SUMMARY.md

Table of contents

• HowToHunt.md

Account Takeover Methodology

• Chaining Low Impact Bugs with Xss
• No Rate Limit On Login with Weak Password Policy
• Password Reset Poisoning Leads To Token Theft
• Using Auth Bypass
• Using CSRF
• Using Sensitive Data Exposure
• Token Leaks In Response

Application Level DoS

• Email Bounce Issues
• Long Password DoS
• Long String DOS

Authentication Bypass

• 2FA Bypasses
• OTP Bypass By Repeating Requests
• OTP Bypass Via Response Manipulation

Broken-Link Hijacking

• Broken-Link Hijacking

Broken Auth And Session Management

• Session Based Bugs

Bypassing CSP

• CSP Bypass

CMS

• Wordpress

CORS

• CORS
• [CORS Bypasses](./CORS/CORS Bypasses.md)

CSRF

• CSRF
• [CSRF Bypass](./CSRF/Cross Site Request Forgery(CSRF) Bypass.md)

Finding CVEs

• CVES

Check List