• AVideo 1
• AWS 1
• Bug bounty 1
• CSRF 2
• Challenge 3
• Cloudflare 1
• IBM 1
• LFI 1
• Medium 1
• Moodle 1
• OAuth 1
• Oculus 1
• PHP 1
• Privilege Escalation 1
• RCE 2
• S3 1
• SOP 1
• ServiceWorker 1
• Sql injection 1
• Twitter 1
• WordPress 1
• XSS 8
• Yahoo 1
• auth 1
• bug bounty 7
• bugbounty 2
• bypass 3
• csrf 1
• eBay 1
• flash 1
• getimagesize() 1
• iframe 2
• leaking 1
• same origin policy 2
• security 2
• takeover 1
• tokens 2
• x-frame-option 2

AVideo

• AVideo < 8.9 Privilege Escalation and File Inclusion that led to RCE

AWS

• Careem AWS S3 Bucket Takeover

Bug bounty

• Take Advantage of Out-of-Scope Domains in Bug Bounty Programs

CSRF

• Obtaining WordPress CSRF Tokens for Fun, $1337 bounty, and CVE-2017-5489
• Flickr XSRF to Change Photo Details

Challenge

• Intigriti Easter XSS Challenge Write-up
• myClock XSS Challenge Solution Write-Up
• Hack.me XSS Challenge | Solution

Cloudflare

• Cloudflare WAF XSS

IBM

• How I Hacked Oculus, eBay, and IBM OAuth

LFI

• AVideo < 8.9 Privilege Escalation and File Inclusion that led to RCE

Medium

• Medium 1-Click Full Account Takeover

Moodle

• Moodle DOM Stored XSS to RCE

OAuth

• How I Hacked Oculus, eBay, and IBM OAuth

Oculus

• How I Hacked Oculus, eBay, and IBM OAuth

PHP

• Obtaining WordPress CSRF Tokens for Fun, $1337 bounty, and CVE-2017-5489

Privilege Escalation

• AVideo < 8.9 Privilege Escalation and File Inclusion that led to RCE

RCE

• AVideo < 8.9 Privilege Escalation and File Inclusion that led to RCE
• Moodle DOM Stored XSS to RCE

S3

• Careem AWS S3 Bucket Takeover

SOP

• myClock XSS Challenge Solution Write-Up

ServiceWorker

• Leaking Amazon.com CSRF Tokens Using Service Worker API

Sql injection

• Blind SQL Injection in Hootsuite Learning Platform

Twitter

• Vine Re-auth Bypass [Twitter Bug Bounty]

WordPress

• Obtaining WordPress CSRF Tokens for Fun, $1337 bounty, and CVE-2017-5489

XSS

• Moodle DOM Stored XSS to RCE
• Intigriti Easter XSS Challenge Write-up
• myClock XSS Challenge Solution Write-Up
• Take Advantage of Out-of-Scope Domains in Bug Bounty Programs
• Hack.me XSS Challenge | Solution
• Medium 1-Click Full Account Takeover
• Cloudflare WAF XSS
• One Payload to XSS Them All!

Yahoo

• Flickr XSRF to Change Photo Details

auth

• Vine Re-auth Bypass [Twitter Bug Bounty]

bug bounty

• Vine Re-auth Bypass [Twitter Bug Bounty]
• Medium 1-Click Full Account Takeover
• How I Hacked Oculus, eBay, and IBM OAuth
• Cloudflare WAF XSS
• One Payload to XSS Them All!
• Blind SQL Injection in Hootsuite Learning Platform
• Flickr XSRF to Change Photo Details

bugbounty

• Leaking Amazon.com CSRF Tokens Using Service Worker API
• Hijack Vimeo Private Videos using Flash

bypass

• myClock XSS Challenge Solution Write-Up
• Take Advantage of Out-of-Scope Domains in Bug Bounty Programs
• Obtaining WordPress CSRF Tokens for Fun, $1337 bounty, and CVE-2017-5489

csrf

• Leaking Amazon.com CSRF Tokens Using Service Worker API

eBay

• How I Hacked Oculus, eBay, and IBM OAuth

flash

• Hijack Vimeo Private Videos using Flash

getimagesize()

• Obtaining WordPress CSRF Tokens for Fun, $1337 bounty, and CVE-2017-5489

iframe

• myClock XSS Challenge Solution Write-Up
• Take Advantage of Out-of-Scope Domains in Bug Bounty Programs

leaking

• Obtaining WordPress CSRF Tokens for Fun, $1337 bounty, and CVE-2017-5489

same origin policy

• myClock XSS Challenge Solution Write-Up
• Take Advantage of Out-of-Scope Domains in Bug Bounty Programs

security

• myClock XSS Challenge Solution Write-Up
• Take Advantage of Out-of-Scope Domains in Bug Bounty Programs

takeover

• Careem AWS S3 Bucket Takeover

tokens

• Obtaining WordPress CSRF Tokens for Fun, $1337 bounty, and CVE-2017-5489
• Leaking Amazon.com CSRF Tokens Using Service Worker API

x-frame-option

• myClock XSS Challenge Solution Write-Up
• Take Advantage of Out-of-Scope Domains in Bug Bounty Programs