Introduction This article is a write up on how I found Cross Site Scripting (Reflected-XSS) in Webmail Calender in IceWarp WebClient which gave me a new CVE-2020–25925. What is Cross Site Scripting (XSS) ? Cross-site scripting (also known as XSS) is a web security vulnerability that allows an attacker to compromise…

Introduction This article is a write up on how I found a Stored XSS in Google Ads Android Application where I was rewarded with $3133.70 I was waiting for the fix and after discussing with Google Security Team I am disclosing my finding. Currently I am ranked in Top 200 at…

Introduction This article is a write up on how I found a Blind XSS in Google Analytics Admin Panel where I was rewarded with $3133.70 Currently I am ranked in Top 200 at Google Hackers Ranking, What is Blind XSS Blind XSS vulnerabilities are a variant of persistent XSS vulnerabilities. They…

Introduction This article is a write up on how I found a Privilege Escalation Vulnerability where an attacker can access complete admin portal without authentication which gave me a new CVE-2020–35745. What is Privilege Escalation? Privilege escalation occurs when a user gets access to more resources or functionality than they are…

Hello Everyone, Why I gave the title “All In One” is because I will be covering bug bounty platforms, books, list of practice and training programs, methodologies, tools, and wordlist so that beginners should get to know from where and how to start there bug hunting journey !! I wish…

Introduction This article is a write up on how I found a 2FA Bypass vulnerability at one of the Top Cryptocurrency Company, no matter your account is blocked or not this bypass works and you are into the account!! What is Two-Factor Authentication (2FA) Two-factor authentication (2FA) adds an extra layer…

Introduction This article is a write up on how I found a critical XSS vulnerability at Shopify Core in Shopify Bug Bounty Program due to which I was Acknowledged and listed in Top 10 at Shopify Hacker’s Hall of Fame in the World. I wrote this for educational purposes only. Do…

Hello Everyone, this is my last part and the best one to get RCE ( Remote Code Execution). I am happy to change the mindset of my College to look into Security where the Education department doesn’t take cybersecurity seriously unless and until they are hit by Cyber Criminals. All…

Hello Everyone, here is the second part SQL INJECTION where I was able to get the complete database of my college. This story is about the challenge I got from one of the head of my System Department Saying “You can’t do anything, you will just sit in college and…