FIELD NOTES / RESEARCH
Real bugs, wrong turns, useful methodology, and the details that survived the report.
01OPEN ↗A real-world bug bounty story where a simple YouTube video sparked a successful Host Header Injection discovery - from mindset and testing to a $650 reward.
Read on Medium ↗
02OPEN ↗How a laid-back afternoon on NASA subdomains turned into an XSS finding and a place in NASA's Hall of Fame - including recon, payloads, and reporting lessons.
Read on Medium ↗
03OPEN ↗A Medium-severity finding at DCU that moved from Not Applicable to a successful reward, with the research methodology and reporting process behind it.
Read on Medium ↗The bug is useful. The reasoning that found it is reusable.