Last year, we (My researcher partner on this topic, Anil and me) and found a SQL injection vulnerability on a target at Synack which was returning queries as error messages. This was quite different from the prior ones that we exploited because the back-end DBMS system was Google BigQuery. For…

I got lots of questions and requests especially from new beginners to the area, so wanted to prepare a blog post regarding how to start at bug hunting and how to be successful. Firstly, I want to say as there is no only true way exist to became successful in…

While I was recently hunting on a promising host target, from my well configured (only checking SQLi) active scan results, I found out a parameter could be vulnerable to SQL injection, within the payloads: name=' -> Redirecting to /Error.aspx page name='' -> Redirecting to /AccessDenied.aspx page Within further manual analysis: …

After publishing my blog post Unauthorized Google Maps API Key Usage Cases, and Why You Need to Care and scanner script for it, I got several messages from the security researchers at the community about some inconsistency on my script results/client feedbacks and some potential API bugs related to them…

For the %90 of my working time, I am hunting bugs on the Synack for 2 reasons: Fast triage/payout times: No matter what the deal is, after you submit a bug, if it is accepted, you got the money on your account within 1 week at maximum. While better cases/examples…

While I prefer more to write/talk about far-going topics instead of just one vulnerability write-up, I decided to make an exception for this one because it was definitely an original one. So, while I was hunting one of the weekly targets of Synack, I found out a document upload section…

When looking for security vulnerabilities on a web application - either for bug hunting or a penetration test project -, I always check 2 things at last when I was clearing my testing up on a target: Searching used user account’s personal information on the HTTP responses via Burp History…

Especially when I talk with newbie security researchers/bug bounty hunters, they always make me feel as not thinking theirselves capable of finding Remote Code Execution vulnerabilities because they are super-complex. Because of this misconception, these people are actually not trying to find any of them or stop looking after some…

Most of you probably familiar within the vulnerability types “IDOR (Insecure Object Direct Reference)” and second order vulnerabilities such as “Second Order SQL Injection.”, still for the ones who are not familiar, OWASP defines IDOR in theory as: Insecure Direct Object References occur when an application provides direct access to…