STOP DOING BEG-BOUNTIES - STOP COPYING ANOTHERS POC ! DO SOMETHING DIFFERENT!🔴🔴🔴🔴✔

Want to support my work?

DONT TRY HACKING WITHOUT BASICS --- IT WILL BE DANGEROUS FOR YOU AND YOUR FUTURE!

## Contents

• Cross Site Scripting (XSS)
• Cross Site Request Forgery (CSRF)
• Clickjacking (UI Redressing Attack)
• Local File Inclusion (LFI)
• Subdomain Takeover
• Denial of Service (DOS)
• Authentication Bypass
• SQL injection
• Insecure Direct Object Reference (IDOR)
• 2FA Related issues
• CORS Related issues
• Server Side Request Forgery (SSRF)
• Race Condition
• Remote Code Execution (RCE)
• Android Pentesting
• Contributing
• Maintainers

Cross Site Scripting (XSS)

• From P5 to P2 to 100 BXSS
• Google Acquisition XSS (Apigee)
• DOM-Based XSS at accounts.google.com by Google Voice Extension
• XSS on Microsoft.com via Angular Js template injection
• Researching Polymorphic Images for XSS on Google Scholar
• Netflix Party Simple XSS
• Stored XSS in google nest
• Self XSS to persistent XSS on login portal
• Universal XSS affecting Firefox
• XSS WAF Character limitation bypass like a boss
• Self XSS to Account Takeover
• Reflected XSS on Microsoft subdomains
• The tricky XSS
• Reflected XSS in AT&T
• XSS on Google using Acunetix
• Exploiting websocket application wide XSS
• Reflected XSS with HTTP Smuggling

Cross Site Request Forgery (CSRF)

• How a simple CSRF attack turned into a P1
• How I exploited the json csrf with method override technique
• How I found CSRF(my first bounty)
• Exploiting websocket application wide XSS and CSRF
• Site wide CSRF on popular program
• Using CSRF I got weird account takeover
• CSRF CSRF CSRF
• Google Bugbounty CSRF in learndigital.withgoogle.com
• CSRF token bypass [a tale of 2k bug]
• 2FA bypass via CSRF attack
• Stored iframe injection CSRF account takeover
• Instagram delete media CSRF
• An inconsistent CSRF
• Bypass CSRF with clickjacking worth 1250
• Sitewide CSRF graphql
• Account takeover using CSRF json based
• CORS to CSRF attack

Clickjacking (UI redressing attack)

• Google Bug bounty Clickjacking on Google payment
• Google APIs Clickjacking worth 1337$
• Clickjacking + XSS on Google org
• Bypass CSRF with clickjacking on Google org
• 1800 worth Clickjacking
• Account takeover with clickjacking
• Clickjacking on google CSE
• How I accidentally found clickjacking in Facebook
• Clickjacking on google myaccount worth 7500
• Clickjacking in google docs and void typing feature
• Reflected DOM XSS and Clickjacking
• binary.com clickjacking vulnerability exploiting HTML5 security features
• 12000 intersection betwen clickjacking XSS and denial of service
• Steam fire and paste : a story of uxss via DOM XSS and Clickjacking in steam inventory helper
• Yet another Google Clickjacking
• Redressing instagram leaking application tokens via instagram clickjacking vulnerability

Local File Inclusion (LFI)

• RFI LFI Writeup
• My first LFI
• Bug bounty LFI at Google.com
• Google LFI on production servers in redacted.google.com
• LFI to 10 server pwn
• LFI in apigee portals
• Chain the bugs to pwn an organisation LFI unrestricted file upload to RCE
• How we got LFI in apache drill recom like a boss
• Bugbounty journey from LFI to RCE
• LFI to RCE on deutche telekom bugbounty
• From LFI to RCE via PHP sessions
• magix bugbounty magix.com XSS RCE SQLI and LFI
• LFI in nokia maps

Subdomain Takeover

• How I bought my way to subdomain takeover on tokopedia
• Subdomain Takeover via pantheon
• Subdomain takeover : a unique way
• Escalating subdomain takeover to steal sensitive stuff
• Subdomain takeover awarded 200
• Subdomain takeover via wufoo service
• Subdomain takeover via Hubspot
• Souq.com subdomain takeover
• Subdomain takeover : new level
• Subdomain takeover due to misconfigured project settings for custom domain
• Subdomain takeover via shopify vendor
• Subdomain takeover via unsecured s3 bucket
• Subdomain takeover worth 200
• Subdomain takeover via campaignmonitor
• How to do 55000 subdomain takeover in a blink of an eye
• Subdomain takeover Starbucks (Part 2)
• Subdomain takeover Starbucks

Denial of Service (DOS)

• Long String DOS
• AIRDOS
• Denial of Service DOS vulnerability in script loader (CVE-2018-6389)
• Github actions DOS
• Application level denial of service
• Banner grabbing to DOS and memory corruption
• DOS across Facebook endpoints
• DOS on WAF protected sites
• DOS on Facebook android app using zero width no break characters
• Whatsapp DOS vulnerability on android and iOS
• Whatsapp DOS vulnerability in iOS android

Authentication Bypass

• Touch ID authentication Bypass on evernote and dropbox iOS apps
• Oauth authentication bypass on airbnb acquistion using wierd 1 char open redirect
• Two factor authentication bypass
• Instagram multi factor authentication bypass
• Authentication bypass in nodejs application
• Symantec authentication Bypass
• Authentication bypass in CISCO meraki
• Slack SAML authentocation bypass
• Authentication bypass on UBER's SSO
• Authentication Bypass on airbnb via oauth tokens theft
• Inspect element leads to stripe account lockout authentication Bypass
• Authentication bypass on SSO ubnt.com

SQL Injection(SQLI)

• Tricky oracle SQLI situation
• Exploiting “Google BigQuery” SQLI
• SQLI via stopping the redirection to a login page
• Finding SQLI with white box analysis a recent bug example
• Bypassing a crappy WAF to exploit a blind SQLI
• SQL Injection in private-site.com/login.php
• Exploiting tricky blind SQLI
• SQLI in forget password fucntion
• SQLI Bug Bounty
• File Upload blind SQLI
• SQL Injection
• SQLI through User Agent
• SQLI in insert update query without comma
• SQLI for 50 bounty
• Abusing MYSQL CLients
• SQLI Authentication Bypass AutoTrader Webmail
• ZOL Zimbabwe Authentication Bypass to XSS & SQLi

Insecure Direct Object Reference (IDOR)

• Disclose Private Dashboard Chart's name and data in Facebook Analytics
• Disclosing privately shared gaming clips of any user
• Adding anyone including non-friend and blocked people as co-host in personal event!
• Page analyst could view job application details
• Deleting Anyone's Video Poll

2FA related issues

• 2FA Bypass via logical rate limiting Bypass
• Bypass 2FA in a website
• Weird and simple 2FA bypass
• How I cracked 2FA with simple factor bruteforce
• Instagram account is reactivated without entering 2FA
• How to bypass 2FA with a HTTP header
• How I hacked 40k user accounts of microsoft using 2FA bypass outlook
• How I abused 2FA to maintain persistence after password recovery change google microsoft instragram
• Bypass hackerone 2FA
• Facebook Bug bounty : How I was able to enumerate instagram accounts who had enabled 2FA

CORS related issues

• CORS bug on google's 404 page (rewarded)
• CORS misconfiguration leading to private information disclosure
• CORS misconfiguration account takeover out of scope to grab items in scope
• Chrome CORS
• Bypassing CORS
• CORS to CSRF attack
• An unexploited CORS misconfiguration reflecting further issues
• Think outside the scope advanced cors exploitation techniques
• A simple CORS misconfiguration leaked private post of twitter facebook instagram
• Explpoiting CORS misconfiguration
• Full account takeover through CORS with connection sockets
• Exploiting insecure CORS API api.artsy.net
• Pre domain wildcard CORS exploitation
• Exploiting misconfigured CORS on popular BTC site
• Abusing CORS for an XSS on flickr

Server Side Request Forgery (SSRF)

• Exploiting an SSRF trials and tribulations
• SSRF on PDF generator
• Google VRP SSRF in Google cloud platform stackdriver
• Vimeo upload function SSRF
• SSRF via ffmeg processing
• My first SSRF using DNS rebinding
• Bugbounty simple SSRF
• SSRF reading local files from downnotifier server
• SSRF vulnerability
• Gain adfly SMTP access with SSRF via gopher protocol
• Blind SSRF in stripe.com due to senntry misconfiguration
• SSRF port issue hidden approch
• The jorney of web cache firewall bypass to SSRF to AWS credentials compromise
• SSRF to local file read and abusing aws metadata
• pdfreactor SSRF to root level local files read which lead to RCE
• SSRF trick : SSRF XSPA in micosoft's bing webwaster

Race Condition

• Exploiting a Race condition vulnerabililty
• Race condition that could result to RCE a story with an app
• Creating thinking is our everything : Race condition and business logic
• Chaining improper authorization to Race condition to harvest credit card details
• A Race condition bug in Facebook chat groups
• Race condition bypassing team limit
• Race condition on web
• Race condition bugs on Facebook
• Hacking Banks With Race Conditions
• Race Condition Bug In Web App: A Use Case
• RACE Condition vulnerability found in bug-bounty program
• How to check Race Conditions in Web Applications

Remote Code Execution (RCE)

• Microsoft RCE bugbounty
• OTP bruteforce account takeover
• Attacking helpdesk RCE chain on deskpro with bitdefender
• Remote image upload leads to RCE inject malicious code
• Finding a p1 in one minute with shodan.io RCE
• From recon to optimizing RCE results simple story with one of the biggest ICT company
• Uploading backdoor for fun and profit RCE DB creds P1
• Responsible Disclosure breaking out of a sandboxed editor to perform RCE
• Wordpress design flaw leads to woocommerce RCE
• Path traversal while uploading results in RCE
• RCE jenkins instance
• Traversing the path to RCE
• How I chained 4 bugs features into RCE on amazon
• RCE due to showexceptions
• Yahoo luminate RCE
• Latex to RCE private bug bounty program

Buffer Overflow Writeups

• Buffer Overflow Attack Book pdf
• Github Repository on Buffer Overflow Attack
• Stack-Based Buffer Overflow Attacks: Explained and Examples
• How Buffer Overflow Attacks Work
• Binary Exploitation: Buffer Overflows
• WHAT IS A BUFFER OVERFLOW? LEARN ABOUT BUFFER OVERRUN VULNERABILITIES, EXPLOITS & ATTACKS

Android Pentesting

• Android Pentesting Lab (Step by Step guide for beginners!)

Contributing

• Open Pull Requests
• Send me links of writeups to My Twitter : alexbieber12341

Maintainers

This Repo is maintained by :

• alexbieber

Warning!

Any actions and or activities related to Bug_Bounty_writeups is your responsibility. The misuse of this toolkit can result in criminal charges brought against the persons in question. The contributors will not be held responsible in the event any criminal charges be brought against any individuals misusing this toolkit to break the law.

YOU CAN BUY ME A COFFEE-->

LOVE YOU 3000!🔴

AWW YOU CAME SOO FAR -- WELCOME DUDE!

:: YOU CAME SOO FAR - WELCOME ::

Find Me on :

# Donate your money and it will inspire soo many people to live their life.