Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature
4,272
196 commits
updated Jul 31, 2024
A list of bug bounty write-up that is categorized by the bug nature, this is inspired by https://github.com/djadmin/awesome-bug-bounty
I have been reading for Bug Bounty write-ups for a few months, I found it extremely useful to read relevant write-up when I found a certain type of vulnerability that I have no idea how to exploit. Let say you found a RPO (Relativce Path Overwrite) in a website, but you have no idea how should you exploit that, then the perfect place to go would be here. Or you have found your customer is using oauth mechanism but you have no idea how should we test it, the other perfect place to go would be here
My intention is to make a full and complete list of common vulnerability that are publicly disclosed bug bounty write-up, and let Bug Bounty Hunter to use this page as a reference when they want to gain some insight for a particular kind of vulnerability during Bug Hunting, feel free to submit pull request. Okay, enough for chit-chatting, let's get started.
Facebook Access Token Stolen by Jack Whitton -
Obtaining Login Tokens for an Outlook, Office or Azure Account by Jack Whitton
Bypassing Digits web authentication's host validation with HPP by filedescriptor
Bypass of redirect_uri validation with /../ in GitHub by Egor Homakov
Bypassing callback_url validation on Digits by filedescriptor
Stealing livechat token and using it to chat as the user - user information disclosure by Mahmoud G. (zombiehelp54)
Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical) by mongo (mongo)
Internet Explorer has a URL problem, on GitHub by filedescriptor.
How I made LastPass give me all your passwords by labsdetectify
Bypass redirect_uri by nbsriharsha
240 followers · starred Oct 2016
216 followers · starred Jan 2019
1,162 followers · starred Nov 2019
75 followers · starred Sep 2023
Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature
4,272
196 commits
updated Jul 31, 2024
A list of bug bounty write-up that is categorized by the bug nature, this is inspired by https://github.com/djadmin/awesome-bug-bounty
I have been reading for Bug Bounty write-ups for a few months, I found it extremely useful to read relevant write-up when I found a certain type of vulnerability that I have no idea how to exploit. Let say you found a RPO (Relativce Path Overwrite) in a website, but you have no idea how should you exploit that, then the perfect place to go would be here. Or you have found your customer is using oauth mechanism but you have no idea how should we test it, the other perfect place to go would be here
My intention is to make a full and complete list of common vulnerability that are publicly disclosed bug bounty write-up, and let Bug Bounty Hunter to use this page as a reference when they want to gain some insight for a particular kind of vulnerability during Bug Hunting, feel free to submit pull request. Okay, enough for chit-chatting, let's get started.
Facebook Access Token Stolen by Jack Whitton -
Obtaining Login Tokens for an Outlook, Office or Azure Account by Jack Whitton
Bypassing Digits web authentication's host validation with HPP by filedescriptor
Bypass of redirect_uri validation with /../ in GitHub by Egor Homakov
Bypassing callback_url validation on Digits by filedescriptor
Stealing livechat token and using it to chat as the user - user information disclosure by Mahmoud G. (zombiehelp54)
Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical) by mongo (mongo)
Internet Explorer has a URL problem, on GitHub by filedescriptor.
How I made LastPass give me all your passwords by labsdetectify
Bypass redirect_uri by nbsriharsha
240 followers · starred Oct 2016
216 followers · starred Jan 2019
1,162 followers · starred Nov 2019
75 followers · starred Sep 2023
