The Bug Hunter

I’m awhacken.

Most of my bugs start out looking harmless. These are the ones that weren’t.

  1. Before: a 505 error for an invalid HTTP versionAfter: an open redirect via Host header poisoning

    How I found a CRLF-based request header injection that let me poison the Host header and turn it into an open redirect on a GitLab instance.

    , 6 min read

  2. Before: self-XSS, useless on its ownAfter: reflected XSS via CSRF, medium severity

    How I transformed a seemingly harmless self-XSS vulnerability into a critical reflected XSS by chaining it with CSRF, demonstrating the power of vulnerability escalation in bug bounty hunting.

    , 6 min read

  3. Before: BSCP: fail, fail, failAfter: BSCP: pass on attempt four

    The BSCP was harder than I expected. Here's what actually worked for me after failing three times and what I'd do differently if I started over.

    , 6 min read