#bug bounty
6 discoveries · Hand-picked discoveries from the open web, newest first.
-
Taimi: Finding Everyone's Private Photos Was Easy, But So Was Getting Paid
How I found critical IDOR vulnerabilities in Taimi that exposed "expiring" videos, private photos through a bizarre location feature, and allowed fake system messages - and how they actually handled it right with a $10k bounty.
bobdahacker blog · EN
-
Bandsintown: How I Almost Rickrolled 191k People
How I found a verification bypass in Bandsintown that let anyone claim unclaimed artist pages with a single API call - including Rick Astley's 191k followers, their emails, and the ability to send push notifications as any artist.
bobdahacker blog · EN
-
Petlibro: Your Pet Feeder Is Feeding Data To Anyone Who Asks
How I found critical vulnerabilities in Petlibro smart pet feeders allowing complete account takeover via broken OAuth, access to anyone's pet data, device hijacking, and private audio recordings - and how they're still leaving the auth bypass active for 'legacy compatibility' two months later.
bobdahacker blog · EN
-
subfinder – Passive Subdomain Enumeration Tool
subfinder 2.17.0 tested on darknet.org.uk with no API keys: 17 subdomains in 14 seconds, and only one resolved in DNS. What needs keys, and how to install it.
Darknet – Hacking Tools, Hacker News & Cyber Security · EN
-
Introducing the Cloudflare PHP Capture the Flag challenge
We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer.
Cloudflare Blog · EN
-
How bug bounty sharpens one researcher’s security skills
As Cybersecurity Awareness Month continues, the GitHub Bug Bounty team spotlights @r31n, diving into their research approach, favorite bug classes, and advice for aspiring hackers. The post How bug bounty sharpens one researcher’s security skills appeared first on The GitHub Blog .
GitHub Blog · EN