# Bug Bounty Challenge

### I made this list for me from this awsome Bug BOunty Writeups List

{% embed url="https://github.com/krishanthan4/Awesome-Bugbounty-Writeups" %}

### Week 1

* [ ] Day 1 = [CORS bug on google's 404 page (rewarded)](https://medium.com/@jayateerthag/cors-bug-on-googles-404-page-rewarded-2163d58d3c8b)
* [ ] Day 2 = [Google Bug bounty Clickjacking on Google payment](https://santuysec.com/2020/03/06/google-bug-bounty-clickjacking-on-google-payment-1337/)
* [ ] Day 3 = [From P5 to P2 to 100 BXSS](https://medium.com/@mohameddaher/from-p5-to-p5-to-p2-from-nothing-to-1000-bxss-4dd26bc30a82)
* [ ] Day 4 = [How a simple CSRF attack turned into a P1](https://ladysecspeare.wordpress.com/2020/04/05/how-a-simple-csrf-attack-turned-into-a-p1-level-bug/)
* [ ] Day 5 = [Disclose Private Dashboard Chart's name and data in Facebook Analytics](https://bugreader.com/jubabaghdad@disclose-private-dashboard-charts-name-and-data-in-facebook-analytics-184)
* [ ] Day 6 = [How I bought my way to subdomain takeover on tokopedia](https://medium.com/bugbountywriteup/how-i-bought-my-way-to-subdomain-takeover-on-tokopedia-8c6697c85b4d)
* [ ] Day 7 = [Touch ID authentication Bypass on evernote and dropbox iOS apps](https://medium.com/@pig.wig45/touch-id-authentication-bypass-on-evernote-and-dropbox-ios-apps-7985219767b2)

### Week 2

* [ ] Day 1 = [RFI LFI Writeup](http://hassankhanyusufzai.com/RFI_LFI_writeup/)
* [ ] Day 2 = [2FA Bypass via logical rate limiting Bypass](https://medium.com/@jeppe.b.weikop/2fa-bypass-via-logical-rate-limiting-bypass-25ae2a4e1835)
* [ ] Day 3 = [Long String DOS](https://medium.com/@shahjerry33/long-string-dos-6ba8ceab3aa0)
* [ ] Day 4 = [Exploiting a Race condition vulnerabililty](https://medium.com/@vincenz/exploiting-a-race-condition-vulnerability-3f2cb387a72)
* [ ] Day 5 = [Exploiting an SSRF trials and tribulations](https://medium.com/a-bugz-life/exploiting-an-ssrf-trials-and-tribulations-14c5d8dbd69a)
* [ ] Day 6 = [Tricky oracle SQLI situation](https://blog.yappare.com/2020/04/tricky-oracle-sql-injection-situation.html)
* [ ] Day 7 = [Microsoft RCE bugbounty](https://blog.securitybreached.org/2020/03/31/microsoft-rce-bugbounty/)

### Week 3

* [ ] Day 1 = [CORS misconfiguration leading to private information disclosure](https://medium.com/@sasaxxx777/cors-misconfiguration-leading-to-private-information-disclosure-3034cfcb4b93)
* [ ] Day 2 = [Google APIs Clickjacking worth 1337$](https://medium.com/@godofdarkness.msf/google-apis-clickjacking-1337-7a3a9f3eb8df)
* [ ] Day 3 = [Google Acquisition XSS (Apigee)](https://medium.com/@TnMch/google-acquisition-xss-apigee-5479d7b5dc4)
* [ ] Day 4 = [How I exploited the json csrf with method override technique](https://medium.com/@secureITmania/how-i-exploit-the-json-csrf-with-method-override-technique-71c0a9a7f3b0)
* [ ] Day 5 = [Disclosing privately shared gaming clips of any user](https://bugreader.com/rony@disclosing-privately-shared-gaming-clips-of-any-user-128)
* [ ] Day 6 = [Subdomain Takeover via pantheon](https://smaranchand.com.np/2019/12/subdomain-takeover-via-pantheon/)
* [ ] Day 7 = [Oauth authentication bypass on airbnb acquistion using wierd 1 char open redirect](https://xpoc.pro/oauth-authentication-bypass-on-airbnb-acquisition-using-weird-1-char-open-redirect/)

### Week 4

* [ ] Day 1 = [My first LFI](https://cyberzombie.in/my-first-lfi/)
* [ ] Day 2 = [Bypass 2FA in a website](https://medium.com/sourav-sahana/bypass-2fa-in-a-website-d616eaead1e3)
* [ ] Day 3 = [AIRDOS](https://kishanbagaria.com/airdos/)
* [ ] Day 4 = [Race condition that could result to RCE a story with an app](https://medium.com/bugbountywriteup/race-condition-that-could-result-to-rce-a-story-with-an-app-that-temporary-stored-an-uploaded-9a4065368ba3)
* [ ] Day 5 = [SSRF on PDF generator](https://medium.com/@michan001/ssrf-on-pdf-generator-36b81e16d67b)
* [ ] Day 6 = [Exploiting “Google BigQuery” SQLI](https://hackemall.live/index.php/2020/03/31/akamai-web-application-firewall-bypass-journey-exploiting-google-bigquery-sql-injection-vulnerability/)
* [ ] Day 7 = [OTP bruteforce account takeover](https://medium.com/@ranjitsinghnit/otp-bruteforce-account-takeover-faaac3d712a8)

