Bug-Bounty on

Be Patient and Keep it Simple, The Bug is There

Sat, 02 Aug 2025 00:00:00 +0000

Good Day!

I hope you are doing well. Long time not writing anything… right? Well I am back again with two finding I have discoverd recently at some private program at Hackerone. I hope at the end you will going to learn something new :)

الحمدلله و الصلاة و السلام على سيدنا محمد

اللهم انصر اخواننا في فلسطين

In fact the bugs I am going to talk about not that much of complexity, the first bug is actually a simple IDOR with a High impact, but don’t worry… I am not here to explain the IDOR. We are all know what the IDOR is and sick of it. I am here to tell you the secret -as I think- that leads me to find that High impact IDOR bug.

Hunting for Hidden API Endpoints Using Katana and Hakrawler

Mon, 09 Sep 2024 00:00:00 +0000

Good day! I hope you’re doing well.

In bug bounty, never say: “This idea is silly to try; the result will be nothing.” Bug bounty hunting is essentially black-box testing — you have to keep poking at your target until something turns up.

الحمدلله والصلاة والسلام على سيدنا محمد اللهم انصر إخواننا في فلسطين

The target I was hunting already had several bugs I’d found and reported before. I used to tell myself, “I know everything about this website. If something new appears, I’ll spot it.”

How easy I made $$$$

Tue, 23 Apr 2024 00:00:00 +0000

Good morning!

I hope you’re doing well. Thank you for joining me today. Probably you’re here because of the attractive title.I mean who doesn’t want to make easy money in just a couple of hours every day? Especially if you live in the Middle East, India, or Africa. A reward with three or four digits can really make a difference.

However, I’m here to tell you that I didn’t earn any easy money sadly. I wanted to talk about something I’ve been thinking about a lot in the past few weeks.

Don't Trust the Cache: Exposing Web Cache Poisoning and Deception Vulnerabilities

Fri, 05 Apr 2024 00:00:00 +0000

Good day! I hope you’re doing well.

I’ve been studying web cache vulnerabilities, so here’s a shortcut through all the different techniques I’ve come across so far. I’ll assume you already have a basic understanding of web caching concepts.

الحمدلله والصلاة والسلام على رسول الله

Obviously, the cache itself isn’t a vulnerability. What makes web applications vulnerable to web cache attacks is either chaining them with other bugs (most often XSS) or abusing misconfigurations to launch a Denial-of-Service (DoS) attack on the site.

Click, Intercept, Hack: Checkmate on Access Control Vulnerability

Thu, 07 Mar 2024 00:00:00 +0000

Good Day!

I hope you are doing well. Today, I am going to share a Broken Access Control (BAC) bug that I found a while ago in one of the HackerOne private programs. The website I was testing on is a popular chess platform, but I’ll refer to it as redacted.com :)

الحمدلله و الصلاة و السلام على سيدنا محمد

Initially, I tested the platform using my main account instead of creating a new one. I spent two days testing, but I only received informative and “N/A” responses from the website security team.

Bugs & JS: A Closer Look at JavaScript for Successful Bug Hunting

Wed, 10 Jan 2024 00:00:00 +0000

Good Day!

Remember when I first started bug hunting? I used to think looking into JS files was unnecessary — would I really find bugs in files everyone can see? But after some reading, I realized I was missing out on a lot. So I want to share some resources, tools, tutorials, and other ways to dig deeper into JavaScript analysis.

Resources and Tools

Diving into JS files can be very rewarding. It lets you uncover hidden functionality, credentials, API keys, paths, and more — especially valuable for finding client-side vulnerabilities like XSS.

How One Bug Scored Me Double Rewards!

Tue, 19 Dec 2023 00:00:00 +0000

Good day! I hope you are well.

I’ll get straight into a couple of bugs I found a while ago in a private program on HackerOne. Let’s call it redacted.com :)

The program resolves any subdomain (anything.redacted.com) to the main login page (redacted.com/login). That behavior was new to me, so I initially thought subdomain-gathering tools would be useless here.

I started with a simple Shodan dork:

ssl:redacted.com

Plenty of results came up, until I found an IP resolving to the subdomain z2007.redacted.com — interesting! From the name, z2007 looked like some old, forgotten server.