Write-ups

Check The Published Writeups

Reset
WDBTitleTagsProgramsAuthorsTypePublicationAdded
4932JWT Refresh Token Manipulation JWT Authentication bypass Account takeover NA Mikail Tunç (@emtunc) Bug Bounty2017-11-162023-06-13
4505IDOR in JWT and the shortest token you will ever see {}.{“uid”: “1234567890”} IDOR NA Plenum (@plenumlab) Bug Bounty2018-10-302023-06-13
4335Hijacking accounts by retrieving JWT tokens via unvalidated redirects Open redirect Token leak NA Shawar Khan (@ShawarkOFFICIAL) Bug Bounty2019-01-272023-06-13
3537DOM based open redirect to the leak of a JWT token Open redirect DOM-based open redirect Token leak NA Adolphoramirez Bug Bounty2020-04-202023-06-13
3499A tale of verbose error message and a JWT token Information disclosure Authorization flaw NA Marek Geleta (@marek_geleta) Bug Bounty2020-05-052023-06-13
3313A tale of critical account take over Account takeover Exposed JWT generation endpoint JWT NA Shivam Pandey (@shivam31200) Bug Bounty2020-07-102023-06-13
3240Exploiting JWT - Lack of Signature Verification Account takeover NA Aditya Dixit (@zombie007o) Bug Bounty2020-08-062023-06-13
3132Chains on Chains: Chaining multiple low-level vulns into a Critical. Blind XSS CSP bypass Lack of rate limiting Exposed JWT generation endpoint JWT NA Daniel Marte (@Masonhck3571) Bug Bounty2020-09-262023-06-13
31315 Ways to do Account Takeover in a Single Website Account takeover Lack of rate limiting OTP bypass IDOR OAuth JWT NA letmeslidein (@VasuYadaav) Bug Bounty2020-09-272023-06-13
3101Unauthorized access to all the user’s account. Account takeover Authentication bypass JWT NA Rahul Naidu Bug Bounty2020-10-122023-06-13
3090Multiple Address Bar Spoofing Vulnerabilities In Mobile Browsers Authentication bypass JWT Android NHS COVID-19 App James Sanderson (@zofrex) Bug Bounty2020-10-202023-06-13
2926Each and every request make sense… Privilege escalation Exposed JWT generation endpoint JWT NA Akshar Tank Bug Bounty2021-01-052023-06-13
2250Eye for an eye: Unusual single click JWT token takeover Open redirect JWT Account takeover JetBrains Yurii Sanin (@SaninYurii) Bug Bounty2021-09-052023-06-13
2103HacktoberFest2k21 vulnerability: How users metadata can be changed via Auth JWT tokens leaking from waybackurls IDOR DigitalOcean Anurag__Verma Bug Bounty2021-11-042023-06-13
1911Stealing administrative JWT%27s through post auth SSRF (CVE-2021-22056) SSRF CSRF VMware Shubham Shah (@infosec_au) Bug Bounty2022-01-172023-06-13
1885Stealing administrative JWT%27s through post auth SSRF (CVE-2021-22056) Windows Driver hacking Kernel DoS VMware Christopher (@Kharosx0) Bug Bounty2022-01-272023-06-13
1761The Bad Twin: a peculiar case of JWT exploitation scenario Account takeover NA Sandh0t (@sandh0t) Bug Bounty2022-03-072023-06-13
1445Hacking into the worldwide Jacuzzi SmartTub network SPA Android JWT Privilege escalation Mass assignment Jacuzzi Group SmartTub Eaton Z. (@XeEaton) Bug Bounty2022-06-202023-06-13
1174ASP.NET Boilerplate Multiple Vulnerabilities Authentication flaw Hardcoded credentials JWT Padding oracle attack Cryptographic issues Volosoft (ASP.NET Boilerplate) Sana Oshika (@bigshika) Bug Bounty2022-08-262023-06-13
1023Exploits Explained: 5 Unusual Authentication Bypass Techniques Authentication bypass JWT CMS SSO NA Ozgur Alp (@ozgur_bbh) Bug Bounty2022-09-282023-06-13
93023000$ for Authentication Bypass & File Upload & Arbitrary File Overwrite JWT Authentication bypass Arbitrary file write Unrestricted file upload NA Souhaib Naceri (@h4x0r_dz) Bug Bounty2022-10-192023-06-13
831SSD Advisory – Cisco Secure Manager Appliance jwt_api_impl Hardcoded JWT Secret Elevation of Privilege Hardcoded credentials Security code review JWT Privilege escalation Cisco - Bug Bounty2022-11-142023-06-13
548Exploiting Hardcoded Keys to achieve RCE in Yellowfin BI RCE Authentication bypass Security code review JWT Yellowfin BI Maxwell Garrett (@TheGrandPew) Bug Bounty2023-01-242023-06-13
499Authentication Bypass in Izanami Docker image 1.10.22 CVE-2023-22495 Authentication bypass JWT Security code review Container security Izanami Raphaël Lob Bug Bounty2023-02-032023-06-13
458Hacking our way into internal DBs with hardcoded authentication keys JWT SSO Authentication bypass Security misconfiguration NA Ophion Security (@OphionSecurity) Bug Bounty2023-02-132023-06-13