bug bounty
4 writeups
Don’t Reply: A Clever Phishing Method In Apple’s Mail App
About four or five years ago, friend and fellow bug bounty hunter Sam Curry asked if I had “ever thought about what was possible to load inside an <img> tag, besides an image“.
Using Burp Suite match and replace settings to escalate your user privileges and find hidden features
On May 14th, Lew Cirne, the CEO of New Relic, announced a new platform called New Relic One.
Get as image function pulls any Insights/NRQL data from any New Relic account (IDOR)
This writeup walks you through the full process as to how I found a pretty bad Insecure Direct Object Reference (IDOR) in New Relic.
Abusing internal API to achieve IDOR in New Relic
I recently found a nice insecure direct object reference (IDOR) in New Relic which allowed me to pull data from other user accounts, and I thought it was worthy of writing up because it might make you think twice about the types (and the sheer number!)