YoKo Kho – Page 3 – Just Another Simple Write-Up

IDOR (at Private Bug Bounty Program) that could Leads to Personal Data Leaks

In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release in simple:[English Version] IDOR...

April 17, 2018

Bug Report / Web Apps / Write-Up

Ribose – IDOR with Simple CSRF Bypass – Unrestricted Changes and Deletion to other Photo Profile

In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release in simple:[English Version] Ribose — IDOR...

April 16, 2018

Bug Report / Mobile Apps / Write-Up in Bahasa

[Bahasa] Multiple Parameter Pollution Bugs at “Battle Camp” Game that could Leads to Several Illegal Action

In the name of Allah, the Most Gracious, the Most Merciful. Silahkan langsung mengunduh paper sederhana pada tautan berikut untuk dapat melihat tulisan ini lebih nyaman:...

April 10, 2018

Bug Report / Web Apps / Write-Up

Bypassing the Current Password Protection at PayPal Tech-Support

In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release (December, 2017 Article):[English Version]...

December 26, 2017

Bug Report / Web Apps / Write-Up

Information Disclosure at PayPal and Xoom (PayPal Acquisition) via Simple Google Dork – 1,000 USD

In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release:[English Version] PayPal – Information...

December 26, 2017

Bug Report / Web Apps / Write-Up

Turning Self-XSS into non-Self Stored-XSS via Authorization Issue at “PayPal Tech-Support and Brand Central Portal”

In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release:[English Version] PayPal — Turning Self-XSS into...

November 12, 2017

Bug Report / Web Apps / Write-Up

FortiNet – Unrestricted Deletion to All Other Sub Account via IDOR at Support Portal

In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release in simple:[English Version] FortiNet...

May 3, 2017

Bug Report / Random Things / Web Apps

Oppo – Reflected XSS at Activation Link via Base64 Value

In the name of Allah, the Most Gracious, the Most Merciful. Description: an Reflected XSS issue at Activation Link that could be triggered via Base64 Encoding....

May 2, 2017

Bug Report / Random Things / Web Apps

Oppo – Open URL Redirection at Activation Link via Base64

In the name of Allah, the Most Gracious, the Most Merciful. Description: an Open URL Redirection issue at Activation Link that could be triggered via Base64...

May 2, 2017

Bug Report / Random Things / Web Apps

LinkedIn – Changing Our Account Type from Normal to “Premium” by Manipulating the “CartId” Parameter

In the name of Allah, the Most Gracious, the Most Merciful. Description: A simple parameter pollution at CartId parameter that could allow people to get the...

April 15, 2017

Author: YoKo Kho

IDOR (at Private Bug Bounty Program) that could Leads to Personal Data Leaks

Ribose – IDOR with Simple CSRF Bypass – Unrestricted Changes and Deletion to other Photo Profile

[Bahasa] Multiple Parameter Pollution Bugs at “Battle Camp” Game that could Leads to Several Illegal Action

Bypassing the Current Password Protection at PayPal Tech-Support

Information Disclosure at PayPal and Xoom (PayPal Acquisition) via Simple Google Dork – 1,000 USD

Turning Self-XSS into non-Self Stored-XSS via Authorization Issue at “PayPal Tech-Support and Brand Central Portal”

FortiNet – Unrestricted Deletion to All Other Sub Account via IDOR at Support Portal

Oppo – Reflected XSS at Activation Link via Base64 Value

Oppo – Open URL Redirection at Activation Link via Base64

LinkedIn – Changing Our Account Type from Normal to “Premium” by Manipulating the “CartId” Parameter

Search

Recent Posts

Categories