Zero Click ATO via Systemic Mass Assignment: The Phantom Hand Most researchers? They’re just scrolling. They see some random JSON field in a proxy log that isn’t in the UI and think, “Whatever …
From medium.com
When a user clicks “Delete Account,” is their data really gone? A deep dive into Excessive Data Exposure, the illusion of “Soft Deletes,”…
From systemweakness.comA deep dive into a Logic Bypass in Starknet Attestation and a lesson in failed responsible disclosure.
From blog.blockmagnates.comHow I discovered a critical Insecure Direct Object Reference vulnerability that allowed unauthorized access to any user profile — and how…
From xalgord.medium.comBased on the insights from “The Best Way to Learn Bug Bounty Hunting” by CyberFlow
From xalgord.medium.comبِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيم
From medium.com
It was found that the password strength policy was only enforced in the browser but not on the server side.
From hackerone.com
