bug-bounty437
google355
xss346
microsoft282
facebook246
apple172
exploit163
rce160
malware102
account-takeover95
cve91
csrf83
writeup79
bragging-post79
browser77
privilege-escalation68
react60
authentication-bypass57
cloudflare54
dos53
node52
ssrf51
docker51
phishing49
aws48
access-control47
oauth45
smart-contract45
supply-chain44
ethereum43
defi42
web342
sql-injection41
lfi37
idor34
smart-contract-vulnerability32
web-application31
info-disclosure31
clickjacking31
race-condition31
reverse-engineering31
wordpress30
vulnerability-disclosure30
cloud29
information-disclosure28
burp-suite28
solidity27
web-security27
pentest26
ctf26
0
7/10
vulnerability
A CORS misconfiguration vulnerability where a website trusts all origins ending with a specific domain (e.g., evilredacted.com for redacted.com), allowing an attacker who registers a predomain wildcard subdomain to make authenticated requests and steal session credentials via JavaScript. The attacker registers a domain like kiraakredacted.com and crafts a malicious page that calls the /v1/user API endpoint with credentials enabled to extract user session IDs.
cors
cors-misconfiguration
wildcard-cors
origin-validation
subdomain-takeover
session-hijacking
account-takeover
access-control-bypass
bug-bounty
web-security
http-headers
Arbaz Hussain
HackerOne
PortSwigger
InfoSec Write-ups