Writeups from my bug bounty hunting practice and live findings. Focus: IDOR, broken access control, authentication, business logic as foundation for now.
View My Live Bug Bounty Hunting Reports (Bug-bounty-reports)
Highlights:
- JWT authentication bypass via JKU header injection
- Username enumeration via account lock
- User role controlled by request parameter manipulation
- Insufficient workflow validation
- SSPP in query string
- Remote code execution via web shell upload
- Web shell upload via Content-Type restriction bypass
- Web shell upload via path traversal
- PHP Upload Security Testing Reference
- Mainly portswigger-labs — PortSwigger Web Security Academy writeups, organized by vulnerability category.
- Hack The Box Academy — Academy module notes and hands-on labs.
tryhackme/— Web Fundamentals and web security learning notes.pentesterlab/— PentesterLab exercise writeups and notes.overthewire/— Linux and command-line challenge writeups.burp-suite-certified-practitioner/— Exam preparation notes, labs, and methodology.- bug-hunter-skill-progression/ — Personal roadmap, checklists, and progress tracking.
random-lessons/— Security concepts, research notes, and miscellaneous documentation.writeup-template.md— Standard template used for documenting writeups.README.md— Repository overview and structure.LICENSE— MIT License for this repository..gitignore— Excludes unnecessary files from version control.
- Business Logic
- Authentication
- Access Control (keep warm)
- Classic Request Smuggling (do this before the CRLF paper)
| Priority | Path | Why it matters here |
|---|---|---|
| P0 | HTTP Request Smuggling | Direct foundation under CRLF desync |
| P0 | Authentication | Session/identity mechanics under Stage 2 |
| P0 | Business logic vulnerabilities | Stage 5 |
| P0 | Server-side template injection | Direct foundation under blind SSTI/RCE |
| P1 | File upload vulnerabilities | Understand validation, storage, and execution risks in upload workflows |
| P1 | SQL injection, especially the blind techniques | This is the actual intellectual root of both the SSTI paper and the ORM-Leak exfil technique — error-based/boolean-based oracle-hunting is one skill applied twice |
| P1 | Server-side prototype pollution | RCE fallback path |
| P1 | OAuth authentication | Identity-flow foundation that transfers conceptually toward SAML, even though SAML itself isn't in Academy |
| P1 | JWT | Token/identity foundation, connects to my existing playbook material |
| P2 | Web cache poisoning | Pairs naturally with smuggling |
| P2 | SSRF | Cloud/internal pivoting — matches interests I've already shown |
| P2 | Insecure deserialization | General "reach RCE through object handling" pattern, complements the RCE course already in my Notion |
- Bugcrowd (active from January 2027)
- HackerOne (active from January 2027)
- Intigriti (active from January 2027)
- X: My X handle
- Email: Malikdishan09@gmail.com