Daily Writeups
@Daily_Writeups
3.45K subscribers
2 photos
127K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.45K subscribers
Daily Writeups
⤷ Title: Rejected but Rewarded — What a GraphQL Misconfiguration Taught Me About Bug Bounty Triage.
════════════════════════
𐀪 Author: kjulius
════════════════════════
ⴵ Time: Mon, 25 May 2026 09:05:09 GMT
════════════════════════
⌗ Tags: #bug_bounty #graphql #penetration_testing #security #responsible_disclosure
Medium
Rejected but Rewarded — What a GraphQL Misconfiguration Taught Me About Bug Bounty Triage.
Responsible disclosure submitted. No mutations were executed. No systems were harmed. Finding classified as Informative. 50 CHF bonus…
17 views
Daily Writeups
⤷ Title: How a GraphQL Invitation Flow Exposed Users at Scale
════════════════════════
𐀪 Author: Ehtesham Ul Haq
════════════════════════
ⴵ Time: Mon, 25 May 2026 16:53:49 GMT
════════════════════════
⌗ Tags: #infosec #penetration_testing #graphql #bug_bounty #information_security
Medium
How a GraphQL Invitation Flow Exposed Users at Scale
A normal invite feature revealed registered accounts, internal GraphQL identifiers, and user metadata through an overly detailed API…
24 views
Daily Writeups
⤷ Title: How a GraphQL Invitation Flow Exposed Users at Scale
════════════════════════
𐀪 Author: Ehtesham Ul Haq
════════════════════════
ⴵ Time: Thu, 28 May 2026 11:55:16 GMT
════════════════════════
⌗ Tags: #infosec #penetration_testing #graphql #bug_bounty #information_security
Medium
How a GraphQL Invitation Flow Exposed Users at Scale
A normal invite feature revealed registered accounts, internal GraphQL identifiers, and user metadata through an overly detailed API…
23 views
Daily Writeups
⤷ Title: Mass Account Takeover of 29,000 Accounts by Abusing GraphQL
════════════════════════
𐀪 Author: Bryan Matthew
════════════════════════
ⴵ Time: Tue, 02 Jun 2026 02:01:02 GMT
════════════════════════
⌗ Tags: #red_team #bug_bounty #penetration_testing #graphql #research
Medium
Mass Account Takeover of 29,000 Accounts by Abusing GraphQL
While testing a GraphQL endpoint, I noticed that introspection was enabled in production. Running an introspection query exposed the…
30 views
Daily Writeups
⤷ Title: GraphQL Introspection: The Feature That Hands Attackers Your API Blueprint
════════════════════════
𐀪 Author: johnnattakit 0xDD
════════════════════════
ⴵ Time: Wed, 03 Jun 2026 12:56:35 GMT
════════════════════════
⌗ Tags: #owasp_api_security_top_10 #penetration_testing #vulnerability #graphql #cybersecurity
Medium
GraphQL Introspection: The Feature That Hands Attackers Your API Blueprint
TL;DR: GraphQL introspection is a built-in, spec-compliant feature that — when left enabled on production endpoints — gives attackers a…
20 views
Daily Writeups
⤷ Title: How GraphQL Mutation Aliasing Led to a $12,500 DoS Bug in HackerOne’s Account Recovery Flow
════════════════════════
𐀪 Author: Abhishek meena
════════════════════════
ⴵ Time: Tue, 09 Jun 2026 08:45:17 GMT
════════════════════════
⌗ Tags: #graphql #bug_bounty_writeup #infosec #bug_bounty #bug_bounty_tips
Medium
How GraphQL Mutation Aliasing Led to a $12,500 DoS Bug in HackerOne’s Account Recovery Flow
A small GraphQL behavior created a very real availability problem.
12 views
Daily Writeups
⤷ Title: A Practical Introduction to GraphQL Pentesting
════════════════════════
𐀪 Author: Amir Dehghan
════════════════════════
ⴵ Time: Tue, 09 Jun 2026 12:55:03 GMT
════════════════════════
⌗ Tags: #cybersecurity #graphql #api_security #web_security #penetration_testing
Medium
A Practical Introduction to GraphQL Pentesting
Understanding GraphQL architecture, reconnaissance techniques, and common security vulnerabilities.
8 views
Daily Writeups
⤷ Title: Blind Extraction of Password Hashes via an Unauthenticated GraphQL Count Oracle
════════════════════════
𐀪 Author: M0n3m
════════════════════════
ⴵ Time: Sat, 13 Jun 2026 17:21:21 GMT
════════════════════════
⌗ Tags: #bug_bounty #graphql #hacking
Medium
Blind Extraction of Password Hashes via an Unauthenticated GraphQL Count Oracle
High Severity Vulnerability with $XXX Bounty
35 views
Daily Writeups
⤷ Title: Writeup — Accessing private GraphQL posts
════════════════════════
𐀪 Author: praditya arga
════════════════════════
ⴵ Time: Wed, 17 Jun 2026 14:42:11 GMT
════════════════════════
⌗ Tags: #burpsuite #cybersecurity #ctf #graphql #penetration_testing
Medium
Writeup — Accessing private GraphQL posts
This lab shows a vulnerability in a GraphQL implementation where users can access sensitive fields because the queries are not properly…
7 views
Daily Writeups
⤷ Title: From GraphQL Introspection to Critical Data Exposure: Discovering Unauthenticated Access to KYC…
════════════════════════
𐀪 Author: savan-025
════════════════════════
ⴵ Time: Sat, 20 Jun 2026 07:49:44 GMT
════════════════════════
⌗ Tags: #cybersecurity #security_research #bug_bounty #graphql #ethical_hacking
Medium
From GraphQL Introspection to Critical Data Exposure: Discovering Unauthenticated Access to KYC OTPs and Payment Records
Introduction
26 views
Daily Writeups
⤷ Title: GraphQL Hacking — The 2026 Goldmine
════════════════════════
𐀪 Author: Nitin yadav
════════════════════════
ⴵ Time: Tue, 23 Jun 2026 11:31:00 GMT
════════════════════════
⌗ Tags: #security #bug_bounty #graphql #technology #hacking
Medium
GraphQL Hacking — The 2026 Goldmine
What’s up everyone! Nitin here 👋
15 views
Daily Writeups
⤷ Title: The Silent Data Leak: Hardening Production Gateways Against GraphQL Introspection
════════════════════════
𐀪 Author: BizTech Pulse Hub
════════════════════════
ⴵ Time: Wed, 24 Jun 2026 02:26:56 GMT
════════════════════════
⌗ Tags: #web_development #software_engineering #api_security #cybersecurity #graphql
Medium
The Silent Data Leak: Hardening Production Gateways Against GraphQL Introspection
The paradigm shift toward dynamic database architectures has fundamentally changed how modern web services communicate. For years, system…
27 views
Daily Writeups
⤷ Title: Excessive Data Exposure via Unauthenticated GraphQL Endpoint
════════════════════════
𐀪 Author: 0xPinocchioSec
════════════════════════
ⴵ Time: Thu, 25 Jun 2026 09:20:53 GMT
════════════════════════
⌗ Tags: #bug_bounty #infosec #graphql #web_security #cybersecurity_research
Medium
Excessive Data Exposure via Unauthenticated GraphQL Endpoint
Bug Bounty Write-up | Information Disclosure | GraphQL Security
12 views
Daily Writeups
⤷ Title: Hacking GraphQL APIs: A Practical Guide for Pentesters — Part 1
════════════════════════
𐀪 Author: Vineet Singh
════════════════════════
ⴵ Time: Fri, 26 Jun 2026 18:39:47 GMT
════════════════════════
⌗ Tags: #application_security #api_security #bug_bounty #graphql #penetration_testing
Medium
Hacking GraphQL APIs: A Practical Guide for Pentesters — Part 1
Learn GraphQL fundamentals and why every pentester should understand GraphQL before testing modern APIs.
10 views
Daily Writeups
⤷ Title: Finding Hidden GraphQL Endpoints | Hacking GraphQL APIs — Part 2
════════════════════════
𐀪 Author: Vineet Singh
════════════════════════
ⴵ Time: Mon, 29 Jun 2026 19:52:58 GMT
════════════════════════
⌗ Tags: #api_security #penetration_testing #bug_bounty #graphql #application_security
Medium
Finding Hidden GraphQL Endpoints | Hacking GraphQL APIs — Part 2
This is Part 2 of an ongoing series where we’ll learn GraphQL from an attacker’s perspective. Each article builds on the previous one, so…
25 views
Daily Writeups
⤷ Title: Accessing Private GraphQL Posts — Lab Walkthrough — Portswigger
════════════════════════
𐀪 Author: Cybernerddd
════════════════════════
ⴵ Time: Tue, 30 Jun 2026 19:48:44 GMT
════════════════════════
⌗ Tags: #cybernerddd #cybersecurity #graphql #hacking #api_testing
Medium
Accessing Private GraphQL Posts — Lab Walkthrough — Portswigger
In this lab from PortSwigger’s Web Security Academy, the goal was simple: find the hidden private blog post and extract its secret…
14 views
Daily Writeups
⤷ Title: API Fuzzing for Bug Bounty — Part 3: GraphQL Security — The Complete Attack Playbook
════════════════════════
𐀪 Author: Fuzzyy Duck
════════════════════════
ⴵ Time: Wed, 15 Jul 2026 01:58:14 GMT
════════════════════════
⌗ Tags: #graphql #bug_bounty_tips #security #bug_bounty_writeup #bug_bounty
Medium
API Fuzzing for Bug Bounty — Part 3: GraphQL Security — The Complete Attack Playbook
Series Overview Part 1 — Recon, Discovery & Mapping the Attack Surface Part 2a — Breaking Authentication & Authorization Part 2b —…
16 views
Daily Writeups
⤷ Title: The GraphQL Bugs Worth Submitting in Bug Bounty (2026)
════════════════════════
𐀪 Author: Afi0pchik
════════════════════════
ⴵ Time: Sat, 18 Jul 2026 09:50:06 GMT
════════════════════════
⌗ Tags: #graphql #bug_bounty #api_security #ethical_hacking #cybersecurity
Medium
The GraphQL Bugs Worth Submitting in Bug Bounty (2026)
Most of mine got closed as "informational." These five actually pay - from a $5K IDOR to a $12,500 account takeover. Plus what to skip.
20 views
Daily Writeups
⤷ Title: Authorization Bypass via Privilege Persistence After Role Downgrade in Hasura PromptQL
════════════════════════
𐀪 Author: Ahmed Embaby
════════════════════════
ⴵ Time: Sat, 18 Jul 2026 15:12:35 GMT
════════════════════════
⌗ Tags: #web_security #authorization #bug_bounty #cybersecurity #graphql
Medium
Authorization Bypass via Privilege Persistence After Role Downgrade in Hasura PromptQL
Still an Admin. Just Not Officially
12 views
Daily Writeups
⤷ Title: How I Found an Auth Flaw in a Government Site: From GraphQL Introspection to Unauthorized Access
════════════════════════
𐀪 Author: Aruvasaga chithan A
════════════════════════
ⴵ Time: Wed, 22 Jul 2026 09:45:05 GMT
════════════════════════
⌗ Tags: #graphql #infosec #ethical_hacking #bug_bounty
Medium
How I Found an Auth Flaw in a Government Site: From GraphQL Introspection to Unauthorized Access
Disclaimer:This write-up describes a vulnerability that has been responsibly disclosed and fixed by the affected organization. All domains…
5 views