Skip to content

appsecwriteups.com

Learning AppSec Through Android & Web Vulnerability Writeups

  • Home
  • 🧑‍💻 Courses
  • Android
  • Web
  • Desktop
  • Shielded
  • Home
  • 🧑‍💻 Courses
  • Android
  • Web
  • Desktop
  • Shielded
Top Writeup
How I Discovered a Critical Vulnerability via Hardcoded GCP Credentials in an Android App and Earned $700 Bounty on Cyberbay
Posted inAndroid

How I Discovered a Critical Vulnerability via Hardcoded GCP Credentials in an Android App and Earned $700 Bounty on Cyberbay

Posted by By Jivan Magare May 17, 2025
Hello aspiring bug bounty hunters! I’m Jivan, and I’m back with another security vulnerability that…
Read More
How I Discovered an HTML Injection Vulnerability in the Origin Query Parameter of a Password Reset Email and Earned a $75 Bounty
Posted inWeb

How I Discovered an HTML Injection Vulnerability in the Origin Query Parameter of a Password Reset Email and Earned a $75 Bounty

Posted by By Jivan Magare May 11, 2025
Hello guys, I’m Jivan, and I’m back with a new write-up where I discovered an…
Read More
How I Found a No Rate Limit Vulnerability on a Login Endpoint, Earned a 100€ Bounty, and My Approach to Testing for No Rate Limit Issues
Posted inWeb

How I Found a No Rate Limit Vulnerability on a Login Endpoint, Earned a 100€ Bounty, and My Approach to Testing for No Rate Limit Issues

Posted by By Jivan Magare May 10, 2025
Hi friends, I’m Jivan, back with another write-up related to a No Rate Limit vulnerability.In…
Read More
How I Discovered a High-Severity IDOR Vulnerability in an Android Hotel Booking App and Earned a $80 Bounty
Posted inAndroid

How I Discovered a High-Severity IDOR Vulnerability in an Android Hotel Booking App and Earned a $80 Bounty

Posted by By Jivan Magare May 9, 2025
Hi everyone, Jivan here!I'm back with another Android vulnerability report. In this write-up, I’ll walk…
Read More
How I Found an OTP Bypass Vulnerability in an Android App and Was Rewarded 150€ Euros as a Bounty
Posted inAndroid

How I Found an OTP Bypass Vulnerability in an Android App and Was Rewarded 150€ Euros as a Bounty

Posted by By Jivan Magare May 9, 2025
Welcome to my very first bug bounty write-up! Hi, I'm Jivan — a passionate self-taught…
Read More

Posts pagination

Previous page 1 2

Archives

  • September 2026
  • January 2026
  • October 2025
  • August 2025
  • July 2025
  • June 2025
  • May 2025

Recent Comments

  1. Jivan Magare on Protected: My First Day Pentesting Thick‑Client Apps — Discovered a Critical IDOR in a Desktop Client with a Full Black‑Box Approach
  2. Shubham on Protected: My First Day Pentesting Thick‑Client Apps — Discovered a Critical IDOR in a Desktop Client with a Full Black‑Box Approach
  3. Jivan Magare on How I Found a No Rate Limit Vulnerability on a Login Endpoint, Earned a 100€ Bounty, and My Approach to Testing for No Rate Limit Issues
  4. Shubham on How I Found a No Rate Limit Vulnerability on a Login Endpoint, Earned a 100€ Bounty, and My Approach to Testing for No Rate Limit Issues
  5. Jivan Magare on CSRF Account Deletion: How I Turned an “Excluded” Bug Into $87 USD Bounty

Recent Posts

  • Protected: My Application Security Pentesting Setup: Android, iOS, Web, API, Thick Client & Cloud Recon
  • Protected: How I Found Broken Access Control & How You Can Find It Too
  • Protected: Why a Critical-Looking Vulnerability Was Downgraded: Exposed SSH Credentials Explained
  • Protected: My First Day Pentesting Thick‑Client Apps — Discovered a Critical IDOR in a Desktop Client with a Full Black‑Box Approach
  • How I Found a Critical Privilege Escalation That Let an Unprivileged User Become Admin and Earn $579 USD Bounty

Categories

  • Android
  • Desktop
  • Web
Post You Might Like
Posted inAndroid Desktop Web
Protected: My Application Security Pentesting Setup: Android, iOS, Web, API, Thick Client & Cloud Recon
Posted by By Jivan Magare September 29, 2026
Posted inWeb
Protected: How I Found Broken Access Control & How You Can Find It Too
Posted by By Jivan Magare September 4, 2026
Posted inWeb
Protected: Why a Critical-Looking Vulnerability Was Downgraded: Exposed SSH Credentials Explained
Posted by By Jivan Magare January 15, 2026
Posted inDesktop
Protected: My First Day Pentesting Thick‑Client Apps — Discovered a Critical IDOR in a Desktop Client with a Full Black‑Box Approach
Posted by By Jivan Magare October 8, 2025

đź”—Follow Me

  • LinkedIn

đź’¬Contact Us

đź“© Have questions, suggestions, or found a security issue? Reach out to us at: contact@appsecwriteups.com

🛡️Privacy Policy

Privacy Policy

Copyright 2026 — appsecwriteups.com. All rights reserved. appsecwriteups.com
Scroll to Top