Real techniques, bypasses and chains
Once you've reported your first bug, it's time to combine techniques. Account takeovers, feature abuse, deep recon. Most of it is public; a few articles require an account.
- Account takeover (OTP brute force, email normalization)
- IDOR in APIs and functionality abuse
- Stored XSS in non-obvious contexts (SVG, attributes)
- Advanced recon and mass enumeration
0-click Account Takeover — OTP brute force + Email Normalization
Two separate flaws look minor. Together, they hand you full ATO knowing only the email. Real bounty: €560 and 12 minutes of exploitation.
All intermediate-level articles
23 articles
0-click Account Takeover — OTP brute force + Email Normalization
Two separate flaws look minor. Together, they hand you full ATO knowing only the email. Real bounty: €560 and 12 minutes of exploitation.
File Upload — extension, content-type and magic bytes bypasses
10 bypasses to upload webshells: double extension, null byte, content-type spoof, magic bytes, polyglots, race conditions and path traversal abuse.
JWT — vulnerabilities, bypasses and claim manipulation
alg=none, RS256→HS256 confusion, kid SQLi/path traversal, jku spoofing, secret cracking with hashcat. How to hunt poorly verified JWTs.
OAuth attacks — state CSRF, redirect_uri bypass, code/token leakage
The missing state parameter, poorly validated redirect_uri, response_type confusion. How to steal OAuth tokens and force account linking.
SQL Injection — complete methodology with time-based, UNION and RCE
Detection via isomorphic queries, time-based payloads for 4 engines, escalation to RCE (xp_cmdshell, INTO OUTFILE, UDFs) and cross-field bypasses.
2FA bypass — TOTP brute force, response manipulation, fallback abuse, race conditions
Real 2FA bypass techniques: TOTP brute force, response manipulation (status 200 with no valid token), fallback to email OTP, race conditions in setup.
Account enumeration via LinkedIn + phone — exposure of millions of users
Real case: API account enumeration combined with LinkedIn scraping + reverse phone lookups to correlate real identities with private accounts. Critical privacy impact.
CSRF advanced exploitation — SameSite bypass, JSON CSRF, Flash, file upload CSRF
Advanced CSRF techniques beyond the classic form submit: SameSite=Lax bypass via GET, JSON CSRF with Content-Type tricks, file upload CSRF and exploitation chains.
IDOR and BAC — manual methodology to find broken access control
How to identify IDOR (Insecure Direct Object Reference) and BAC (Broken Access Control) manually: dual-account testing, parameter swap, role escalation, hidden parameters.
OAuth attacks — state CSRF, redirect_uri bypass, token reuse, token IDOR
Vulnerabilities in OAuth 2.0 flows: missing state parameter, redirect_uri loose validation, cross-app token reuse, IDOR in token refresh endpoints.
Password reset — Puny code, header injection, email normalization, host header
Password reset bypass with Unicode confusables, Host header injection, email normalization (gmail + alias), token leakage in referer, response manipulation.
postMessage — common vulnerabilities: origin bypass, XSS sink, cross-window IDOR
How to identify and exploit vulnerabilities in window.postMessage(): listeners without origin validation, insecure JSON payloads that reach DOM XSS, cross-origin IDOR.
Race conditions in a marketplace — coupons applied N times, negative stock, double checkout
How to identify and exploit race conditions in e-commerce flows: discount coupons applied multiple times, products with 0 stock sold, double checkout for refunds.
Stored XSS €1200 — sanitizer bypass via SVG href javascript: with entity encoding
Walkthrough of a real €1200 report: stored XSS in POE bypassing a sanitizer fix via SVG with href=`javascript:` and HTML entity encoding over the filtered characters.
XSS contexts — payloads per context (HTML, attribute, JS, URL, CSS)
How to identify the exact context where your input is injected and the payloads that escape each one: HTML body, HTML attribute, JS string, JS event, URL, CSS, JSON.
Command Injection — bypasses with spaces, encoding and backticks
Command injection in endpoints that pass input to the shell. Filter bypasses: ${IFS}, $@, ;|&, encoded null bytes, output redirection to a file.
CORS misconfigurations — null origin, wildcard credentials and subdomain trust
When ACAO reflects any Origin with ACAC=true, when null is accepted, when subdomains are wildcarded — cross-site leak of authenticated data.
NoSQL Injection — MongoDB, Firebase and operator bypasses
How to inject into NoSQL queries: $ne/$gt/$regex in MongoDB, auth bypass, blind extraction and differences from classic SQLi.
Open Redirect via Backslash Bypass in the OAuth Login's redirect_url
The client-side validator checks //, : and /. The backslash slips through. Browsers normalize it to a slash and the victim ends up on evil.tld with an active session cookie.
URL shortener as a mass PII leak — extraction of ~300 people/hour
Low-entropy codes + no rate limiting + a ticket with no auth = enumeration of phone numbers, cards (BIN+last 4) and real customers' purchases.
Rate limit bypasses — IP rotation, header spoofing, casing and alternative endpoints
X-Forwarded-For, IP rotation with cloudfront IPs, path casing, encoding tricks, bucket race condition. How to find the gaps in throttling.
Stored XSS via SVG with href javascript: in chat — reclassification of Self-XSS
An SVG payload uploaded as an attachment. Filter bypassed. Rendered inline in the main context. Any chat participant is exposed on click.
XXE — XML External Entity injection and OOB exfiltration
How to abuse misconfigured XML parsers: read server files, internal SSRF, blind XXE via external DTD. Typical endpoints: SAML, SOAP, configuration parser.
Create a free account to save your progress and unlock more articles.
- hunters training
- 711
- labs from real reports
- 55
- completions
- 1,205
- in bounties practiced
- $213,970
hunters training
labs from real reports
completions
in bounties practiced