We’ve learned a lot about CISOs’ priorities and challenges based on conversations with customers and the ‘hacktivity’ of our Bug Bounty platform.

As we celebrate our 10th anniversary, we’ve decided to share what we’ve observed in interviews with customers and hunters, along with tens of thousands of vulnerability reports they’ve resolved over the past 12 months.

Downloadable with a single click, our first-ever annual review of Bug Bounty trends is aimed at both hunters and security teams.

The drivers behind growing adoption of crowdsourced security testing worldwide

What 2024’s Bug Bounty stats – such as the most common CWEs and highest payouts – tell us about vulnerability trends and the Bug Bounty model

Interviews with our heads of triage and customer success management teams

Final leaderboards for 2024 and hacking advice from some of our highest performers – including our all-time #1 hunter

A recap of a record year for YesWeHack live hacking events

And the merits and challenges of leveraging Bug Bounty to secure open source

 without needing to enter your email or any other personal details.

The YesWeHack Bug Bounty Report 2025

Endpoint and parameter discovery are critical first steps in the Bug Bounty reconnaissance process. The real value lies in uncovering hidden endpoints, undocumented parameters and overlooked paths that expand the target’s attack surface. 

This guide will teach you practical techniques like parameter fuzzing, forced browsing, and path/parameter discovery, as well as how to use targeted wordlists, parse files and analyse JavaScript in order to find entry points for more rewarding vulnerability hunts.

Initiating reconnaissance: building your baseline

The first step in uncovering hidden endpoints and parameters is to establish a baseline understanding of your target’s exposed surface. Start by configuring Burp Suite for a manual crawl: enable the proxy to capture all traffic, and ensure JavaScript and CSS files are not blocked. Once this manual pass gives you a feel for the application’s structure, complement your findings with an automated Burp crawl. 

Scrape the robots.txt and sitemap.xml files for overlooked paths and use Google dorks. Also check out a related article we published recently, 

, to further enhance your parameter discovery process.

You’ll already start to have a clear, comprehensive view of your target.

Why JavaScript files are key for asset discovery

Modern web applications use JavaScript to manage user interactions, fetch data and shape site functionality. As a result, JavaScript files often hold critical insights that are neither visible in HTML nor easily guessable. For example, you may find references to specific API endpoints that a regular user would be unable to access through conventional means. Additionally, parameters that control feature flags or access testing endpoints might appear as variable names, function arguments or URL fragments inside these scripts.

Examining JavaScript source code helps you find undocumented APIs or parameters and understand how endpoints work. This context can enable more strategic testing – revealing which parameters are worth fuzzing, which routes are likely to handle sensitive data, and where misconfigurations might exist.

The following tools are invaluable for analysing JavaScript:

Using LinkFinder to find hidden endpoints and parameters

 is a Python-based tool that crawls JavaScript files and extracts URLs, paths and parameters that could otherwise remain unnoticed. Running LinkFinder is straightforward:

This command scans the specified JavaScript file and outputs a list of discovered endpoints directly in your terminal. You can then integrate these findings into your fuzzing tools, add them to your wordlists or explore them manually in Burp Suite.

JavaScript bookmarklets: handy, quick recon tools

For fast, on-the-fly endpoint discovery, JavaScript bookmarklets provide a lightweight, browser-native solution. A bookmarklet is simply a snippet of JavaScript code saved as a browser bookmark. When clicked on any webpage, it immediately runs within the browser and extracts valuable information – such as hidden endpoints – without requiring external tools or switching contexts.

This approach is particularly useful when you’re already exploring a target application and want to quickly expand your understanding of its attack surface. Instead of pausing to set up additional scripts or tools, you can instantly run a bookmarklet to uncover new paths or parameters as you navigate.

Here’s a great bookmarklet for extracting endpoints from JavaScript created by 

Add a new bookmark in your browser’s toolbar

Replace the bookmark’s URL with the JavaScript code snippet

Visit the target page and click the bookmarklet. The script will run in your browser, revealing previously undiscovered endpoints right on the page.

By incorporating bookmarklets into your reconnaissance toolkit, you can seamlessly integrate endpoint discovery into your browsing experience.

Burp Suite extensions for JavaScript analysis

While standalone tools and bookmarklets are powerful, integrating JavaScript analysis directly into your primary testing environment can streamline your workflow. By adding dedicated Burp Suite extensions, you can automatically detect hidden endpoints and parameters as you proxy requests through Burp, keeping all your reconnaissance data in one place.

 is a popular Burp extension that parses JavaScript files intercepted by Burp. It identifies and reports parameters and endpoints directly in your Burp dashboard.

burp extension, meanwhile, specialises in parsing JavaScript for interesting endpoints and values. GAP can highlight unusual behaviour or sensitive variables within the code.

 offers a comprehensive approach to JavaScript analysis, revealing endpoints, parameters and potential vulnerabilities.

Fuzzing involves systematically sending varied, often unexpected inputs – such as paths, parameters or HTTP headers – to an application’s endpoints. Unlike conventional scanners that stick to known routes and values, fuzzing deliberately explores the unknown. By experimenting with large sets of inputs, you can trigger edge cases, uncover functionality never intended for public use, and reveal subtle weaknesses in the application’s logic.

One form of fuzzing, forced browsing, discovers hidden directories, backup files and development endpoints that developers never intended to expose. While forced browsing targets the structure of an application’s environment, fuzzing can apply the same testing principles to parameters, headers and more complex areas of the application.

In the context of Bug Bounty reconnaissance, fuzzing isn’t simply guesswork. It involves leveraging well-crafted wordlists, selecting the right tools (such as ffuf or dirb), and using structured approaches offered by platforms such as Burp Intruder. This informed methodology ensures efficiency and precision, broadening your search for hidden directories, parameters and routes that could lead straight to overlooked vulnerabilities.

probing unlisted directories, files or endpoints to reveal backups, test areas or deprecated components.

 By testing for undocumented or unexpected parameters in application requests, researchers can uncover weaknesses in how applications handle input. Parameter fuzzing serves two key purposes: discovering new parameters that the application processes, such as hidden or undocumented GET and POST parameters, and exploring the potential values of these parameters to identify vulnerabilities like injection attacks, logic bypasses or insecure data handling. This dual approach makes parameter fuzzing a versatile and powerful technique in bug bounty reconnaissance.

Tweaking HTTP headers to discover server misconfigurations, debugging information or services running behind the scenes. This provides intelligence that can shape your subsequent attack strategies.

Why Is fuzzing crucial for asset discovery?

Fuzzing significantly expands the scope of your reconnaissance. Instead of limiting yourself to known pages or documented endpoints discovered previously, you cast a wider net over the target’s infrastructure, looking for anything that responds in an unexpected way. This broader perspective increases your chances of uncovering meaningful, hitherto undiscovered bugs. More specifically, fuzzing enables you to:

: Many web applications and APIs contain paths not linked in the user interface – like old admin panels, forgotten test endpoints or development scripts. Fuzzing systematically tests for these, catching assets that would be invisible through traditional navigation.

Identify misconfigurations or access control issues

: Sometimes, unexpected responses like HTTP status codes (eg, a 200 OK on a directory that should be restricted) signal a configuration slip-up. Fuzzing makes spotting these anomalies straightforward.

Automate the exploration of application behaviour

: Checking each path or parameter by hand is impossible. Fuzzing tools let you run through extensive wordlists and payload sets automatically. This accelerates your workflow, ensuring you don’t miss critical targets that might yield valuable information.

Gain a deeper understanding of how the target application functions

: By watching how the app reacts to unfamiliar input, you gain insights into its underlying logic, error-handling routines and fallback mechanisms. These findings can guide more targeted attacks later, making your overall testing strategy smarter and more efficient.

With fuzzing, you’re doing more than just ‘poking around’ in a scattergun fashion. You’re methodically mapping the application’s structure to expand and understand its potential attack surface. Done properly, this process significantly increases your chances of discovering impactful vulnerabilities that could earn you juicy bounties.

: Start with endpoints you’ve already discovered through manual crawling, JavaScript analysis and forced browsing. Make a list of these URLs and note any parameters or query strings that might be worth exploring. Having a well-defined baseline ensures you focus on meaningful targets rather than blindly testing the entire application.

: Even well-protected applications sometimes rely on predictable naming conventions, leftover backup files or default directories that developers assume won’t be found. Taking advantage of these assumptions, forced browsing involves systematically guessing file paths, directories and extensions to access hidden or restricted resources. Rather than relying solely on automated tools with arbitrary wordlists, you can apply informed intuition – trying out common paths like /admin, testing for backup files by appending 

: After you’ve identified core files – like 

– consider probing for backup versions. For example, try appending common backup extensions or variations:

Sometimes these leftover files contain sensitive data, such as database credentials, API keys or configuration details. Combine this approach with your previous discovery methods: if JavaScript hinted at a config directory, test variations like 

Exploring common administrative or juicy directories

: Administrative panels or promising directories are frequently stored under predictable paths. Test common directory names such as:

If you know the target uses a particular technology (eg, WordPress), also try platform-specific directories like 

 Discovering these panels can reveal areas with weaker authentication checks or outdated management tools. Once found, you can inspect these endpoints for logic flaws, insecure defaults or old testing interfaces that developers never removed.

Wordlists: your irreplaceable tools for effective recon

Wordlists guide your fuzzing by providing inputs to test against endpoints and parameters. Using the right wordlist will be a game-changer for your recon. Use reputable collections of wordlists for paths, parameters and more such as 

: General-purpose wordlist for common endpoints.

: Tailored to the programming language of your target

: Tailored to specific technologies such as 

You can also refine these lists using data gathered in earlier steps – for instance, from JavaScript files, by adding parameter names or endpoint fragments found in the code, or from forced browsing, including any interesting directories or filenames that turned up as partial matches or hinted at backup files.

By customising your wordlists, you align your fuzzing efforts with the target’s unique environment rather than relying solely on generic guesses. You can also generate your own wordlists using tools like 

, which extracts keywords from a target’s website.

 are widely used for fuzzing because they are fast, flexible and easy to configure. For example, you can perform:

Use custom wordlists to brute-force paths and uncover hidden files or folders.

Identify undocumented GET or POST parameters by using specific parameter-based wordlists.

Before you hit ‘Run’, adjust your tool settings to maximise efficiency and relevance:

: Limit output to specific status codes or response sizes to highlight unusual findings.

: Set a comfortable number of parallel requests (eg, -t 10 in 

: Use refined wordlists that incorporate insights from previous discovery methods, ensuring that fuzzing inputs are both broad and targeted.

, which includes built-in wordlists and can quickly identify resources by simply inputting the target URL.

Burp Intruder is super-handy for parameter fuzzing, as you can send multiple payloads to known parameters and analyse how the server responds. You can also script custom fuzzing routines using Python tools or automation frameworks if you need more specialised testing.

In the Intruder section, you can set up custom fuzzing attacks by marking parameters, loading payloads and starting the attack. You can generate your own payloads, such as numeric ranges, character lists or even custom wordlists, directly in Burp.

: Intruder is particularly helpful for automating tests for vulnerabilities like IDOR (Insecure Direct Object References).

Analysing, iterating and integrating findings

Once you have gathered your results, sort through them to identify promising leads. Incorporate newly discovered endpoints or parameters back into your testing pipeline, for example by:

 Add unique filenames, directories or parameters that emerged.

 If certain responses hint at SQL injection, XSS or authentication bypass, tailor your next fuzzing round with more specialised payloads.

 Feed new findings into other approaches, like forced browsing of different directories or running advanced parameter fuzzing on newly revealed endpoints.

Bonus: exploring header fuzzing techniques

HTTP headers can also expose interesting information about the application, such as:

Bug Bounty Recon Series #1: Discover and Map Hidden Endpoints and Parameters

Public Bug Bounty Programs remain a rich source of vulnerabilities even after the hardening of scopes via pentests and private programs.

That’s one message conveyed by rising hacking talent ‘

’ in the Q&A below, where she offers other valuable advice to aspiring and inexperienced hackers, recounts her Bug Bounty journey so far and discusses her favourite hacking tools and bug discovery so far.

Currently ranked 49th overall, pwnii – aka 

 – has steadily ascended the YesWeHack leaderboard since joining the platform in 2022, and is already sufficiently well regarded to be invited to various live hacking events. The French hunter currently combines Bug Bounty hunting with studying for a cybersecurity degree and a part-time position as security researcher at YesWeHack. In the latter role, she presents a video series called 

, where she outlines solutions to YesWeHack’s Dojo CTF challenges.

I started to get interested in cybersecurity when I was young. I got my first computer at nine and I started to use Linux at 14. By this way, I started to get interested in CTFs. I got into a CTF team called Flag Poisoning.

I started Bug Bounty last year at leHACK. I met some people that did Bug Bounty live events, and I started to hunt at this event. I didn’t find any bugs, but when I came home I started to hunt by myself, and now I’m here!

My favourite bug isn’t a technical one. My favourite bug is an 

, but I really appreciate this one because I got it when I started to hunt on mobile applications. With this IDOR, I got the possibility to modify the email of every user. So this way I had the possibility to take over their accounts.

I found this bug pretty quickly, honestly. I got a lot of ‘flex’, and it’s especially because people mainly don’t think to go on mobile applications, or just don’t dig enough.

I’m not using that many tools. My basic starter pack is Burp Suite with PwnFox. I really enjoy using tools like Wayback Machine, Waybackurls, those kinds of things.

Using Wayback Machine or tools like that is a little trick I really enjoy, because sometimes you can find some old endpoints or just like hidden endpoints, and it can be interesting. I had the possibility, for example, to find all the source code of a platform this way.

On the three words that best describe her as a hacker…

Passionate, motivated and creative. And by creative I mean that, sometimes, with the context of your bugs, you can increase the impact. So it can be nice.

On the hacking skill she most wants to develop…

I want to go deeper into mobile applications. I’m still a newbie and I really want to go deeper in web too. I mean, I have learned a lot with Bug Bounty – but I want to go deeper again.

On her career and life plans in Bug Bounty and beyond…

I plan after my studies to maybe do Bug Bounty full-time. I will enjoy travelling around the world for a few months or maybe a year, I don’t know. I would also really enjoy opening my own company in the future.

On the most challenging aspect of Bug Bounty…

One of the hardest sides of Bug Bounty is the fact that you have to admit that, sometimes, you just can’t find bugs and it’s just normal. And yeah, sometimes it’s pretty hard to deal with duplicates. But don’t forget that a duplicate bug is a valid bug. So it’s nice!

Her top tips for newbie Bug Bounty hunters…

As a new hunter, I will tell you to be patient and just be motivated. At the beginning, it’s completely normal to not find any bugs. You have the luck on YesWeHack to have 

, so just do Dojo, and after that you will probably get some private program invites. Don’t be scared to go on public programs too. There are a lot of bugs.

Learn more about hunting through YesWeHack

, or learn about the latest hacking tools and techniques 

‘There are a lot of vulnerabilities on public programs’: pwnii’s Bug Bounty journey so far

Ranked 22nd on YesWeHack's all-time leaderboard, 

 proves you can excel with the bare minimum of tools (he generally uses only one).

The French security researcher and CTF player with the 

, who has found more than 200 vulnerabilities since registering on YesWeHack in 2016, sat down with YesWeHack at leHACK this year to discuss his Bug Bounty career to date.

Among other things, he talks about how he got into hacking via video games, his fondness for PHP targets and why bug hunting is comparable to being a scientist.

Blaklis on how he became an ethical hacker…

I've been doing Bug Bounty for about seven years now. I've been hacking for much longer: I started when I was about 13/14 (to cheat on video games – it's not very glorious I know, but you have to start somewhere).

So I started Bug Bounty with my internet service provider in Switzerland, 6/7 years ago, which had decided to do a Bug Bounty almost overnight. And then eventually, I really fell into the pot of magic potion that is Bug Bounty, and then I continued to do it on different platforms.

And now I'm trying to talk about it a lot in France. I've created a community, I've done quite a few things for Bug Bounty in France. And now I've been making a living out of it for two years. So that's all I do now – I'm a full-time bug hunter.

Personally, I love hacking in general. I'm so curious that I like to go and see how everything functions, how it works, how you can make things deviate a bit from their basic functioning. And I think it's essentially about curiosity. And I also like tinkering. It's a bit like the cheating I used to do, which is still a bit present here, but now it's more for a good cause.

On what a typical day looks like as a full-time bug hunter…

Well, in reality, in a standard day for me, it starts with waking up and knowing: am I going to work or am I not going to work? I'm lucky to have this freedom.

I'm a big fan of video games, so my days are split between potentially playing video games, spending a bit of time with my partner and working – sometimes I have to! But I don’t always work on the same devices, so I can hack on my computer from the living room, or hack on completely different devices if I'm testing very specific ones. So my days aren't really standard, after all.

On the ethical hacking opportunities available in video games…

There are some. There are video games – MMORPGs, that sort of thing – that allow testing. Today, I'm just starting to get into it, very slowly. It reminds me a bit of my younger days. Today, it's more difficult than it was. There are skills I'm missing that I'm in the process of relearning. It's also one of the strengths of Bug Bounty that I now have time to learn things that I potentially lacked back then. It's time I can take for myself, to teach myself.

On the most challenging parts of being a hacker…

For me, there's no doubt about it: the most difficult aspect is the biases you can have at the beginning. When a hunter starts out, he's bound to have biases that are gigantic: ‘I'm not skilled enough to take on big companies’, ‘there are already too many people who've tested before me’ or ‘I've spent three days hacking, I've found nothing, I'm never going to find anything’.

These are things that I think we've all encountered. And it's extremely difficult to get out of them.

On the vulnerability he is most proud of…

So there are lots of bugs I'm really proud of. I like bugs that are a bit devious, a bit complex.

And here's a good example: I have a very long chain that took me a month to find on a program and it earned me a $75,000 bounty. So that's something I'm really proud of; I spent a month working on it non-stop. I cried a bit, I sweated, I had a few tears of joy when I finally succeeded too.

I don't really have a preference. It's all very subjective. I can't quite explain it to myself yet. But I just have to have fun with it. I can't explain it completely. But it's true that when I see PHP on targets, it always puts little stars in my eyes. It's a language where I know there are a lot of pitfalls. I know them very, very well: I'm a former PHP developer, so obviously I know the pitfalls quite well.

On the three words that best describe him as a hacker…

The first is perseverance: I've already talked about that, so there's really no need to explain it. The second is twisted: I like bugs that are really twisted, that are really complex, where you have to untangle a lot of things. And the third is technical: I love anything technical. And I think that I've been able to develop a technical level that's quite high today. So I think those three words represent me pretty well.

Burp. It's the only one I use. A console, Burp, a browser – and that's it, I'm off! I don't use anything else. I'm still a bit of a Cro-Magnon in the way I hack. If I need a tool, I just code it and that's it.

On the profession (not including IT or security-related jobs) that Bug Bounty is most similar to…

For me, it's pretty close to being a scientist. I like finding new things, I like always trying to push my research a little further to find new ways of exploiting bugs, new ways of exploiting mechanisms that seem vulnerable to me, that aren't at first sight but that will eventually become so.

So I'm a bit like a scientist doing research. If I had an outside view of myself, that's more or less how I see myself.

‘Hacking is essentially about curiosity’: Blaklis on the art and science of Bug Bounty hunting

A two-part research writeup on DOMPurify security from Kévin Gervot seems a worthy place to kick off our latest roundup of news and research aimed at security researchers.

 uncovered with the help of @IcesFont, @hash_kitten and @ryotkak: “three related to the default configurations for versions <= 3.1.0, 3.1.1, and 3.1.2, and one based on triple HTML parsing payloads”. The research 

, meaning moderators deemed it truly novel or innovative in the realm of web security. 🚀 Kévin (aka Mizu) acknowledges the role played by 

, a new open source tool for understanding how browsers parse HTML from our resident security researcher, Bitk. Previewing the sequel to this impressive writeup, Kévin says the latest DOMPurify fix is robust but leaves the library's security heavily reliant on a single regular expression. “In the second article, we will explore how and why this reliance can become problematic in certain configurations and use cases,” he says. 🧩

Prompt injection and containerised ChatGPT

Prompt Injecting Your Way To Shell: OpenAI's Containerized ChatGPT Environment

’, 0din’s Marco Figueroa unearths “the surprising capabilities that allow users to interact with” the “underlying structure” of OpenAI’s containerized model “in unexpected ways”. Among other things, this includes delving "into the Debian-based sandbox environment where ChatGPT’s code runs, highlighting its controlled file system and command execution capabilities". 🧐

Google’s open source security team, meanwhile, has outlined how a fuzzing project with 11,000 vulnerabilities to its name during its eight-year run so far has 

 with AI-generated and enhanced fuzz targets. Perhaps the most notable of the bugs discovered by OSS-Fuzz was “a vulnerability in the critical OpenSSL library (CVE-2024-9143) that underpins much of internet infrastructure”, as per a recent blog post. From drafting an initial fuzz target to triaging any crashes, the LLM can now apparently execute the first four steps of the developer’s process, with the fifth – having LLMs suggest patches – in the pipeline. 🤖

Other writeups and InfoSec news of interest this month:

Ruby 3.4 universal RCE deserialization gadget chain

: Diving into an Overlooked Attack Surface and Uncovering 10+ New Vulnerabilities

How Sean Kahler gained unauthorized access to 

. The bug is patched but Sean suggests the game developer could benefit from a Bug Bounty Program

 where they compromised a critical national infrastructure entity through a web shell “left from a third party’s previous security assessment”

 in the past month from the 2024 edition of the grandaddy of all hacker cons – definitely worth a look (we’ve posted one of the most popular below)!

 and the launch of a new video series featuring talented bug hunter and YesWeHack researcher enablement specialist Hanissa S (known in hacking circles as pwnii or pwnwithlove). ❤️ Called 'Talkie Pwnii', the new monthly series sees Hanissa outline potential solutions to the most recent Dojo challenge, along with other technical tips and tricks. The 

 kicked off with 'Shell Escape', which involved exploiting the SQL LIKE operator and a command injection regex bypass. The 

 (embedded below) revisits 'Hacker Forum', which involved exploiting second order SQL injection to extract data. 🛠️

: zyp3, HannanHaseeb and nomish_. 🎉 Relatedly, Dojo now has a 

, a vulnerability that occurs when an attacker can access or modify objects through manipulation. As for hacking tools, PimpMyBurp returns with a focus on SignSaboteur, a Burp extension that enables you to edit, sign, verify and 

, while another noteworthy Burp tool we spotted is a 

 for installing a Burp Collaborator Server in a docker environment using a LetsEncrypt wildcard certificate. Marvellous. 🌟

A pair of hunter interviews to flag now, starting with this sage advice from Nagli: “If you don’t stay on top of the latest trends, you won’t make it to the top.” 🧠 Who are we to disagree with one of the world’s most successful bug hunters? Keeping abreast of evolving technologies is only one of several best practices shared by the 26-year old hacker, entrepreneur and Bug Bounty automation pioneer in a new 

 (we featured the video alone in a previous newsletter). As we said earlier, Pwnii also features in a new 

 (see below) where she discusses how she got into Bug Bounty, her proudest bug find to date, her preferred hacking tools, her plans for deepening her hacking skills and her long-term plans beyond Bug Bounty. 🎯

“In general, new bugs like large language model (LLM) injection, HTTP request smuggling, OS binary or mobile app issues are more challenging for the triage team than classic vulnerabilities like XSS, CSRF and open redirects,” says our triage chief, Adrien Jeanneau (aka Hisxo), in a 

. “When reports use new techniques, we need to understand the risks, impact and possible mitigations.” While the interview is primarily aimed at customers and prospects, there are still some fascinating insights like this one for hunters. 🔥

Our first live hacking event in Latin America

Leaderboard time! We’ll kick off with the final podium from our live hacking event at Ekoparty in Buenos Aires last month, with Galicia Bank providing the targets (

Big up also to those who made the leaderboards of our other recent live hacking events – for 

 (topped by none other than pwnii!) and at 

 (with proceeds donated to the relief effort for the flooding disaster in Spain). 👏

Over to YesWeHack’s overall leaderboard now. Pocsir has leapfrogged marcosen into third place on the 

 rankings, with the ever-prolific Rabhi and Xel still out in front. This exactly mirrors the as-it-stands podium for 

 overall with just a couple of weeks left to run. 🏆

Read this monthly roundup of content aimed at ethical hackers even sooner by subscribing to 

Are you a CISO, other security professional or security-conscious dev? Check out our CISO-focused sister newsletter, 

 – bringing you news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

DOMPurify bypasses, prompt injecting ChatGPT to shell, AI fuzz finds – ethical hacker news roundup

, asked participants to perform a second-order SQL injection, inserting a new value into the database which later exposes the flag in the result of a SQL SELECT statement.

Want to create your own monthly Dojo challenge? Send us a message on Twitter!

 feeds to be notified of upcoming challenges.

Read on to find out how one of the winners managed to solve the challenge.

TALKIE PWNII #2: VIDEO CHALLENGE WRITE-UP

We want to thank everyone who participated and reported to the Dojo challenge. Below is the best write-up overall:

A critical vulnerability was identified within the 

 functionality. More specifically, SQL injection is possible via the author field when posting a comment, giving the attacker the ability to modify and extract sensitive information such as user passwords.

During the initial reconnaissance phase, a thorough code inspection was conducted in which the underlying tech-stack was revealed. The application uses PHP that connects to an SQLite3 database, as shown in the first three lines of the source-code:

This immediately sparked concern for potential PHP code– or SQL injection.

Next, the application defines three PHP functions: 

, which are used in the context of rendering posts with their respective comments.

Further down, on line 53, we encounter user-supplied input for the first time. Two variables are defined: 

Next, immediately after the user-inputs are defined we find the code in which the user-comments are inserted into the SQL database.

A note was taken that the application makes proper use of 

The YesWeHack Blog

The YesWeHack Bug Bounty Report 2025

The YesWeHack Bug Bounty Report 2025

Bug Bounty Recon Series #1: Discover and Map Hidden Endpoints and Parameters

‘There are a lot of vulnerabilities on public programs’: pwnii’s Bug Bounty journey so far

The YesWeHack Bug Bounty Report 2025

‘Hacking is essentially about curiosity’: Blaklis on the art and science of Bug Bounty hunting

DOMPurify bypasses, prompt injecting ChatGPT to shell, AI fuzz finds – ethical hacker news roundup

Dojo challenge #37 - Hacker Forum winners and writeup

‘Hacking is essentially about curiosity’: Blaklis on the art and science of Bug Bounty hunting

‘My best attribute is persistence – technical skills you can learn’: drak3hft7’s Bug Bounty story so far

Clock ticking on Cyber Resilience Act compliance, Bug Bounty forecasts, intriguing CISA red team find – OffSec roundup for CISOs

‘Collaboration helped me become successful’: Nagli on becoming a world-renowned Bug Bounty hunter

‘My best attribute is persistence – technical skills you can learn’: drak3hft7’s Bug Bounty story so far

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us