Bug Bounty: Real-World Writeups

Vulnerability writeups and reporting templates from live operations

Real-World Security Disclosures

A curated collection of real-world bug bounty writeups. These reports detail the vulnerabilities discovered, step-by-step reproduction steps, technical impact, and lessons learned. All writeups have been published after responsible disclosure and with explicit permission.

Writeup Catalog

📄

Standard Writeup Template

Use this clean Markdown template to document, report, and disclose bugs professionally on HackerOne/Bugcrowd.

View Template →
⚡

RCE on target.com via Unvalidated File Upload

Critical (9.8) Leaking system access by bypassing filename extensions filter to execute an interactive web shell.

Read Report →
🔑

Full Account Takeover via IDOR in User Settings API

High (8.5) Exploiting predictable UUID formats inside target's JSON API endpoint to reset password parameters.

Read Report →
🌩ī¸

SSRF on PDF Generator leaking AWS IAM Credentials

Critical (9.1) Bypassing SSRF local filters using DNS rebinding attacks to read internal cloud metadata routes.

Read Report →
đŸŗ

Container Escape: User to Host Root — Full Chain

Critical Complete attack chain: www-data → Container Root (SUID find) → Host User (privileged mount) → Host Root (Docker group).

Container Escape CTF Privilege Escalation
Read Report →

🔗 Back to Hub