos maliciosos para ejecución de código
CORS Misconfiguration
Exfiltración de datos vía orígenes mal configurados
Reconocimiento & Info Disclosure
Descubrimiento de información sensible expuesta
Race Conditions
Explotar condiciones de carrera en operaciones concurrentes
Técnicas Avanzadas
WebSockets, Unicode, LLM hacking, cache deception y más
Por contexto de ataque(6)
OAuth & SSO
Ataques en flujos de autorización delegada y Single Sign-On
Pasarelas de Pago
Vulnerabilidades en flujos de compra, suscripción y transacciones
HTML to PDF
SSRF y LFI vía generadores de PDF server-side
WebSockets
Ataques en comunicaciones bidireccionales en tiempo real
GraphQL APIs
Introspección, batching, inyecciones y DoS en APIs GraphQL
Headless Browsers
Explotar bots, crawlers y screenshots server-side
02 · Reference
Cheatsheets
18 sheets · 407+ payloadsXSS
35 payloads
SSRF
33 payloads
SQLi
29 payloads
IDOR
30 payloads
CSRF
15 payloads
Open Redirect
23 payloads
XXE
17 payloads
Path Traversal
27 payloads
CORS
12 payloads
OAuth
17 payloads
Race Condition
12 payloads
File Upload
25 payloads
GraphQL
17 payloads
WebSockets
15 payloads
SSTI
23 payloads
Command Injection
29 payloads
NoSQL Injection
28 payloads
JWT
20 payloads
Ver índice completo03 · Glossary
Security dictionary
50 terms04 · Get started
Bug bounty programs
6 platformsHackerOne
PrincipianteLa plataforma de bug bounty más grande del mundo. Programas de empresas como Google, Microsoft, GitHub, Shopify y muchas más. Ideal para empezar porque tiene programas con scope amplio y comunidad activa.
Bugcrowd
PrincipianteSegunda plataforma más grande. Conocida por su sistema de triage rápido y programas de empresas como Tesla, Mastercard y Netflix. Tiene un sistema de niveles que desbloquea programas privados.
Intigriti
IntermedioPlataforma europea líder en bug bounty. Fuerte presencia en el mercado europeo con programas de empresas como Atos, Proximus y empresas del sector financiero. Conocida por su comunidad y eventos.
YesWeHack
IntermedioPlataforma francesa de bug bounty con fuerte presencia en Europa y Asia. Ofrece programas de empresas como OVH, La Poste y organismos gubernamentales franceses. Tiene su propio programa de formación.
Open Bug Bounty
PrincipiantePlataforma gratuita y abierta de responsible disclosure. No requiere invitación ni registro especial. Ideal para practicar responsible disclosure con sitios web reales sin riesgo legal, ya que solo permite reportar XSS y vulnerabilidades de configuración.
Immunefi
AvanzadoLa plataforma líder de bug bounty para Web3 y blockchain. Bounties extraordinariamente altos (hasta millones de dólares) por vulnerabilidades en smart contracts, bridges y protocolos DeFi. Requiere conocimientos de Solidity y seguridad blockchain.
Ready to practice what you learned?
- hunters training
- 709
- labs from real reports
- 55
- completions
- 1,204
- in bounties practiced
- $213,970
hunters training
labs from real reports
completions
in bounties practiced