← All posts

Tag

bug bounty

12 posts tagged with bug bounty.

2026-04-21bug bountyweb securityrecon7 min read

The first ten minutes on a new JavaScript bundle

Opening a stranger's bundled JavaScript for the first time. What I grep for, in what order and why. A practical follow-up to why you should not skip JS files at all.

2026-04-20bug bountyCVEWordPress7 min read

Finding CVEs in WordPress: CVE-2025-4392, stored XSS in Shared Files

CVE-2025-4392 was an unauthenticated stored XSS in the Shared Files plugin. A sanitizer that only ran for SVGs and silently passed everything else through. How the gate made the function's name a lie, and a checklist to grep your own plugin source for the same pattern.

2026-04-18bug bountyCVEWordPress7 min read

Finding CVEs in WordPress: CVE-2025-3769, IDOR in LatePoint

A walkthrough of CVE-2025-3769, an IDOR in the LatePoint plugin that exposed customer data from about 100K WordPress sites. How I found it, the code-review pattern behind it and a checklist for auditing WordPress plugins yourself.

2026-03-08bug bountypentestingmindset4 min read

Your scope protects from findings, not from attackers

Attackers don't follow your scope. Limited bug bounty programs protect you from findings while leaving your real attack surface wide open. Here's why wide scopes and recon matter.

2026-02-27bug bountypentestingrecon4 min read

Go wide before you go deep

The best vulnerabilities aren't on the main domain. Here's why wildcard scopes beat limited ones and how going wide leads to the findings that actually matter.

2026-02-26bug bountyweb securityrecon4 min read

Stop skipping JavaScript files

Running automated scans while ignoring JavaScript files means missing the real gold. Here's how reading JS files led to full admin access on a HackerOne target.

2026-02-13pentestingbug bountymindset3 min read

Know your audience: translating technical findings into business impact

Technical expertise matters, but if you want your findings fixed, you need to speak your audience's language. Here's how to translate security issues into business decisions.

2026-01-12bug bountyweb securitySSRF4 min read

DNS rebinding: turning blocked SSRF into internal access

How a well-timed DNS change can bypass SSRF filters and turn a blocked vulnerability into full internal network access.

2025-11-26bug bountypentestingweb security2 min read

The uppercase letter that bypassed authorization

Sometimes a single case change in a URL path is enough to bypass 401/403 errors. Here's why this edge case works and when to test for it.

2025-02-04bug bountyreconRCE4 min read

The RCE hidden behind a forgotten endpoint

A development endpoint that shouldn't exist led to full remote code execution. Here's how thinking about impact turned one finding into a critical chain.

2025-01-14bug bountyweb securitySQLi3 min read

The single quote that leaked database credentials

One character in a URL parameter exposed full database credentials and turned into a $2,000 double critical finding. Here's what happened.

2024-06-28bug bountycareermindset3 min read

What 8 years of bug bounty taught me about burnout

Bug bounty can drain you if you approach it wrong. After 8 years and 1,000+ vulnerabilities, here's what actually matters to avoid burning out.