9
TOTAL FINDINGS
1
CRITICAL
2
HIGH
6
MEDIUM
9
WRITEUPS
FINDING_001 · SERVER-SIDE HIGH
SSRF

SSRF Vulnerability — Internal Cloud Infrastructure Exposure

Discovered a Server-Side Request Forgery that allowed internal IP probing, metadata endpoint access, and exposure of internal cloud infrastructure through manipulated request parameters.

SSRF Cloud Internal Network Metadata Endpoint
↗ Read Full Write-Up
FINDING_002 · BUSINESS LOGIC HIGH
PRICE MANIPULATION

Price Manipulation / Business Logic Flaw

Identified a price manipulation vulnerability in an e-commerce application where the backend blindly trusted client-side request values, allowing attackers to modify product prices before checkout.

Business Logic Client Trust E-Commerce Parameter Tampering
↗ Read Full Write-Up
FINDING_003 · ACCOUNT TAKEOVER CRITICAL
0-CLICK ATO

Punycode-Based Account Takeover — 0-Click!

Found a Punycode-based vulnerability that can lead to a serious 0-click Account Takeover when applications blindly trust user-controlled input. No interaction from the victim required.

0-Click Account Takeover Punycode Input Validation
↗ Read Full Write-Up
FINDING_004 · SESSION MANAGEMENT MEDIUM
SESSION FIXATION

Password Changed — But the Old Session Never Died

Discovered that a learning platform failed to invalidate existing authenticated sessions after a password change. An attacker holding a stolen session token could maintain full account access even after the victim reset their credentials — and could even lock the legitimate user out by overwriting the password through the still-active session.

Session Fixation Authentication Session Lifecycle Account Takeover
↗ Read Full Write-Up
FINDING_005 · AUTHENTICATION MEDIUM
NO RATE LIMITING

Unlimited Login Attempts — When a Login Page Never Says "Enough"

Found a healthcare platform login endpoint with no rate limiting, account lockout, CAPTCHA, or throttling of any kind. Over 100 consecutive failed login attempts were processed normally, leaving the endpoint fully exposed to brute-force and credential stuffing attacks.

No Rate Limiting Brute Force Credential Stuffing Authentication
↗ Read Full Write-Up
FINDING_006 · CLOUD MISCONFIGURATION MEDIUM
S3 BUCKET EXPOSURE

Publicly Accessible Storage Bucket — Unauthenticated File Enumeration

While exploring a travel platform's staging subdomain, discovered a publicly accessible cloud storage bucket returning an unauthenticated XML listing of its contents. Object names, upload timestamps, file sizes, and stored assets were all enumerable without any credentials — exposing internal naming conventions and deployment structure.

Cloud Misconfiguration S3 Bucket Information Disclosure Recon
↗ Read Full Write-Up
FINDING_007 · INFORMATION DISCLOSURE INFORMATIVE
CONFIG EXPOSURE

Public Bitbucket Pipeline Config — Internal Infrastructure Blueprint

Discovered a publicly accessible Bitbucket pipeline configuration file on a travel platform with no authentication required. The file revealed deployment workflows, SSH-based deployment processes, internal directory layouts, and operational infrastructure details — providing an attacker with a detailed map of the backend environment without touching any exploit.

Information Disclosure Pipeline Config Recon Infrastructure
↗ Read Full Write-Up
FINDING_008 · API SECURITY MEDIUM
GRAPHQL BATCHING

GraphQL Query Batching — One Request Doing the Work of Hundreds

Identified a GraphQL endpoint with no query complexity limits, depth restrictions, or execution throttling. By batching hundreds of identical aliased operations into a single HTTP request, the server could be forced to perform a disproportionate amount of work — a potential denial-of-service vector requiring zero special privileges.

DoS GraphQL Query Batching No Rate Limiting
↗ Read Full Write-Up
FINDING_009 · AI / LLM SECURITY MEDIUM
PROMPT INJECTION

AI Assistant Reveals Its Own System Prompt — Prompt Injection

Using a single natural-language prompt against an AI chatbot embedded in a tax-filing platform, extracted the full system prompt including internal tool names, ticket escalation workflows, support routing logic, promotional instructions, and hidden behavioral rules — all without authentication bypass or technical exploits.

Prompt Injection LLM Security System Prompt Leak Information Disclosure
↗ Read Full Write-Up