https://blog.hks.ec/tags/bugbounty/ Recent content in bugbounty on Hakisec Hugo -- gohugo.io en-US Thu, 09 Oct 2025 00:00:00 +0000 https://blog.hks.ec/posts/first-time-on-remoteapp/ Thu, 09 Oct 2025 00:00:00 +0000 https://blog.hks.ec/posts/first-time-on-remoteapp/ Hello There :) I know many of you like having creative things to read and to try to recreate ! Knowing that, i decided to show a vulnerability you don’t see very often :) Poking around This time, i was working on a RemoteApp and you should know i’m really not familiar with this kind of thing at all, having never had the opportunity to play with it before. Many people prefer to walk away when they see something like this https://blog.hks.ec/posts/playing-with-internal-path-traversal-leads-to-lot-of-fun/ Mon, 01 Sep 2025 00:00:00 +0000 https://blog.hks.ec/posts/playing-with-internal-path-traversal-leads-to-lot-of-fun/ Hello There :) It’s been a while since my last post, sorry for that. To make up for it, i will talk about a pretty cool vulnerability i found ! I hope you will like it and it will give you nice ideas for the future vulns you will find :) Appetizer Well, this story is about a vulnerability i found when enjoying time with friends ! There was a company who paid us a trip to their HQ, speaking about our experiences and stuff. https://blog.hks.ec/posts/ip-spoofing-ftw/ Thu, 21 Sep 2023 00:00:00 +0000 https://blog.hks.ec/posts/ip-spoofing-ftw/ Starting from the bottom Today, i will talk about a really huge company with millions of accounts and millions peoples going there every day ! At the beginning, the website was looking secure, the most annoying part was that they were using Datadome. On my FFUF, i often use my own “config” (Exotics User-Agent, special headers, …) and, when i launched it, i discovered that it wasn’t blocked by Datadome and, also, that it have access to extra files i didn’t have access to (403 Forbidden). https://blog.hks.ec/posts/directory-listing-to-rce/ Thu, 14 Sep 2023 00:00:00 +0000 https://blog.hks.ec/posts/directory-listing-to-rce/ Directory Listing to RCE (?!) Hello World :) Here is a little Write-Up i decided to do. It’s on a vulnerability i discovered not long ago on BugBounty, i hope you will like it ! Starting from the bottom I started by looking at a website who was not looking really big and, after looking passively (following links, digging JS files, …) i didn’t found anything really interesting on it.