Writeups & Blogs
Browser Extensions
A Practical Catalog of Browser Extension Attack Scenarios
Identity Theft
How 60 Chrome Extensions Silently Stole the Identities of 1.1 Million Streaming Subscribers
GhostPoster
GhostPoster Never Dies: 100,000+ Users Affected With New Variant
Privilege Escalation
Privilege Escalation via Named Pipe Hijacking and WebSocket Auth Bypass
IDOR · $500
IDOR: Very Simple IDOR Resulted in $500 (2 bugs — total $600)
Auth Token IDOR
IDOR: Authentication Token & Video Metadata Manipulation
Auth Bypass
Bypass: Forgot Password Verification
GraphQL BAC