4 Crits in 48 hours: Unicorn Programs
I've decided to remove this article for the time being to write a more detailed writeup in collaboration with the program itself, so stay tuned.…
Reflections on ECSC 2021
Note: I updated my Ghost instance but forgot to back up images, so all of the images that were on this blog are now gone forever. cries but anyway The Story And Some NotesIn September, I was fortunate enough to be selected as a team member of Team Ireland. I…
H@cktivityCon 2021 CTF
I participated in the H@cktivityCon 2021 CTF alongside some talented hackers - we placed 57th out of over 2,000 participating teams. My contributions weren't that big - but I did learn a lot. Most of the challenges I solved were easy. Bad Words The general aim of Bad…
Oauth client secret leak and possible IDOR leading to PII Disclosure
Given that this vulnerability is still in triage, I will give a vague overview of the bug chain. Whilst working on my automation, I was investigating various interesting subdomains that it had found. One given subdomain was owned by a SaaS bug bounty program. I was reading the HTML source…
Intigriti XSS Challenge - August 2021 - A venture into prototype pollution
When I started the challenge, I was greeted with this: Hovering over the links, I noticed that the links contained a recipe parameter. So, I opened the link in a new tab. Clearly the parameter was being processed somewhere, so figuring out where it was taking place was important. In…