writeups.xyz writeups.xyz

InfoSec and Bug Bounty Writeups Directory.

This Website is a collection of Information Security and Bug Bounty writeups that allows you to easily filter writeups by vulnerabilities, programs, authors, and more, making your research and exploration of security issues simpler and more efficient.

Important Note: Please remember that the inclusion of a program or target in this directory does not imply permission to conduct any hacking activities. Always review and adhere to the specific policies of each program before taking any action.

Title Vulnerabilities Programs Authors
Multi-sandwich attack with MongoDB Object ID or the scenario for real-time monitoring of web application invitations: a new use case for the sandwich attack
Windows Installer, Exploiting Custom Actions
Bypassing Account Suspension Using Anonymous Posting | Facebook Bug Bounty
GitHub Actions Exploitation: Self Hosted Runners
SAPwned: SAP AI vulnerabilities expose customers’ cloud environments and private AI artifacts
Unveiling TE.0 HTTP Request Smuggling: Discovering a Critical Vulnerability in Thousands of Google Cloud Websites
Identity Crisis: The Curious Case of a Delinea Local Privilege Escalation Vulnerability
SSD Advisory – XenForo RCE Via CSRF
Type confusion attacks in ProseMirror editors
Encoding Differentials: Why Charset Matters
How to Bypass Golang SSL Verification
Unauthenticated SSRF on Havoc C2 teamserver via spoofed demon agent
Firmware Security: Alcatel-Lucent ALE-DeskPhone
Hacking a Secure Industrial Remote Access Gateway
SSD Advisory – SonicWall SMA100 Stored XSS To RCE
A Race to the Bottom - Database Transactions Undermining Your AppSec
Bidding Like a Billionaire - Stealing NFTs With 4-Char CSTIs
Chaining Three Bugs to Access All Your ServiceNow Data
Dynamics 365 Business Central - A Journey With Ups and Downs
Evernote RCE: From PDF.js font-injection to All-platform Electron exposed ipcRenderer with listened BrokerBridge Remote-Code Execution
GitHub Actions Exploitation: Repo Jacking And Environment Manipulation
Bypassing ACLs – IDOR exploitation via HPP
CVE-2024-29511 – Abusing Ghostscript’s OCR device
Fickle PDFs: exploiting browser rendering discrepancies
Intigriti XSS Challenge July 2024 — Finding a new DOMPurify bug