Privilege escalation through a GraphQL authorization gap
A GraphQL authorization gap let a limited Program Admin join privileged groups and gain report and reward permissions.
Security writeups
Practical security research and lessons from real-world bug hunting.
6 results
Read
Bypassing HackerOne 2FA due to race condition.
A race condition in HackerOne’s 2FA recovery flow created multiple active reset requests, allowing one cancellation to leave others valid.
A practical workflow for small-scope bug bounty programs
A repeatable workflow for understanding compact targets, exercising every endpoint, and finding product-logic flaws beyond basic reconnaissance.
2FA bypass through information disclosure and improper access control
Pre-authentication state and an organization-switch endpoint combined to bypass 2FA.
Account takeover through an unbound email-change link
An email-change confirmation link updated whichever account opened it because the token was not bound to the account that requested the change.
Account lockout as permanent denial of service
How an account-based login lockout that invalidated active sessions could be abused for repeated denial of service.