i break apps not hearts.

• MRS #2: Bypassing premium features by checking “premium validation” parameters (€€€)
• My Report Summaries #1: Project manager can see & download all users’ login history at redacted app (IDOR)
• Disclosure email address of any Wordpress user via redacted-service
• Bypassing email verification of high-profile tech company ($$$)
• Bypass Apple’s redirection process with the dot (“.”) character
• Break the Logic: 5 Different Perspectives in Single Page (€1500)
• Break the Logic: Insecure Parameters (€300)
• Multiple bugs in one program leads to 1500€
• I mean, IDOR is NOT only about others ID
• How Did I Leak 5.2k Customer Data From a Large Company? (via Broken Access Control)
• Tackling CVE-2021–41277 Using a Vulnerability Database
• SONY Hunting I: Discovering Hidden Parameters (5x SWAG)
• What is BOLA? 3-digit bounty from Topcoder ($$$)
• The fine line of IDOR (ESET $WAG)
• Reflected Cross Site Scripting on REDACTED Program (Bounty: 750$)
• Analysis: FortiOS Credentials Disclosure (CVE-2018–13379) [TR]
• IDOR Practices I [TR]
• Business Logic Flaws — Giriş I [TR]

• #1073420

• Apple
• Opera
• SONY
• Xiaomi
• Visma
• BOSCH
• Philips
• BMW Group
• AT&T
• ESET
• Topcoder
• United Nations
• European Union
• Federal Reserve
• Singapore Government (GovTech)
• U.S. Dept Of Defense
• UNDER ARMOUR
• GAP Inc.
• Beiersdorf
• Realself
• University of Twente
• Riipen
• Digitaal Vlaanderen (Belguim)
• Innovapost / Canada Post

• INTIGRITI - Bug Bytes #187
• IW Weekly #40
• IW Weekly #39
• INTIGRITI - Bug Bounty Tips
• Issue 148: Microsoft Power Apps breach, BOLA on Topcoder portal, RFC 9101 released, API hacking guide
• The fine line of IDOR (Bug Bounty) canmustdie
• BOLA Vulnerability, YouTube Clickjacking Bug, GitHub Dev Mode | Thursday Hacking Masala | EP #20
• What is BOLA? 3-digit bounty from Topcoder ($$$)

"you wear a mask for so long, you forget who you were beneath it."