Bagas Gunardi

Hello folks, I will share my experience how I found the Github page takeover vulnerability. Because there are still many who are confused about how to exploit it, I will explain in detail. In this report I can’t tell the website because it’s a private program on Hackerone. The thing that has the potential to be a Github page we can takeover is when the page we access displays a 404 Github error status, as shown below. Github 404 Page The next step to verify if this can be takeover is to look at the CNAME...

Hello Folks, This is my first blog for sharing about bug bounty hunting. Here I’m hunting for private programs so I won’t leak the name of the program. Because I’m still learning how this website works. I explore it without Burp suite, so all I did was explore like an ordinary person opening a website, logging in to an account, uploading photos, viewing blogs on the website, etc. After bit exploring, I found the user account can connect to Facebook and LinkedIn. When I click it, it show the url like this...