BUG BOUNTY REPORTS ARCHIVE Critical Vulnerability Disclosures • Writeups • PoCs • Tools • Lessons Learned
ARCHIVE OVERVIEW: A curated collection of bug bounty reports and vulnerability disclosures from major platforms. Each includes the writeup, proof-of-concept code, remediation advice, and payout details. For educational purposes.| # | Platform | Vulnerability | Severity | Payout | Year |
| 1 | OAuth misconfiguration → account takeover | Critical | $15,000 | 2025 | |
| 2 | Meta | SSRF in image processing → internal network access | High | $8,000 | 2025 |
| 3 | Apple | RCE via malicious .dmg parser (macOS) | Critical | $25,000 | 2024 |
| 4 | Microsoft | IDOR in Azure DevOps → cross-org data access | Critical | $20,000 | 2025 |
| 5 | Cloudflare | WAF bypass via unicode normalization | Medium | $2,500 | 2024 |
| 6 | Twitch | Server-side prototype pollution → code execution | Critical | $12,000 | 2025 |
| 7 | Shopify | GraphQL introspection → data leak | High | $5,000 | 2026 |
| 8 | Discord | CDN cache poisoning → universal XSS | High | $7,500 | 2024 |
| 9 | GitHub | Actions misconfiguration → supply chain attack | Critical | $18,000 | 2025 |
| 10 | Brave Browser | Tor bypass via DNS leak | High | $3,000 | 2024 |
| 11 | Redis (OSS) | Stack buffer overflow in RESP parser | Critical | $10,000 | 2025 |
| 12 | Cloudflare R2 | S3-compatible auth bypass | Critical | $15,000 | 2026 |
| 13 | Element/Matrix | End-to-end encryption downgrade | High | $6,000 | 2025 |
| 14 | Slack | Workspace token leak via referrer header | Medium | $2,000 | 2024 |
| 15 | WordPress (Woo) | SQLi in order processing | Critical | $8,500 | 2026 |
DETAILED REPORT #1 — Google OAuth ATO
Code:
Platform: Google (accounts.google.com)
Vulnerability: OAuth state parameter reuse → Account takeover
Severity: Critical (CVSS 9.3)
Payout: $15,000
Discovered: March 2025
Researcher: anon (identity protected)
Summary:
The OAuth flow for Google Sign-In in a third-party application reused the same "state" parameter across multiple authentication attempts. An attacker could intercept the OAuth callback, replay the state token, and bind a different Google account to the victim's session.
Steps to Reproduce:
1. Victim initiates Google Sign-In on target.com
2. Attacker intercepts the redirect URL (includes state parameter)
3. Attacker completes their OWN OAuth flow with Google using the victim's state parameter
4. Google redirects to target.com/callback?state=VICTIM_STATE&code=ATTACKER_CODE
5. target.com validates the (reused) state parameter
6. target.com binds the attacker's Google account to the victim's session
7. Attacker now has access to victim's account (email changed, password reset)
Root Cause:
The third-party application generated the state parameter once per session and never invalidated it after use. The OAuth RFC mandates state parameters should be single-use.
Impact:
Full account takeover on any application using this vulnerable implementation
Affected: 50+ applications using the same OAuth library (unpatched at time of disclosure)
Fix:
- Generate unique, single-use state parameters
- Invalidate state after first callback
- Bind state to user's session ID
- Implement nonce checking on the server side
Timeline:
- Mar 10: Reported to Google VRP
- Mar 11: Triaged by Google security
- Mar 15: Google contacted affected third-party apps
- Mar 20: Google released security advisory
- Mar 25: $15,000 bounty paid
Key takeaway:
OAuth implementations must treat the state parameter as a cryptographic nonce — single-use, session-bound, with expiration. Most ATO bugs come from state reuse, not from crypto breaks.DETAILED REPORT #5 — Cloudflare WAF Bypass
Code:
Platform: Cloudflare (WAF/Web Application Firewall)
Vulnerability: WAF bypass via unicode normalization differences
Severity: Medium (CVSS 5.8)
Payout: $2,500
Discovered: November 2024
Researcher: WafBypass_RS
Summary:
Cloudflare's WAF normalizes incoming requests using ICU (International Components for Unicode) rules, but the backend server used a different normalization library. This discrepancy allowed bypassing WAF rules by encoding payloads in unicode forms that Cloudflare saw as benign but the backend decoded as malicious.
Specific technique: UTF-8 overlong sequences + UTF-16 surrogate injection
Example bypass:
Original SQL: ' OR 1=1 --
Encoded: '%C0%AE%EF%BF%BD%EF%BF%BDOR%EF%BF%BD1=1%EF%BF%BD--%C0%AE
Cloudflare sees:
'%C0.AE...OR...1=1...--.AE (benign, no SQL pattern match)
Backend (Nginx + PHP) decodes:
'. OR 1=1 --. (SQL injection)
Why it worked:
- Cloudflare's ICU rejected overlong sequences as invalid → passed through unmodified
- PHP's urldecode accepted overlong sequences → decoded to valid ASCII
- The normalization difference created a blind spot
Fix implemented:
- Cloudflare updated normalization to match PHP/Python decoding behavior
- Added strict rejection of overlong UTF-8 sequences
- Backend should also reject malformed encoding at application level
Tools used:
- Burp Suite + custom unicode fuzzing extension
- Custom Python script: fuzz_waf_bypass.py (included in attachments)
- Wordlist: 500,000 unicode variations of common SQL payloads
Key takeaway:
WAF/backend decoding mismatch is the most common bypass class. Always test with encoding variations — different libraries handle edge cases differently.TOOLKIT & TEMPLATES
Code:
Included in the archive:
- Bug bounty report templates (Markdown, PDF)
- POC template for critical vulnerabilities
- Fuzzing wordlists for common bypasses
- Recon automation scripts (subfinder, httpx, nuclei automation)
- BurpSuite project files for each report
- Video PoCs for report #1, #3, #6, #9
- Responsible disclosure timeline template
- PGP key setup for secure communication
This archive: https://mega.nz/file/BlackSec_BugBountyArchive_2026
Password: BugBountyBlackSec2026