IDOR: How I Could Delete Any Product Image on an E-Commerce Platform

By: ／u／General_Speaker9653 — September 12^th 2025 at 02:37

Admin Emails & Passwords Exposed via HTTP Method Change

By: ／u／General_Speaker9653 — July 26^th 2025 at 01:32

Just published a new write-up where I walk through how a small HTTP method misconfiguration led to admin credentials being exposed.

It's a simple but impactful example of why misconfigurations matter.

Let me know what you think — and feel free to share similar cases!

#bugbounty #infosec #pentest #writeup #websecurity

By: ／u／General_Speaker9653 — July 13^th 2025 at 00:35

Hey folks,

Just published a write-up where I turned a blind XSS into Remote Code Execution , and the final step?

Injecting commands via Accept-Language header, parsed by a vulnerable PHP script.

No logs. No alert. Just clean shell access.

Would love to hear your thoughts or similar techniques you've seen!

🧠🛡️

By: ／u／General_Speaker9653 — July 9^th 2025 at 03:16

I recently tested a language-learning site that used live frontend filtering to block HTML input (e.g., <img> <svg> tags were removed as you typed).

But by injecting the payload directly via browser console (without typing it), the input was submitted and stored.

Surprisingly, the XSS executed later on my own profile page — indicating stored execution from a DOM-based bypass.

I wrote a short write-up here:

enjoy