Biscuit's Bug Bounty Playbook
CtrlK
  • ๐Ÿ‘‹Introduction to Biscuit's Bug Bounty Playbook
  • Mains
    • ๐ŸงพResume For Cyber Security Freshie
    • ๐Ÿ“—Browser extension For Bug Bounty
    • ๐Ÿ“€POC Videos YT Channel
    • ๐Ÿ“บ55 YouTube Channels To Learn Hacking
    • ๐Ÿ‘€Hackers to Follow on Social Media
      • Twitter
      • Medium
      • YouTube
      • GitHub
      • Discord Server
      • Security GitBooks
    • ๐Ÿ…Learn The Basics
      • ๐ŸŽ–๏ธType Of Cyber Security
      • ๐ŸฅˆCommon Job Roles
      • ๐Ÿฅ‰Get Started With InfoSec
      • โš•๏ธBest Bug Bounty Platform
      • ๐Ÿ—ž๏ธBest InfoSec Writeups Website
      • ๐ŸชHacking Books
      • ๐Ÿฅ‚CLI Commands
      • ๐Ÿ’ฟLearn WSL
    • ๐Ÿ‘ฉโ€๐Ÿ’ปFun Programming Codes
    • ๐Ÿ”ฎBuild your own Bug Bounty Methodology
    • ๐ŸŽดBug Bounty Checklist
  • ๐ŸŸงLearn to Use Burp Suite
  • Learn Android Bug Bounty
    • ๐ŸŽฅVideo Tutorials
  • โค๏ธYouTube Channels
  • ๐Ÿ“ฐBug Bounty Reports
  • ๐Ÿ“šBlogs & Writeups
  • ๐ŸนGitHub Repository
  • ๐Ÿ‘จโ€๐Ÿ‘จโ€๐Ÿ‘งConference Talks
  • ๐Ÿ–จ๏ธAutomated Scanners
  • โš™๏ธIntentionally Vulnerable Apps
  • ๐ŸŽฑLearn Drozer For Android Pentesting
  • ๐Ÿช€Learn Frida For Android Pentesting
  • ๐ŸˆBypassing Security Protections in APKs via Objection and Frida
  • ๐ŸชSecurity Tools For Android Pentesting
  • ๐Ÿ˜ผPIDCAT for Android Bug Bounty Logging
  • ๐ŸŽนCLI Commands & Shortcuts
  • Learn Thick Client Pentesting
    • ๐ŸŸฅIntroduction Videos
  • ๐Ÿ“‘Introduction Articles
  • โœ…Pentesting Checklist
  • ๐Ÿ“šBug Bounty Writeups
  • ๐ŸžThick Client Vulnerabilities
    • DLL Hijacking Basics
  • ๐ŸฅผIntentionally vulnerable labs
  • ๐Ÿ› ๏ธTools for Thick Client Pentesting
  • ๐Ÿ Bug Bounty Programs with Thick Client Scope
  • ๐Ÿ’ตPaid Udemy Course
  • Bug Bounty Reports & Articles
    • 0๏ธโƒฃIndex
    • 1๏ธโƒฃTakeover's (Accounts, Sub-domains, etc)
      • ๐ŸšกSub Domain Takeover
      • ๐Ÿš Account Takeover
      • ๐ŸšŸdependency confusion vulnerability
    • 2๏ธโƒฃIDOR (Indirect Object Reference)
    • 3๏ธโƒฃLeaks & Disclosure (PII, API Key, etc)
    • 4๏ธโƒฃOpen Redirects
    • 5๏ธโƒฃRequest Forgery (CSRF & SSRF)
      • ๐ŸŸขCSRF
      • ๐Ÿ”ดSSRF
    • 6๏ธโƒฃInjections (HTML, XSS, etc)
      • ๐ŸŸกXSS
      • ๐ŸŸ HTML Injection
      • โšซSQL Injection
      • ๐ŸŸฃCR/LF Injection
      • ๐ŸŸขSSTI
      • ๐Ÿ”ดHost Header Injection
      • ๐Ÿ”ตCSV Injection
    • 7๏ธโƒฃBroken Access Control & Broken Authentication
      • โš™๏ธFile Upload Functionality
      • โš™๏ธPassword Reset Functionality
      • โš™๏ธ2FA Functionality
      • โš™๏ธOauth Functionality
      • โš™๏ธBypassing
      • โš™๏ธMisconfiguration
      • โš™๏ธCaptcha Bypass
      • โš™๏ธBusiness Logic Flow
    • 8๏ธโƒฃWeb Socket
    • 9๏ธโƒฃMiscellaneous Reports
    • ๐Ÿ”ŸIDN Homograph Attack
    • ๐ŸงปUser-Role Management Issue
    • 0๏ธCloud
      • ๐ŸŒฉ๏ธAWS S3
    • 1๏ธLow Hanging Fruits
    • 2๏ธCache Vulnerabilities
    • 3๏ธDOS/DDOS
  • 4๏ธForced Browsing
  • Bug Bounty Platforms
    • ๐Ÿ›BugCrowd
    • ๐ŸžHackerOne
    • ๐ŸIntigriti
    • ๐ŸœOpen Bug Bounty
  • Exploiting Technologies
    • 0๏ธโƒฃIntroduction
    • 1๏ธโƒฃWordpress
    • 2๏ธโƒฃGraphQL API
    • 3๏ธโƒฃIDOR Vulnerability
Powered by GitBook
On this page
  1. Bug Bounty Reports & Articles

3๏ธโƒฃLeaks & Disclosure (PII, API Key, etc)

LogoHunting JavaScript File for Bug HuntersStackademic
LogoAnalyzing JavaScript Files To Find BugsMedium
LogoHow to look for JS files Vulnerability for fun and profit?Medium
LogoGit Directory Exposed Leads to Credentials DisclosureMedium
LogoJS for Bug Bounties 2.0 Extreme Edition 2024Medium
LogoJS is love โค๏ธ.Medium
Logo25+ users sensitive information disclosed by waybackurlsMedium
LogoInformation DisclosureMedium
LogoPlaintext Storage of a Password Lead to sensitive data leakageMedium
LogoThis is the easiest bug you can find right now.InfoSec Write-ups
LogoIDOR lead to PII DisclosureMedium
LogoUnauthenticated Massive PII LeakMedium
LogoLogitech disclosed on HackerOne: Sensitive information disclosure...HackerOne
LogoDeriv.com disclosed on HackerOne: login to any user's cashier...HackerOne
LogoX (Formerly Twitter) disclosed on HackerOne: Information Disclosure...HackerOne
LogoInformation Disclosure: Story of 500โ‚ฌ + 400$ BountyInfoSec Write-ups
LogoP1 Vulnerability in 60 secondsInfoSec Write-ups
LogoHow I Found a Bug under 3 minsย , that could risk the reputation of an entire organisationย !Medium
LogoHow to find the Origin IPMedium
LogoHow I can easily get four P1 at NASA using Simple Google Dorking.Medium
PreviousIDOR (Indirect Object Reference)NextOpen Redirects

Last updated 11 months ago