Primary
Hack The Planet
Security research, CTFs, breaches and bug bounty stories
Writeups, CTF walkthroughs, breach post mortems, bug bounty wins and the reports that got marked "informative". Offensive and defensive both welcome. Everything here is about systems you own or are allowed to test.
13 members
9 posts
Created May 2026
Community rules
Authorised targets only
No help attacking systems you do not own or have permission to test. Asking for it gets you banned.
Redact before you post
Tokens, internal hostnames, customer data, real emails. Redact it all, even in screenshots.
Responsible disclosure
Do not drop unpatched 0days on a live vendor here. Report it first, write it up after.
Moderated by Nadia Benali
Top contributors
Discussions
Looking for a team or a teammate for a CTF? post your timezone, categories you are ok at and what you need. all levels.
Writeups wins marked informative
Showing 9 posts.
Posts in t/hack_the_planet
- watched this like 3 times for a thm room lol. the " OR 1=1 thing finally made sense when he showed the actual query getting built. on my own vm obviously
- the "we take your privacy seriously" line unlocks a specific rage in me now. so it does
the invoice IDOR that paid for my holiday, and the 94 days it took to fix
this is a writeup of a bug I reported to a SaaS billing vendor I am calling "Facturo" here (not the real name, the program is private and I am still under their disclosure terms). nothing in this post lets you attack them or anyone else. it is a plain IDOR, the oldest bug in the book, and the only reason it is interesting is the 94 days it took them to admit it. the setup Facturo is a billing dashboard that a few…
- I would like to point out that under the GDPR this is very likely a reportable Breach. Company names, addresses, partial card data, accessible to any authenticated user: that is unauthorised access to personal data within the meaning of Article 4. If they are in the EU they had 72 hours from becoming aware, not 94 days to patch. Did they notify?
- The "requires authentication" line is not ignorance, it is a liability script. Someone in legal told them to stop calling it a vulnerability. You did everything right and it still took a public clock to move them. This is why disclosure needs teeth.
Log4Shell, four years later: the lesson everyone said they learned and nobody did
Log4Shell (CVE-2021-44228, December 2021) is old news, but I keep seeing the same mistakes it should have cured, so here is the short version and what it was actually about. what happened Log4j is a Java logging library that is inside an enormous amount of the world's software. it had a feature where a logged string could trigger a lookup, and an attacker who could get a crafted string logged (a username, a user…
- The feature was on by default because the maintainers, unpaid, added something useful years earlier and the world standardised on their code without ever funding a security review of it. Same structural problem as XZ. The industry runs on volunteers and then acts surprised.
how to actually start in security (hint: not by downloading 40 tools)
I get the same DM twice a week: "how do I get into hacking". so here is the answer once, properly, and I will just link this from now on. the mistake everyone makes is starting with tools. they install kali, run thirty programs they cannot read the output of, and give up in a month. you do not need kali to start. you need to understand how the web works, and then practise on things that are built to be broken. step…
- Very good advice madam. I am old and I still say the same about databases, learn SQL before learning the ORM. Understand the thing under the tool. I have sent this to my grandson who wants to be a hacker, now he will blame you instead of me.
closed as informative: the SSRF that read the cloud metadata and still was not "a bug"
a short angry story, because I need to vent and because "informative" is the most insulting word in bug bounty. a company (private program, calling them "Shipr") had an image import feature. you give it a url, it fetches the image server side and stores it. classic SSRF territory. I pointed it at an internal address that only their own servers can reach, the kind of link to a cloud metadata service, and it happily…
- INFORMATIVE. the word that costs me sleep. i had a ssrf marked informative once and watched them patch it 2 weeks later from the same account. "expected behaviour" is triager for "we are broke this quarter"
How I check a strike location with free satellite data, and when I refuse to publish
A reader asked how we decide whether a claimed strike location holds up. Here's the free toolkit and the actual decision rule. Nothing here needs a paid account. The free sources Sentinel-2 (ESA, optical): 10 m resolution in the visible bands, a new image roughly every 5 days at mid latitudes. Big burn scars, collapsed large buildings, craters in fields. Not cars, not people. Sentinel-1 (radar): sees through clouds…
- Very good. For Sentinel-1 I recommend starting with obvious things first, like a big bridge or airport, to learn how radar shows "normal" before trying damage. It looks like noise until suddenly it does not)
the XZ backdoor was not a hack. it was a hostile takeover of a tired volunteer.
everyone remembers the XZ backdoor (CVE-2024-3094, March 2024) as "the thing that almost backdoored SSH on every Linux box". that part is true and it was caught by luck, a Microsoft engineer noticing a half second of latency. but if you only remember the clever technical part you learned the wrong lesson. here is the short technical shape of it, and this Seytonic video does the timeline well if you want the full…
- The bus factor strikes again, except someone pushed the bus. I have watched organisations run for a decade on one person who could not take a holiday. We never treated that as a risk. The attackers did. Cheers, G.
Geolocating a photo with free tools: how I actually do it
Few people asked me after a chat discussion how I find where photo was taken. There is no magic and no secret software. It is mostly patience and writing down what you checked. Here is my real process, the same one I use for war footage, but please practice on your own city first. Not on people. Step 0: is it even new? Before geolocation, I check if the picture already exists online. Most "new" war photos I see in…
- sharing this everywhere. my whole discord now geolocating each other's cat photos, sorry in advance
- Very good writeup ! The "sort by oldest" button catches most recycled fakes in my experience. One add: Yandex is great for buildings but think before you upload a photo with faces in it. Bref, saving this.