active · since May 2026

HunterTop 10XSS

@benjaminnocervigni

Labs solved

Flags captured

Ranking

$12,350

Total bounty

Monthly streak

3 consecutive months · 0/2 this month — 2 left to keep it

year 2026

jan

feb

mar

apr

may

jun

jul

aug

sep

oct

nov

dec

achieved (≥2)

pending

no streak

2 labs with a flag per month to keep it

achievements_unlocked

Achievements · 17/31

progress

55%

PLATINO

Bounty Hunter

$11.3K € en bounties acumulados

PLATA

Top Ranking

Currently top 6

PLATA

Cazador de Labs

19 labs resueltos

PLATA

Insane Slayer

4 labs Insane

PLATA

Constancia Mensual

3 meses consecutivos

published_writeups

Writeups · 1

pdf

Reflected XSS en contexto de string JS + exfiltración vía bot revisorHard$300

239.7 KB · 7 days ago

Download

Vulnerabilities mastered

top 10 categories

XSS

Business Logic

IDOR

BAC

Race Condition

SSRF

API Abuse

Auth Bypass

CSRF

Path Traversal

Activity

last 90 days

less

// track_record

Labs solved

26 labs

Hard$4,450

Business Logic Error - Payment Bypass via Client-Side Trust Abuse

Business Logic

May 2026flag

Insane$1,500

Wizard Takeover ATO ( IDOR + CSRF )

CSRFIDORBAC

Jul 2026flag

Insane$1,200

Stored XSS to Domain Takeover

XSS

May 2026flag

Hard$1,100

Web Cache Poisoning → XSS con bypass de WAF → ATO one-click del asesor

XSS

6 days agoflag

Medium$1,000

Payment Bypass via Business Logic Flaw

Business Logic

Jun 2026completed

Insane$700

SQL Injection en identificador de tabla → RCE por PostgreSQL `COPY … FROM PROGRAM`

SQLiRCE

25 days agoflag

Insane$600

0-click-ATO — Account Takeover via OTP Brute Force + Email Case-Sensitivity Bypass

API Abuse

Jun 2026flag

Hard$500

Reflected XSS via `auth_url` + admin DM bot + cookie exfil

XSS

Jun 2026flag

Hard$500

IDOR via Predictable Checkout IDs

Business LogicIDOR

May 2026flag

Hard$300

Reflected XSS en contexto de string JS + exfiltración vía bot revisor

XSS

7 days agoflag