Bug Bounty Writeups

Solutions, exploit walkthroughs, and challenge analysis in Bug Bounty.

Bug Bounty

How I Got My Highest Payout: The Token Was Fine. That Was the Whole Problem

Uncovering a high-severity authentication logic and token validation flaw in an application portal leading to full account takeover and a top bounty payout.

bug-bountyauth-bypassaccount-takeoverapi-securityweb

@0xsponge // Bug Bounty

Read →

Bug Bounty

To Admin for a Bounty | How Two Dots Made Me Admin

How a path traversal and broken access control flaw allowed escalating privileges from a low-privileged account to Admin across 150 administrative endpoints.

bug-bountypath-traversalaccess-controlprivilege-escalationweb

@0xsponge // Bug Bounty

Read →