root@sparrow:~$ cd ~/bug-bounty/vulnerability-patterns && ls -la
bug-bounty/vulnerability-patterns
One family per write-up: the underlying pattern, where it hides, and how I go about detecting it. Methodology, not case studies.
Business Logic Abuse
No injection, no exploit — just doing the flow in an order, combination or value range the business rules never anticipated.
root access
view →
Cache Poisoning & Cache Deception
One poisoned response can hit every visitor to a URL; cache deception can leak one victim's private data to anyone who knows the trick.
root access
view →
GraphQL Misconfiguration
Introspection left wide open, and mutations that skip the checks their REST equivalents would have.
root access
view →
IDOR & Broken Access Control
Two sides of the same coin: reading someone else's data by changing an ID, or performing an action your role was never meant to allow.
root access
view →
OAuth & Authentication Flaws
Account takeover through broken password reset and session handling, and OAuth redirect_uri hijacking — the two roads to the same destination.
root access
view →
Open Redirect
Why 'it's just a redirect' undersells it, and the whitelist/Referer bypasses that make it worth reporting.
root access
view →
Path Traversal / LFI
Reading files the application never meant to expose, by manipulating a file path parameter.
root access
view →
SQL Injection
From a single quote that breaks a page to blind, time-based data exfiltration — how I confirm it's real before touching anything sensitive.
root access
view →
SSRF
Getting the server itself to fetch a URL you control — where it hides and how to prove it safely.
root access
view →
WAF Bypass
The underlying bug was never fixed — the WAF just learned to block the obvious version of the payload.
root access
view →
XSS
How I think about stored and reflected XSS — where it hides, how to confirm persistence, and what actually makes it worth reporting.
root access
view →