<![CDATA[Stories by The XSS Rat on Medium]]> https://medium.com/@thexssrat?source=rss-c4af1cf135f5------2 https://cdn-images-1.medium.com/fit/c/150/150/1*FKamZM1_6f3gkK2QOjEAxA.png Stories by The XSS Rat on Medium https://medium.com/@thexssrat?source=rss-c4af1cf135f5------2 Medium Sat, 14 Nov 2026 18:09:54 GMT <![CDATA[GraphQL Is a Gift to Bug Hunters — Here’s My Introspection-to-Takeover Workflow]]>

Most hunters test GraphQL like it’s REST and walk straight past the money bugs. Here’s how I read the schema, map the mutations, and turn…

Continue reading on Medium »

]]> https://thexssrat.medium.com/graphql-is-a-gift-to-bug-hunters-heres-my-introspection-to-takeover-workflow-3f52e8a52bc1?source=rss-c4af1cf135f5------2 https://medium.com/p/3f52e8a52bc1 Tue, 10 Nov 2026 21:08:34 GMT 2026-11-10T21:08:34.588Z <![CDATA[The Forgot-Password Flow Is Where I Take Over Accounts: My Password-Reset Attack Chain]]>

Six checks I run on every reset function — host-header poisoning, token leaks, and the logic bugs that hand you someone else’s account.

Continue reading on Medium »

]]> https://thexssrat.medium.com/the-forgot-password-flow-is-where-i-take-over-accounts-my-password-reset-attack-chain-4512f7b31bc4?source=rss-c4af1cf135f5------2 https://medium.com/p/4512f7b31bc4 Mon, 09 Nov 2026 20:14:57 GMT 2026-11-09T20:14:57.579Z <![CDATA[The Five-Check JWT Chain: How I Break Token Auth Before I Touch the Business Logic]]>

Most JSON Web Token bugs die on the first three checks. Here’s the exact order I run them, and why I never start with the clever stuff.

Continue reading on Medium »

]]> https://thexssrat.medium.com/the-five-check-jwt-chain-how-i-break-token-auth-before-i-touch-the-business-logic-118f672cdc45?source=rss-c4af1cf135f5------2 https://medium.com/p/118f672cdc45 Thu, 05 Nov 2026 13:37:42 GMT 2026-11-05T13:37:42.202Z <![CDATA[The Three-Request IDOR Method: How I Find Broken Access Control Before Breakfast]]>

Two accounts, three requests and one matrix — the routine that still pays my bounties in 2026

Continue reading on Medium »

]]> https://thexssrat.medium.com/the-three-request-idor-method-how-i-find-broken-access-control-before-breakfast-aaf30335f3d2?source=rss-c4af1cf135f5------2 https://medium.com/p/aaf30335f3d2 Tue, 03 Nov 2026 11:09:20 GMT 2026-11-03T11:09:20.150Z <![CDATA[The OWASP Top 10 2025 Is Here — And You Can Hack Every Item Live]]>

A hands-on walkthrough of the new list by Wesley Thijs — The XSS Rat

Continue reading on Medium »

]]> https://thexssrat.medium.com/the-owasp-top-10-2025-is-here-and-you-can-hack-every-item-live-6b449f74d783?source=rss-c4af1cf135f5------2 https://medium.com/p/6b449f74d783 Sat, 10 Oct 2026 20:42:04 GMT 2026-10-10T20:42:04.969Z <![CDATA[subScraper: The Broad-Scope Playbook]]>

A hands-on recon guide by Wesley Thijs — The XSS Rat

Continue reading on Medium »

]]> https://thexssrat.medium.com/subscraper-the-broad-scope-playbook-03d35a28f477?source=rss-c4af1cf135f5------2 https://medium.com/p/03d35a28f477 Sat, 10 Oct 2026 17:14:32 GMT 2026-10-10T17:14:32.490Z <![CDATA[Uncle Rat’s Bug Bounty Methdology — 2026 Version]]>

This methodology has been based on a hunt on tesla.com.

Continue reading on Medium »

]]> https://thexssrat.medium.com/uncle-rats-bug-bounty-methdology-2026-version-65c88af2cbe6?source=rss-c4af1cf135f5------2 https://medium.com/p/65c88af2cbe6 Tue, 14 Apr 2026 08:53:39 GMT 2026-04-14T09:02:01.323Z <![CDATA[Bug Bounty / Web Application Security Hunting Checklist - 2026 XSS Rat version]]>

Continue reading on Medium »

]]> https://thexssrat.medium.com/bug-bounty-web-application-security-hunting-checklist-2026-xss-rat-version-1886138a8200?source=rss-c4af1cf135f5------2 https://medium.com/p/1886138a8200 Mon, 06 Apr 2026 10:39:59 GMT 2026-04-06T10:42:29.169Z <![CDATA[The Professional’s Playbook: 25 Rules for the Bug Bounty Grind]]>

Why are you failing?

Continue reading on Medium »

]]> https://thexssrat.medium.com/the-professionals-playbook-25-rules-for-the-bug-bounty-grind-d3612b139c89?source=rss-c4af1cf135f5------2 https://medium.com/p/d3612b139c89 Fri, 30 Jan 2026 17:44:37 GMT 2026-01-30T17:44:37.603Z <![CDATA[That time an Agentic AI Pentester beat me in CAPIE!]]>

## Setting the Scene

Continue reading on Medium »

]]> https://thexssrat.medium.com/that-time-an-agentic-ai-pentester-beat-me-in-capie-9ef6097c3c33?source=rss-c4af1cf135f5------2 https://medium.com/p/9ef6097c3c33 Wed, 01 Oct 2025 18:34:40 GMT 2025-10-01T18:34:40.203Z