XL
active · since July 2026
HunterBAC
@xl4n
10
Labs solved
0
Flags captured
—
Ranking
$7,350
Total bounty
Monthly streak
0 consecutive months · 0/2 this month — 2 left to keep it
year 2026
jan
feb
mar
apr
may
jun
jul
aug
sep
oct
nov
dec
achieved (≥2)
pending
no streak
2 labs with a flag per month to keep it
achievements_unlocked
Achievements · 0/31
progress
0%
No achievements yet
// this hunter hasn't unlocked any achievement yet
published_writeups
Writeups · 0
No writeups yet
// @xl4n hasn't published writeups yet
Vulnerabilities mastered
top 10 categories
BAC
4
Auth Bypass
3
Open Redirect
2
XSS
2
IDOR
1
Business Logic
1
API Abuse
1
CSRF
1
Path Traversal
1
Activity
last 90 days
less
more
// track_record
Labs solved
10 labs
Hard$4,450
Business Logic Error - Payment Bypass via Client-Side Trust Abuse
Business Logic
25 days agocompleted
Insane$1,500
Wizard Takeover ATO ( IDOR + CSRF )
CSRFIDORBAC
25 days agocompleted
Insane$600
DOM XSS via postMessage → eval (cross-origin admin pwn)
XSS
25 days agocompleted
Hard$500
Reflected XSS via `auth_url` + admin DM bot + cookie exfil
XSS
26 days agocompleted
Hard$300
Open Redirect via Backslash Bypass + Header Drag
Open Redirect
25 days agocompleted
EasyVDP
Open Redirect Playground
Open Redirect
25 days agocompleted
MediumVDP
NASA - Rails Approval Bypass via Mass Assignment
Auth BypassAPI AbuseBAC
25 days agocompleted
HardVDP
Web Cache Deception & BAC in /uploads
Auth BypassBAC
25 days agocompleted
HardVDP
NASA - Client-Side Auth Bypass via Match & Replace
Auth BypassBAC
25 days agocompleted
InsaneVDP
Playground de Client-Side Path Traversal
Path Traversal
25 days agocompleted