Writeups.
Real findings, told as stories — the spark, the dead ends, the moment it clicked, and the fix. Every company, domain and identifier is anonymized under responsible-disclosure terms.
- 01CriticalWeb Cache Deception· 4 min
The Fake .js File That Cached Everyone's Login
An API that handed out session tokens plus a CDN that thought it was serving JavaScript equals a one-click account takeover you could serve to anyone.
Target · a national grocery & retail chain
- 02CriticalAuth Bypass· 4 min
The Boolean That Owned Every Account
A passwordless login trusted the browser to grade its own homework — so I flipped one false to true and walked into anyone's account with just their email.
Target · a retail super-app
- 03CriticalInsecure postMessage (OAuth Token Leak) → Account Takeover· 4 min
The Popup That Handed Me Everyone's Account
A single wildcard in one postMessage call quietly turned an OAuth popup into an account-takeover machine.
Target · an education-technology platform
- 04CriticalXSS to OAuth Account Takeover· 4 min
The First Name That Signed Me In as You
A profile field nobody guards became the loose thread that unraveled an entire OAuth login — one unescaped name away from full account takeover.
Target · a construction-industry B2B platform
- 05CriticalAuth Bypass· 4 min
The Magic Link That Showed Itself to the Wrong Person
A feature meant to email a student's login link put it on the teacher's screen instead — turning convenience into one-click account takeover.
Target · an education platform's classroom product
- 06CriticalIDOR → Account Takeover· 5 min
One Vendor Number, the Whole Directory — Then the Keys
The app identified vendors by a number in the request. Read anyone's profile with it; then change their email and own the account.
Target · a global retailer's vendor portal
- 07CriticalDOM XSS → Account Takeover· 5 min
A Payload With No Parentheses
The login flow executed a javascript: URL it should have rejected. A WAF tried to stop it — so I wrote a payload the WAF couldn't read.
Target · a SaaS video platform
- 08CriticalGraphQL IDOR → ATO· 4 min
A Mutation With a Stranger's ID
The GraphQL mutation to edit account info trusted whatever user ID you handed it. So I handed it someone else's.
Target · a local-business reviews platform
- 09HighIDOR· 4 min
The Oracle at the End of the Redirect
A photo-print service hid every image behind an unguessable URL — then handed that URL to anyone who asked, no login required. So I asked for everyone's.
Target · a big-box retailer's photo-printing service
- 10HighIDOR (GraphQL Broken Object-Level Authorization)· 4 min
Two Queries From an Email to a Stranger's Tax ID
A seller portal let me look up any vendor by email — and one field in the response was the key that unlocked their tax ID.
Target · a global marketplace's seller portal
- 11HighSSRF· 4 min
The Filter Checked the Wrong URL
A server-side URL fetcher blocked the AWS metadata IP on the way in — but never checked where its own redirects were taking it.
Target · an AI video-generation SaaS
- 12HighMFA Bypass· 4 min
One Flipped Status Code Away From a Permanent Passkey
A logistics platform gated passkey enrollment behind 2FA — but let the browser decide whether the OTP passed. So I told it the server said yes.
Target · a logistics & delivery platform
- 13HighReflected XSS· 4 min
One Click From Every Customer's Home Address: XSS Behind a Login Wall
A parts-lookup page echoed one query parameter into the DOM. Behind the login wall, that was enough to drain a victim's full profile with a single click.
Target · a major consumer-electronics brand's service center
- 14HighIDOR· 4 min
The Chatbot That Handed Me Everyone Else's Conversations
A little support-chat bubble asked for a customer ID and never asked for a password — so I deleted every cookie and started reading strangers' transcripts.
Target · a retail chain's support chatbot
- 15HighBroken Access Control· 4 min
The Private Album With No Lock on the Door
Every customised photo project got its own URL — and that URL was the only thing standing between a stranger and your family photos.
Target · a print-on-demand photo service
- 16HighIDOR· 3 min
Every Supplier's Documents, One Filename Away
The download endpoint asked which file you wanted — and never checked whether it was yours.
Target · a retail supplier portal
- 17HighAuth Bypass· 3 min
I Asked It to Send the Code to Me Instead
The 'resend code' request carried the destination email — so I changed it, and the victim's OTP arrived in my inbox too.
Target · a grocery e-commerce chain
- 18HighIDOR· 3 min
Same ID, Different Verb, Someone Else's Data
One endpoint checked who you were. Its next-door sibling, sharing the same service layer, forgot to.
Target · a retail loyalty platform
- 19HighIDOR (write)· 3 min
Editing a Stranger's Identity by Changing One Field
The profile-update request carried the account's own ID. Swap it, and you overwrite someone else's name, phone and documents.
Target · an e-commerce grocery chain
- 20HighStored XSS → ATO· 4 min
The Second Bug in the Field Next Door
The first XSS got fixed. The neighbouring field had its own — a different context, a different payload, the same account takeover.
Target · a construction-industry B2B platform
- 21HighBlind SSRF· 4 min
Reading an Internal Network Through a 400 vs a 504
The fetcher wouldn't return a response body — but the difference between a fast error and a slow timeout was all the answer I needed.
Target · an AI media-generation platform
- 22HighReflected XSS (WAF bypass)· 4 min
One Payload, a Whole Dealer Network
A legacy portal reflected user input everywhere and leaned on a WAF to save it. The same backtick-and-constructor payload worked across the entire network.
Target · a Fortune-500 automaker's dealer portal
- 23MediumBusiness Logic· 4 min
The QR Code That Fed Me Other People's Photos
A convenience feature quietly pointed its trust arrow the wrong way — and a single scan could route a stranger's private photos straight into my account.
Target · a print-on-demand retail service
- 24MediumOpen Redirect· 3 min
An HTML File That Redirected From a Domain You Trust
The upload form happily took an HTML file, then served it back on the company's own domain — turning their brand into a phishing launch pad.
Target · a large retailer's file service
- 25MediumStored HTML Injection· 3 min
The Chatbot That Rendered My HTML
A URL parameter got stored and replayed — inside the site's AI assistant, unescaped, for other users to see.
Target · a careers portal
- 26MediumData Integrity· 3 min
Ten Thousand Fake Viewers, No Account Needed
The view-tracking endpoint asked for no auth and enforced no ownership — so anyone could invent an audience for anyone's video.
Target · a video-analytics SaaS
- 27MediumIDOR· 2 min
Guessable Tokens on Private Uploads
The image URL looked random. Part of it wasn't — and that part was enough to walk into other people's uploads.
Target · an online photo-printing service