Posts tagged #bug-bounty on Dynamo Geeks: 3 posts from the community, most useful first.
this is a writeup of a bug I reported to a SaaS billing vendor I am calling "Facturo" here (not the real name, the program is private and I am still under their disclosure terms). nothing in this post lets you attack them or anyone else. it is a plain IDOR, the oldest bug in the book, and the only reason it is interesting is the 94 days it took them to admit it. the setup Facturo is a billing dashboard that a few…
I get the same DM twice a week: "how do I get into hacking". so here is the answer once, properly, and I will just link this from now on. the mistake everyone makes is starting with tools. they install kali, run thirty programs they cannot read the output of, and give up in a month. you do not need kali to start. you need to understand how the web works, and then practise on things that are built to be broken. step…
a short angry story, because I need to vent and because "informative" is the most insulting word in bug bounty. a company (private program, calling them "Shipr") had an image import feature. you give it a url, it fetches the image server side and stores it. classic SSRF territory. I pointed it at an internal address that only their own servers can reach, the kind of link to a cloud metadata service, and it happily…
