Articles Writeups CVE Programs

Sign in Start free

BUGFLARE

Threat intelligence and bug bounty research platform. Live vulnerability data, in-app writeup reading, and program tracking — aggregated from trusted public sources.

Explore

Articles Writeups CVE Programs Create account

Legal

© 2026 Bugflare. Publishers retain authorship; always verify on the source.

bugflare.site

Contact · Bugflare

In-app reader

Contact

PentesterLandAugust 27, 2020Sign in to save

Sign in to like · 0

bug-bounty writeup article

**

Pentester Land

**

Writeups
Blog
Contact
GitHub
Twitter

**

Contact us

Whether you have a bug bounty writeup to submit to our list, a business question or anything else, we look forward to hear from you.

Fill out the form below and we’ll be in touch soon.

Name _

Email address _

Subject Choose... Submit a writeup Report an error Business enquiry Other

Message

**Submit

Top

Source

Originally published by PentesterLand (pentester.land).

Shown in Bugflare for convenience. Ownership and accuracy remain with the original publisher — always verify on the source when it matters.

Open original on pentester.land →https://pentester.land/contact

Discussion

Comments

Sign in to join the discussion.

No comments yet — start the thread.

Keep reading

More on Bugflare

WriteupDesktop App Local API IDOR: Hunting Bindings on LocalhostFind IDOR and auth gaps on desktop local HTTP APIs—predictable ports, missing bind checks, and cross-user object access from browser-origin calls.
WriteupElectron App RCE in Bug Bounty: Practical Hunting PathsFind Electron remote code execution via nodeIntegration, preload leaks, open redirects into shell opens, and IPC trust bugs without trashing the tester machine.
WriteupBrowser Extension Privilege Abuse in Bug Bounty ProgramsHunt extension bugs from overbroad permissions, message-passing gaps, and web-accessible resources that turn a helper add-on into account or session abuse.
WriteupMCP Server Security Testing for Bug Bounty HuntersTest Model Context Protocol servers for tool overreach, auth gaps, path traversal in resources, and prompt-driven abuse without wrecking shared environments.
WriteupRAG Poisoning Bug Bounty Basics: What to Prove and What to Skip

Learn practical RAG poisoning tests for bounty: poison documents you control, prove retrieval influence, and avoid noisy claims without a grounded impact path.

WriteupLLM Output Handling: XSS and IDOR Paths Hunters Should TestTest how apps render model output and tool results—stored XSS in chat UIs, unsafe HTML, and IDOR when prompts or transcripts ignore object ownership.

Optional: create a free account to save items, track programs, and sync across web + app. Reading stays free.