Real techniques, bypasses and chains
Once you've reported your first bug, it's time to combine techniques. Account takeovers, feature abuse, deep recon. Most of it is public; a few articles require an account.
- Account takeover (OTP brute force, email normalization)
- IDOR in APIs and functionality abuse
- Stored XSS in non-obvious contexts (SVG, attributes)
- Advanced recon and mass enumeration
0-click Account Takeover — OTP brute force + Email Normalization
Two separate flaws look minor. Together, they hand you full ATO knowing only the email. Real bounty: €560 and 12 minutes of exploitation.
All intermediate-level articles
23 articles
0-click Account Takeover — OTP brute force + Email Normalization
Two separate flaws look minor. Together, they hand you full ATO knowing only the email. Real bounty: €560 and 12 minutes of exploitation.
File Upload — extension, content-type and magic bytes bypasses
10 bypasses to upload webshells: double extension, null byte, content-type spoof, magic bytes, polyglots, race conditions and path traversal abuse.
JWT — vulnerabilities, bypasses and claim manipulation
alg=none, RS256→HS256 confusion, kid SQLi/path traversal, jku spoofing, secret cracking with hashcat. How to hunt poorly verified JWTs.
OAuth attacks — state CSRF, redirect_uri bypass, code/token leakage
The missing state parameter, poorly validated redirect_uri, response_type confusion. How to steal OAuth tokens and force account linking.
SQL Injection — complete methodology with time-based, UNION and RCE
Detection via isomorphic queries, time-based payloads for 4 engines, escalation to RCE (xp_cmdshell, INTO OUTFILE, UDFs) and cross-field bypasses.
2FA bypass — TOTP brute force, response manipulation, fallback abuse, race conditions
Real 2FA bypass techniques: TOTP brute force, response manipulation (status 200 with no valid token), fallback to email OTP, race conditions in setup.
Account enumeration via LinkedIn + phone — exposure of millions of users
Real case: API account enumeration combined with LinkedIn scraping + reverse phone lookups to correlate real identities with private accounts. Critical privacy impact.
CSRF advanced exploitation — SameSite bypass, JSON CSRF, Flash, file upload CSRF
Advanced CSRF techniques beyond the classic form submit: SameSite=Lax bypass via GET, JSON CSRF with Content-Type tricks, file upload CSRF and exploitation chains.
IDOR and BAC — manual methodology to find broken access control
How to identify IDOR (Insecure Direct Object Reference) and BAC (Broken Access Control) manually: dual-account testing, parameter swap, role escalation, hidden parameters.
OAuth attacks — state CSRF, redirect_uri bypass, token reuse, token IDOR
Vulnerabilities in OAuth 2.0 flows: missing state parameter, redirect_uri loose validation, cross-app token reuse, IDOR in token refresh endpoints.
Password reset — Puny code, header injection, email normalization, host header
Password reset bypass with Unicode confusables, Host header injection, email normalization (gmail + alias), token leakage in referer, response manipulation.
postMessage — common vulnerabilities: origin bypass, XSS sink, cross-window IDOR
How to identify and exploit vulnerabilities in window.postMessage(): listeners without origin validation, insecure JSON payloads that reach DOM XSS, cross-origin IDOR.
Race conditions in a marketplace — coupons applied N times, negative stock, double checkout
How to identify and exploit race conditions in e-commerce flows: discount coupons applied multiple times, products with 0 stock sold, double checkout for refunds.
Stored XSS €1200 — sanitizer bypass via SVG href javascript: with entity encoding
Walkthrough of a real €1200 report: stored XSS in POE bypassing a sanitizer fix via SVG with href=`javascript:` and HTML entity encoding over the filtered characters.
XSS contexts — payloads per context (HTML, attribute, JS, URL, CSS)
How to identify the exact context where your input is injected and the payloads that escape each one: HTML body, HTML attribute, JS string, JS event, URL, CSS, JSON.
Command Injection — bypasses with spaces, encoding and backticks
Command injection in endpoints that pass input to the shell. Filter bypasses: ${IFS}, $@, ;|&, encoded null bytes, output redirection to a file.
CORS misconfigurations — null origin, wildcard credentials and subdomain trust
When ACAO reflects any Origin with ACAC=true, when null is accepted, when subdomains are wildcarded — cross-site leak of authenticated data.
NoSQL Injection — MongoDB, Firebase and operator bypasses
How to inject into NoSQL queries: $ne/$gt/$regex in MongoDB, auth bypass, blind extraction and differences from classic SQLi.
Open Redirect via Backslash Bypass in the OAuth Login's redirect_url
The client-side validator checks //, : and /. The backslash slips through. Browsers normalize it to a slash and the victim ends up on evil.tld with an active session cookie.
URL shortener as a mass PII leak — extraction of ~300 people/hour
Low-entropy codes + no rate limiting + a ticket with no auth = enumeration of phone numbers, cards (BIN+last 4) and real customers' purchases.
Rate limit bypasses — IP rotation, header spoofing, casing and alternative endpoints
X-Forwarded-For, IP rotation with cloudfront IPs, path casing, encoding tricks, bucket race condition. How to find the gaps in throttling.
Stored XSS via SVG with href javascript: in chat — reclassification of Self-XSS
An SVG payload uploaded as an attachment. Filter bypassed. Rendered inline in the main context. Any chat participant is exposed on click.
XXE — XML External Entity injection and OOB exfiltration
How to abuse misconfigured XML parsers: read server files, internal SSRF, blind XXE via external DTD. Typical endpoints: SAML, SOAP, configuration parser.
Create a free account to save your progress and unlock more articles.
hunters training
labs from real hacks
completions
paid out for these bugs
The checklist I run on every new target
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
The community
This isn't a platform with users.It's people breaking the same things you are.
Inside people ask, share what they found and solve together what would block anyone on their own. It's free to join: no account, no plan, no email required.
Free and open. You don't need a BBLABS account to join.