Writeup

Everything here happened inside bug bounty programs, in scope and with permission. I reviewed every finding and submitted it by hand. Third-party data is redacted, and the examples were disclosed before publication. For the past few months, I have been testing whether AI can handle the repetitive parts of bug bounty hunting without deciding on its own that a bug is real. Mapping sites, reading JavaScript, comparing requests and revisiting old leads takes time, so I wanted a helper that could keep doing that work and bring me only what deserved a closer look. ...

Reported through the bank’s bug bounty program, triaged as critical, marked valid and rewarded. Every name, host and package in this post is a placeholder, so the commands here won’t reproduce against the real target. I never sent a payload to the bank. I uploaded a file to a public website, went to make coffee, and by the time I came back I had code execution on their build server, root on production containers in three different clouds, and a shell on some poor developer’s Windows laptop. ...

All issues were responsibly reported to eToro through Bugcrowd and have been acknowledged. Hi, I’m back. This time I wandered somewhere I hadn’t planned to go. I wasn’t hunting for AI bugs at all. I was poking at eToro’s trading platform, the usual stuff, IDOR on portfolio endpoints, parameter tampering, when a little chat bubble caught my eye down in the corner. Torii, eToro’s AI assistant. Ask it about your portfolio, your balances, the market, and it just answers. ...

Disclaimer This blog post is shared for educational and academic purposes only. All issues described here were responsibly reported to the affected company and have since been verified. The intention of this write-up is to raise awareness, improve security practices, and share lessons learned with the community. Since I was back in Korea and looking for my next role, I decided to spend this month fully focused on bug bounties again. It’s always a mix of frustration and small breakthroughs. One of the simple but surprisingly interesting bugs I uncovered was this cross-domain redirect flaw in a bank’s core application. ...

Disclaimer This blog post is shared for educational and academic purposes only. All issues described here were responsibly reported to the affected company and have since been fixed and verified. Permission to publish was granted by the company. The intention of this write-up is to raise awareness, improve security practices, and share lessons learned with the community. Act I — The Setup It all started on a lazy evening in April. I wasn’t trying to hack anything major, just poking around a movie ticketing site which I’m client of with DevTools open. As I added a ticket to my cart, something odd caught my eye: a POST request carrying a mysterious parameter named encInfo. ...