PrakritPrad·Oct 24แชร์แนวทางการหา CVE ตัวแรกในปี 2026สวัสดีครับบทุกคนน วันนี้ผมจะมาแชร์แนวทาง / ปัญหาที่เจอในการหา CVE ตั้งแต่ต้น จนจบเลย ตั้งแต่ศูนย์ set lab สำหรับเทส ไปจน Public disclosure…A response icon1A response icon1
kjulius·Oct 23The Metadata Nobody Reads: How a Government Portal Leaked Internal Usernames Across 15,000…A short writeup of a bulk-harvestable metadata leak, how I found it, and what it says about the way we publish documents.
Zyadatef·Oct 15Bypassing a Coupon’s usage_limit via a Race Condition in an E-Commerce PlatformTL;DR: A Ruby on Rails e-commerce platform enforces a promotion’s redemption limit (e.g. a single-use coupon) by counting the completed…
54adon·Oct 5AI Vulnerability That Silently Leaks Email to AttackersThis is a writeup of an indirect prompt injection chain I discovered and reported through HackerOne. The vulnerability class is…
MaMad·Sep 6Exposed Django Debug Mode on a Development SubdomainInformation Disclosure via Django Debug Mode
MaMad·Sep 6How to Configure Subfinder with API Keys for Better Passive Subdomain EnumerationSubfinder is a passive subdomain enumeration tool developed by ProjectDiscovery.
praveenarsh0xx0·Aug 22From a Cache Header to a $400 Bug Bounty: My API Security ResearchHello kiddos ,A response icon2A response icon2
lukewago·Aug 20What Should You know: The Bounty things…Bug-bounty is not for everyone BUT this does not mean you should not try it out as this is the epitome of any hacker , an initiation to the…
InOSINT TeambyGokuleswaran B·Aug 11I Was Just Checking an API Endpoint… Then I Found Its Internal Metrics 👀 Telekom Hall Of FamePublicly Exposed Prometheus Metrics & Debug Information in a Telekom IoT API
