Writeup - Easy 130$ Bounty: User to Admin
Like all bug hunters I always hunting. When I was watching youtube or movie my terminal is fuzzing. If I search anything on the internet and if there is a website acting differently, this will add one plus hour to my night shift :). And that night I saw a movie review site then immediately started to check key functions of site like register, login, logout, update profile etc. As you can imagine its very fast process because you expect nothing than a little hint. But this time was different, it was too fast too easy and too good. There is a 3 easy step for this bug and I believe everyone here can execute it but maybe you guys believe that this kinda of bugs are not seen in real life. ( I was thinking same as you until I find this). Lets step up and start. 1- Register and Login Press enter or click to view image in full size This is a normal register request with 3 fields (username,email and password) but host subdomain was api. After successful registration I logged in. And Login...
