thexssrat.medium.com resources

thexssrat.medium.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-11-10.

Bug Bounty 4 AuthN 3 JWT 3 IDOR 2 AuthZ 1

Date Added	Resource	Excerpt
2026-11-10 2026	The Forgot-Password Flow Is Where I Take Over Accounts: My Password-Reset Attack Chain AuthN Bug Bounty	This article details a password-reset attack chain discovered by a security researcher. The researcher exploited vulnerabilities within a website's "forgot password" functionality to gain unauthorized access to user accounts. The attack chain, described as a method for account takeover, highlights critical security weaknesses in how password recovery mechanisms are implemented. This type of vulnerability can allow attackers to effectively hijack user accounts by manipulating the password reset process.
2026-11-08 2026	The Five-Check JWT Chain: how I break token auth before business logic AuthN Bug Bounty JWT	This article details a five-step methodology for exploiting JSON Web Token (JWT) authentication vulnerabilities. The author explains how to bypass token validation by chaining together common weaknesses in JWT implementation, effectively compromising authentication before reaching the application's business logic. This approach highlights critical security oversights in how JWTs are handled, enabling attackers to gain unauthorized access by manipulating token components. The content focuses on practical, repeatable techniques for identifying and exploiting these flaws.
2026-11-07 2026	The Five-Check JWT Chain: How I Break Token Auth Before I Touch the Business Logic JWT	This content outlines a five-step process for finding vulnerabilities in JSON Web Token (JWT) authentication before delving into business logic. The author emphasizes that most JWT bugs are discovered within the initial three checks and details their specific order for exploitation. The aim is to exploit weaknesses in token authentication early in the testing process.
2026-11-06 2026	The Five-Check JWT Chain for breaking token auth AuthN Bug Bounty JWT	This content likely discusses a security vulnerability related to JSON Web Tokens (JWTs). The "Five-Check JWT Chain" suggests a method or exploit that involves a sequence of five checks to compromise token authentication. This could involve exploiting weaknesses in how JWTs are processed or validated, potentially allowing attackers to bypass authentication mechanisms. The specific details of the exploit and its implications for token security would be elaborated within the full content.
2026-11-04 2026	The Three-Request IDOR Method: How I Find Broken Access Control Before Breakfast AuthZ IDOR	The "Three-Request IDOR Method" is a technique for discovering broken access control vulnerabilities. This approach involves sending three carefully crafted requests to identify flaws where a user can access data or perform actions intended for another user. The method focuses on exploiting insecure direct object references (IDORs) by manipulating identifiers across these requests. The author claims this process is efficient, allowing for quick identification of such vulnerabilities.
2026-04-22 2026	Hunting for IDOR and BAC in B2B Apps with Burp Authorize IDOR	Hunting for IDOR and BAC in B2B Apps with Burp Authorize
2021-04-13 2021	Analysing JavaScript Files For Bug Bounty Hunters \| by Thexssrat \| Apr, 202 Bug Bounty	The content discusses the importance of analyzing JavaScript files for bug bounty hunters. It raises the question "What is JS even?" implying a deeper exploration into the significance of JavaScript in bug hunting activities. The article likely delves into the role of JavaScript in identifying vulnerabilities, understanding its impact on web security, and providing insights for bug bounty hunters on how to effectively analyze JavaScript files to uncover potential bugs and security flaws.