Mastering Bug Bounties: Personal PoCs & Live Hunt Sessions

Master note taking skills to track learning from writeups and labs in bug bounties, using Obsidian, Notion, or Google Docs, documenting patterns, access types, and payloads to analyze security progress.

Document your learnings to build a knowledge base for Android bug bounty. Share curated resources, writeups, blogs, videos, and talks in GitBook or Notion to help the community learn faster.

Learn to craft clear bug bounty reports using a consistent template, detailing introduction, steps to reproduce, impact, and cvss 3.1 vector, cw id, and risk context.

Join a cybersecurity community to master bug bounty through three pillars—networking, Linux, and programming—build your methodology, checklist, and vulnerability knowledge for live hunt sessions.

Engage in reconnaissance for a target during a live bug bounty hunt, developing personal PoCs and refining a practical proof-of-concept workflow.

Explore manual bug bounty live hunts in a target session, learning how to craft personal PoCs and respond to a real target in a controlled environment.

Follow a real-time manual bug bounty hunt from zero to discovery, showing recon, subdomain gathering, endpoint probing, Burp Suite scope with advanced scope control, and clear reporting.

Explore target no 3 in a live manual bug bounty hunt to develop personal proof-of-concepts and participate in live hunt sessions.

Perform live reconnaissance on Motorola Solutions, use Boomer for subdomain enumeration, analyze VirusTotal data via API, document findings, and report bugs with disclosure notes for a bug bounty workflow.

This lecture presents a race condition poc on a social follow feature, showing how parallel follow requests can inflate followers and documenting steps to reproduce, functionality, and exploitation.

Demonstrate a race condition in a team invitation flow by creating an account, validating it, and sending parallel invites to bypass the ten member limit.

Demonstrates a race condition that lets a free user bypass the two-project limit on Supabase. Within bug bounties, this PoC uses intercepted requests to illustrate the free-tier bypass.

Expose how a race condition in a bug bounty app allows parallel requests to award xp points multiple times, revealing a business logic flaw that can disrupt the leaderboard.

Explores a free account limitation bypass by exposing a fault in the ten-set cap, using parallel requests with unique names to bypass the user limit in code.com.

Demonstrates a race condition exploit to bypass a user limit by abusing concurrency and parallel requests; reveals how a PoC can override limits during live testing.

Demonstrates a race condition vulnerability in a live post like feature on Internshala, where parallel requests can lower or raise likes, potentially producing negative likes.

Explore a zero-click account takeover in an android app via password reset token leakage, demonstrated by intercepting a reset request and exploiting internal email access.

Demonstrates an Android app bug bounty POC showing an XSS vulnerability during user sign-up, where manipulating the last name with a long input triggers database issues in the app.

Discover how intercepting Android app traffic reveals exposed API keys, including Google map keys, enabling data retrieval by altering URLs and highlighting Android security gaps and zero-click risks.

Demonstrating a proof-of-concept, an Android app’s quiz answers leak via an idor bug by changing quiz name and level, then retrieving answers with a curl request and an auth token.

Demonstrates a mass assignment bug in a community feature by intercepting a request, manipulating upvotes and is_pinned to pin a comment and inflate likes in a live poc.

A massive PII leak exposes thousands of doctors' personal data on a hospital website through unauthenticated requests in the search feature.

Demonstrate a bug bounty POC where a PandaDoc subdomain document path leaked thousands of documents containing personal data, emails, phones, and signatures via Wayback data.

Expose how an insecure api leaks sensitive data by intercepting blog comment requests, revealing user emails alongside usernames, and highlighting data exposure during bug bounty testing.

Demonstrate a proof of concept for exif data geolocation leakage in Chess.com, where image metadata in profile pictures exposes user location through flawed handling of image data.

The video demonstrates a POC of leaking sensitive data from a hall of fame page by extracting emails via regex, exposing researchers' PII across Gmail, Outlook, and ProtonMail.

Demonstrate a POC on CWE 620 unverified password change. Show how reusing an old password after a breach can bypass password policies.

Demonstrates an email verification bypass vulnerability in a blog commenting flow, showing how an unverified account's jwt token can be reused to verify the account and enable commenting.

Demonstrates bypassing rate limits across four endpoints by automating OTP requests via a bash script, exploiting absence of global rate limiting to spam a user's phone.

Expose how a security control bypass arises from no character limit and no rate limiting, enabling attackers to post extremely long comments and potentially DDoS the application.

Explores a paywall bypass on Gumroad, revealing how zero-amount requests and unauthenticated shareable URLs let attackers access paid digital products.

Demonstrates arbitrary url injection on google.com social links. Uses ip logger.org to track redirects and raw GitHub links to trigger downloads from LinkedIn and website fields.

Explain the race condition bug in kaggle.com's email feature that bypasses a 20-email limit via concurrent requests. The example shows how requests can exhaust the limit and send extra messages.

Explore an SSRF vulnerability in a Kaggle writeup feature via an HTTP callback, highlighting the need for thorough retesting after initial bug reports and potential exposure of internal AWS credentials.

Examine arbitrary url injection bugs, illustrated by Kaggle.com and social media examples, and assess how attackers leak IP addresses and geolocation using IP logger tools, plus automatic file downloads.

Demonstrates arbitrary URL injection pocs across multiple feeds, revealing how client-side restrictions can fail without server-side validation, enabling attackers to expose victims' location via IP logger or GitHub links.