Privilege escalation bugs were not something I used to pay a lot of attention to. Thus, I was amazed when, to prepare for the interview with Douglas Day, I spent a few hours just hunting for them and quickly, I found two of them on a program I've already been familiar...
Case Studies
Request smuggling case study – what more to do other than running existing tools?
HTTP request smuggling is a great vulnerability class. Over the years, we’ve seen many articles with great research and findings. But personally, I’ve never done more discovery than running HTTP Request smuggler. I wanted to know how can I profit from that and what...
How to find CSRFs despite SameSite cookies? CSRF Case Study
I was very curious about the CSRF case study. It’s a bug class that had been very popular but then came the SameSite cookie attribute that’s a very effective measure against this bug class. There was only one way to find out if the SameSite attribute did kill CSRFs or...
RCE – where to look for them? RCE Case Study
This was definitely the hardest case study. Usually, I am able to quite well, reduce the number of different labels that I have. But there's a huge variety of bugs that can result in a command execution. It also shows how much we have to learn to be able to find...
How to make money for DoS bugs? DoS case study
DoS bugs were very intriguing to me. On one hand, I thought they were usually out of scope of web programs anyway. On the other, I saw big, even 5-digit bounties being awarded for them. So I decided to do what I like to do - extract all DoS reports from the Internet...
Account takeover case study + checklist that will help you find them
I can now say that I do these case studies regularly. I extract all the reports of a particular bug class from the Internet and I study them. I thought no case study will surprise me anymore - a few 5-digit payouts from big companies followed by tens of reports from...
How to maximise payouts for file disclosure bugs? File disclosure case study
Path traversals may seem like an easy vulnerability class - read /etc/passwd, send a report, done. But it’s only scratching the surface. What about file writes? What files to read to prove the impact? How to turn it into RCE? To answer these questions, I went on the...
How to make money with IDORs? IDOR case study
IDORs are often recommended as the easy vulnerability class, good to start the bug hunting journey. “Just change the ID in the URL parameter” they say. But are they really that easy? Well, there’s only one way to find out - to do the case study. This week, I analysed...
SQLi Case Study
I never look for SQL injection vulnerabilities. To be honest, I don’t even think about SQLi these days, considering it’s a thing of the past. But am I right doing that? Well, there’s only one way to find out! Extract all the disclosed reports from the Internet and do...
XSS – case study of 174 reports
XSSes are everywhere. They’ve been the most common vulnerability class for years. But while popping an alert may seem simple, there’s much, much more to cross-site scripting. What payloads are people using? Where are people finding XSSes? What about CSP? Can you...