The bug which worth 2k$

Bilal Khan — Tue, 09 Jul 2019 06:28:14 +0000

I was testing around a public program on Bugcrowd. The program does not allow public disclosure so I will call it redacted.com, it was public for about 7 years and lots of 1337 (1337 => hackers) have tried it for security vulnerabilities, so I was testing around and was so frustrated, as those were my starting days. Being frustrated I took a break and thought what am I doing I revert back the 1337 methodology which is try harder. I took a break and got to sleep after waking up I realize a request which was fetching my saved items so I immediately turn my laptop on and started looking for the request by capturing the request with BurSuit so, there was a request which retrieved my saved items and it was sent via GraphQL to the server after entering a semicolon to the saved saved_items_id got the SQL syntax error. After reporting the issue within a week got 2k$ bounty and an immediate fix was applied to the endpoint

🇵🇰

@this_rex

I earned💲2000 for my submission on @Bugcrowd bugcrowd.com/bilalkhan #bugbounty #ItTakesACrowd

09:25 AM - 21 Feb 2019

2 15

DEV Community: Bilal Khan

The bug which worth 2k$