Walk-throughs of real bugs from live bug bounty hunts
2026-06
From a Sequential ID to a Stranger’s eSIM: An Unauthenticated IDOR Walk-ThroughA field note on an unauthenticated IDOR in a mobile provisioning inventory API: a sequential-key lookup and a QR-code endpoint that, chained, returned GSMA eSIM activation credentials (LPA strings) for SIMs provisioned to other people. On recognising that a 200-with-a-PNG decoded to a provisioning secret, scoping impact as credential-sensitivity × population scale, and the reasoning that kept it an honest High rather than an overclaimed Critical.
2026-05
From a Free Account to Every Advertiser’s Address: A Broken Access Control Walk-ThroughA field note on a missing authorization check in a self-serve advertising platform: an unscoped paginated listing that returned the full platform-wide advertiser directory — names, street addresses, and internal identifiers for 1,440+ advertisers — to any registered account, including unapproved ones. On reading “this is private” from a 302-to-login, sampling 72 pages of cross-user PII without harvesting it, and the dirty-data clues (a personal email in a postcode field) that proved the records were genuinely private.
2026-05
From Unauthenticated Upload to Root: A Path-Traversal Walk-ThroughA field note on a single-request unauthenticated path-traversal-to-root chain on a Python web application: the multipart filename footgun in os.path.join, an HTTP 500 used as the file-write confirmation oracle, and the runtime-environment choices (web user with a real home directory, passwordless sudo, debug mode on) that turned a contained file-write bug into a twelve-minute root shell.