https://blog.abartan.net/tags/bug-bounty/ Recent content in Bug Bounty on haxormad Hugo en Sun, 08 Sep 2019 00:00:00 +1000 https://blog.abartan.net/posts/ship-it-to-me-for-free/ Sun, 08 Sep 2019 00:00:00 +1000 https://blog.abartan.net/posts/ship-it-to-me-for-free/ How I found a price manipulation vulnerability in an e-commerce checkout flow that let me get express shipping for free, earning my first four-figure bug bounty. https://blog.abartan.net/posts/insecure-direct-object-reference-idor/ Sun, 27 Jan 2019 00:00:00 +1000 https://blog.abartan.net/posts/insecure-direct-object-reference-idor/ A beginner-friendly guide to finding, exploiting, and preventing IDOR vulnerabilities in web applications. https://blog.abartan.net/posts/my-journey-to-google-hall-of-fame/ Sun, 25 Nov 2018 00:00:00 +1000 https://blog.abartan.net/posts/my-journey-to-google-hall-of-fame/ How I chained an open redirect with XSS on a Google acquisition (Sidewalk Labs) to earn a spot in Google's Hall of Fame — after seven months of invalid reports. https://blog.abartan.net/posts/my-first-swag-pack-logical-bug-edmodo/ Sun, 05 Aug 2018 00:00:00 +1000 https://blog.abartan.net/posts/my-first-swag-pack-logical-bug-edmodo/ How I found a simple logical flaw in Edmodo's phone verification that could block users from enabling two-factor authentication — and earned my first swag pack. https://blog.abartan.net/posts/tips-from-a-bugbounty-hunter/ Sun, 29 Jul 2018 00:00:00 +1000 https://blog.abartan.net/posts/tips-from-a-bugbounty-hunter/ Beginner bug bounty tips covering Google dorking, subdomain enumeration, and hunting for logical flaws — the methods that landed my first bounties.