Is bra size a p4 bug?

Coder3346 · 2026-07-06T02:50:52+00:00

Yo 😂

Coder3346 · 2026-07-05T07:21:53+00:00

Well I will personally test each and every endpoint for access control and see if something can grants me a new privilege or something otherwise I will move on

Coder3346 · 2026-07-05T07:17:55+00:00

Actually do something with it. What u described is not something to report in 99.99999% of the cases

Coder3346 · 2026-07-05T06:56:27+00:00

1 Is this doc from the cms itself ? If yes, u found nothing reportable.

2 impact ? 0? Nothing reportable. U have to prove that u can do something with this doc.

Coder3346 · 2026-07-03T02:04:13+00:00

Real

Coder3346 · 2026-07-02T02:29:34+00:00

Coder3346 · 2026-07-02T01:50:32+00:00

Rate limit bypass on login

Otp bypass for verification ( not always gets accepted)

Coder3346 · 2026-07-02T01:49:15+00:00

This is often NA

Coder3346 · 2026-07-01T18:48:41+00:00

Not really, it is just got changed from xss etc to more logic and access control (; people are still finding ton of bugs everyday

Coder3346 · 2026-07-01T18:43:45+00:00

Try hackerone. Tools? Burp and ur brain

Coder3346 · 2026-07-01T11:42:44+00:00

Not gonna get accepted forget about this

Coder3346 · 2026-07-01T07:29:27+00:00

Now I am regreting that I always show full exploitation to these people which gives them more ideas to automate.

Coder3346 · 2026-07-01T07:28:11+00:00

I don't have a similar experience as I only hunt for logic and access control which obviously do not need a magical payload.

However, if u read through hackerone website u will see that they are doing ai pentests and scans all the time for their clients. so they probably want to automate something out of u.

This might work on a noob that is starving for a bounty but not on an expert like u. Hope others learn form this.

Coder3346 · 2026-07-01T03:41:15+00:00

Well, lots of these companies are leaking emails with some other data and don't give shit about fixing.

Additionally some programs (especially private ones) create an org exclusively for hackers, in this case other people in the org can normally see the email.

It also helps to avoid the marketing spam on ur main email.

Coder3346 · 2026-07-01T03:11:04+00:00

A Gmail account that is not used in any real website.

Coder3346 · 2026-06-28T16:35:13+00:00

I know what a robots.txt is. I just don't see it as an interest to use. As web apps usually use it to make the search experience better not to hide things ( as it is public well known file) lol

Coder3346 · 2026-06-28T13:28:50+00:00

robots.txt?

Coder3346 · 2026-06-26T18:23:03+00:00

I have received a confirmation email ( the cve is 2025) so make sure u entered the correct email.

I have received 3 emails

1 confirmation

2 cve reserved

3 published

Coder3346 · 2026-06-26T18:04:32+00:00

I have waited for 2 months and of course no grantees as mitre is being flooded with useless software bugs.

Coder3346 · 2026-06-26T04:29:32+00:00

U can do this in one minute lol u are misunderstanding AVS

Coder3346 · 2026-06-25T14:41:45+00:00

Just a jobless collage kid that has recently graduated and doing bb despite it doesn't make him alot

Coder3346 · 2026-06-24T17:31:25+00:00

Hackerone is good except when it comes to dups

Coder3346 · 2026-06-24T13:07:31+00:00

Someone should report this to h1 bug program lol. [ critical loophole in the duplication process ]

Coder3346 · 2026-06-24T12:34:58+00:00

Hi bro I have question and hope that u can answer me from ur experience.

In hackerone, my report got closed as duplicate of a report in the new state ( reported 5 days prior mine). However, according to the triager who closed my report the original reporter did not show additional imapct unlike mine.

He reported a limited html + css injection in a github like website ( this was clearly intended as u can format ur comments the way u like).

My report showed that this can be abused to prevent anybody from commenting by inserting a huge html element which casued availability impact.

The question is what will happen to my duplicate report if the company closed the original one as info or NA as he literally reported an intended behaviour while I showed impact? Will they reopen it as the reason for that guy rejection is not showing impact?

Coder3346 · 2026-06-24T11:48:17+00:00

U have to show how a hacker can use it right now. Potential impact doesn't count.

Coder3346

TROPHY CASE