Summary This bug allowed me to access a Management Information System Portal by bruteforcing common passwords. The admin panel allows changing theatre names, theatre status, changing ticket prices, user management, viewing system logs, etc. in South Asian countries. Reproduction Steps 1. Find all the ASNs owned by The Walt Disney
Learn about hacking, exploits, and insider threats, and understand the need for protecting yourself in the digital world. Get informed and protect yourself from cyber-attacks.
Hello Hackers, I am Inderjeet Singh aka encodedguy. Today, I will share one of my recent findings where I pwned 10 admin panels and the team rewarded me with $8000+. Background I was invited to a private HackerOne challenge this month. The total bounty pool for this challenge was $15K.
The Walt Disney Company started its program on Hackerone in March 2022. Last week, I reported 3 highs and 1 critical on their program. This is the story of an IDOR report due to improper authorization. Authentication and Authorization Authentication: When a user logs into a site or app, this