Today I‘ll share with you a interesting XSS in Yahoo. My favorite target is Yahoo, because they have a big scope, so let’s start.

Offensive website security Bug bounty Ethical hacking

JavaScript has become one of the most ubiquitous technologies in the modern web browsers. Applications built using client-side JavaScript…

This actually worked on the first site we tested! 🤯 P.S.: Legacy or unimplemented OAuth flows often contain vulnerabilities that can lead to account takeover. 😈 Thanks for the #BugBountyTip, @ngalongc!

I got invite for private program on bugcrowd. Program do not have huge scope , just a single app with lots of features to test. I usually…

Google’s Gmail email service is used by upwards of 1.5 billion people. The Google Calendar app, meanwhile, has been downloaded more than a…

And maximize their impact while hunting for bugs.

This blogpost is about a recently disclosed security issue with the LastPass browser extension discovered by Tavis Ormandy from the Google…

This repository will serve as the "master" repo containing all trainings and tutorials done in preperation for OSWE in conjunction with the AWAE course. This repo will likely cont...

It all started in month of August when I reached out to Gerben Javado regarding a question, yes it was a basic question but a quick chat…

When doing penetrating on this target, I collaborated with YoKo Kho to get the highest privileges. In this paper you may find a little…

No spam, illegal acitivities, advertising without admin's approval, harrassing members or full disclosure of vulnerability (partial disclosure is fine)

Bug Hunting Resources
@bug_hunting

Happy hunting! 🥰

This Lab contain the sample codes which are vulnerable to Server-Side Request Forgery attack - incredibleindishell/SSRF_Vulnerable_Lab

Yesterday, a new version of DOMPurify (very popular XSS sanitization library) was released, that fixed a bypass reported by us. In this post I’ll show how exactly the bypass looked like preceded by general information about DOMPurify and how it works. If…

We've added a brand new topic on testing for #WebSockets vulnerabilities, including three new labs. https://t.co/kZhy25Qho1

In this section, we'll explain how to manipulate WebSocket messages and connections, describe the kinds of security vulnerabilities that can arise with ...