vict0ni

With my invitation to renniepak's HackerHideout, I got the chance to re-live the bug bounty/hunting thrill that I hadn't felt for some time. I haven't bug hunted for quite a while, so I decided to write a small post about two recent findings that could lead to an account

Since October 2023, I've discovered more than 10M PII of people and helped many companies worldwide secure sensitive information. The companies range from e-shops and hospitals to human resource consulting agencies. They all had one catastrophic thing in common: misconfigured Elasticsearch hosts. Elasticsearch is a storage and search engine for

Article written by Jagmeet Singh for TechCrunch after my finding report about a bug in Rajasthan's portal that allowed access to Janaadhaar's applicants' documents.

Article written by Matt Burgess for WIRED after my finding about the leaks of a Bangladeshi SIGINT agency.

Article written by Zack Whittaker for TechCrunch after my finding report of more than 2 million citizen IDs leaking from a Chinese e-commerce store.

This is the first article of the series. It's a pretty cool bug, in my opinion, with a little twist at the end. As we progress, there will be more high- (and low-) profile exposures and issues. Lately, I've given a lot of focus on APIs. I've been researching ways

Article written by Lorenzo Franceschi-Bicchierai for TechCrunch after my finding report of more than 50 million citizen records leaking from a governmental Bangladeshi system.

Around October 2020, I was pretty active in the bug hunting community. And of course, I was hunting too, as a form of training and learning process. Around that time, my friend @pry0cc made a utility named ipi As explained in the README file, this utility was based on the

In another bug bounty session of mine, I came across a bounty program of a “Contract Review” company. In their web app, one could register with a first/last name, an email and their company’s name (and a password ofc)...