Daily Writeups
@Daily_Writeups
4.03K subscribers
4 photos
137K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.03K subscribers
Daily Writeups
⤷ Title: How I Found an Auth Flaw in a Government Site: From GraphQL Introspection to Unauthorized Access
════════════════════════
𐀪 Author: Aruvasaga chithan A
════════════════════════
ⴵ Time: Wed, 22 Jul 2026 09:45:05 GMT
════════════════════════
⌗ Tags: #graphql #infosec #ethical_hacking #bug_bounty
Medium
How I Found an Auth Flaw in a Government Site: From GraphQL Introspection to Unauthorized Access
Disclaimer:This write-up describes a vulnerability that has been responsibly disclosed and fixed by the affected organization. All domains…
9 views
Daily Writeups
⤷ Title: Why You Should ALWAYS Test WebSockets (And Why Most Hunters Never Do)
════════════════════════
𐀪 Author: CypherNova1337
════════════════════════
ⴵ Time: Sat, 25 Jul 2026 03:34:00 GMT
════════════════════════
⌗ Tags: #ethical_hacking #websocket #graphql #bug_bounty #penetration_testing
Medium
Why You Should ALWAYS Test WebSockets And Why Most Hunters Never Do
A real-world bug bounty walkthrough on how skipping WebSocket recon is leaving money on the table — and how I found a P1 by going where…
30 views
Daily Writeups
⤷ Title: How I Found an Auth Flaw in a Government Site: From GraphQL Introspection to Unauthorized Access
════════════════════════
𐀪 Author: Aruvasaga chithan A
════════════════════════
ⴵ Time: Mon, 27 Jul 2026 09:24:22 GMT
════════════════════════
⌗ Tags: #graphql #infosec #ethical_hacking #bug_bounty
Medium
How I Found an Auth Flaw in a Government Site: From GraphQL Introspection to Unauthorized Access
Disclaimer:This write-up describes a vulnerability that has been responsibly disclosed and fixed by the affected organization. All domains…
17 views
Daily Writeups
⤷ Title: From GraphQL Enumeration to Cross-Workspace Takeover
════════════════════════
𐀪 Author: Insid_e
════════════════════════
ⴵ Time: Thu, 30 Jul 2026 14:40:20 GMT
════════════════════════
⌗ Tags: #cybersecurity #api_security #web_security #graphql #bug_bounty
Medium
From GraphQL Enumeration to Cross-Workspace Takeover
Chaining unauthenticated mutations, GraphQL batching abuse, and IDOR into full cross-tenant compromise
15 views
Daily Writeups
⤷ Title: Discovering an IDOR in Hoppscotch: A Deep Dive into Broken Access Control
════════════════════════
𐀪 Author: Ajith Prabhu
════════════════════════
ⴵ Time: Sat, 01 Aug 2026 05:25:14 GMT
════════════════════════
⌗ Tags: #cybersecurity #bug_bounty #open_source #graphql #application_security
Medium
Discovering an IDOR in Hoppscotch: A Deep Dive into Broken Access Control
How a seemingly harmless GraphQL query exposed private user history and highlighted the importance of authorization in nested resolvers.
23 views
Daily Writeups
⤷ Title: CVE-2026-5423: Authentication Bypass Hits Neo4j GraphQL Subscriptions
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 10 Aug 2026 13:30:34 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Authentication Bypass #CVE_2026_5423 #GraphQL security #JWT #Neo4j GraphQL
Daily CyberSecurity
CVE-2026-5423: Authentication Bypass Hits Neo4j GraphQL Subscriptions
TL;DR A high-severity authentication bypass affects the Neo4j GraphQL Library before versions 7.5.6 and 5.12.14. Tracked as CVE-2026-5423 (CVSS 8.2), it lets an unauthenticated attacker forge JWT …
13 views
Daily Writeups
⤷ Title: APIs in 2026: The New Digital Currency
════════════════════════
𐀪 Author: Jits Rit
════════════════════════
ⴵ Time: Tue, 11 Aug 2026 10:21:50 GMT
════════════════════════
⌗ Tags: #api_security #ai #api_development #graphql #rest_api_design
Medium
APIs in 2026: The New Digital Currency
How design, security, and monetization are redefining what an API is for
26 views
Daily Writeups
⤷ Title: GraphQL Security Assessment: From Exposed API Keys to SQL Injection
════════════════════════
𐀪 Author: Abdulmalik Adebayo
════════════════════════
ⴵ Time: Sun, 16 Aug 2026 19:58:37 GMT
════════════════════════
⌗ Tags: #hack_the_box_writeup #hackthebox_writeup #hackthebox_walkthrough #graphql_testing #graphql_schema
Medium
GraphQL Security Assessment: From Exposed API Keys to SQL Injection
A walkthrough of a GraphQL API assessment on a business application handling employee, product, and customer data — six confirmed findings…
35 views
Daily Writeups
⤷ Title: CVE-2026-19478 (CVSS 9.4): GitLab GraphQL Code Injection Flaw Patched
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 18 Aug 2026 01:40:33 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #code_injection #CSRF #CVE_2026_19478 #CVE_2026_19650 #gitlab #graphql
Daily CyberSecurity
CVE-2026-19478 (CVSS 9.4): GitLab GraphQL Code Injection Flaw Patched
TL;DR GitLab shipped an out-of-band critical patch on August 17, 2026. It fixes CVE-2026-19478, a GraphQL code injection flaw rated CVSS 9.4. Under certain conditions, an unauthenticated attacker …
15 views
Daily Writeups
⤷ Title: $12,000 for one GraphQL field: unauthenticated RCE on the servers that build Firefox
════════════════════════
𐀪 Author: Pawan Jaiswal
════════════════════════
ⴵ Time: Tue, 18 Aug 2026 15:49:38 GMT
════════════════════════
⌗ Tags: #infosec #graphql_security #bug_bounty #hacking #cybersecurity
Medium
$12,000 for one GraphQL field: unauthenticated RCE on the servers that build Firefox
No login. No token. No special header. Just a filter argument nobody validated.
11 views