A_box4·Nov 1Authentication Bypass via Password Reset Flow Manipulationقَالُوا سُبْحَانَكَ لَا عِلْمَ لَنَا إِلَّا مَا عَلَّمْتَنَا ۖ إِنَّكَ أَنتَ الْعَلِيمُ الْحَكِيمُ
Samadhan shimple·Oct 22I Found a Password Reset Token Flaw in My Bug Bounty Testing , But My Report Was Marked as a…
BugWraith (Lokesh)·Aug 30I sent one HTTP request and hijacked a password reset link → ATOA single “redirect” parameter, an attacker-controlled Collaborator domain, and a full account takeover. Welcome to another password reset…A response icon1
Given Quincy·Jul 27HACKING JULY DAY 22: VULN-BANK EXPLOITATION #6Apologies for not being able to post on Saturday due to unavoidable circumstances.
TheRealIbk·Jul 17VulnBank: Using Exposed API Docs and Weak Reset Logic to gain Superadmin AccessExposed API endpoints are often the starting point for dangerous information leaks. In this write-up, I will demonstrate how a weak…
