PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Thanh xuân như một tách trà, tìm được một bug hết bà thanh xuân.

blog.viettelcybersecurity.com | blog | #bug-bounty | #api-security | #mobile-security | #idor | #broken-access-control | #writeup
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A bug bounty write-up on a restaurant management platform where staged tenant accounts revealed cross-restaurant IDOR and broken function-level authorization across web and mobile APIs.
Published
Collected

Related coverage

blog · borghq.io
IDOR Testing for APIs: How to Find Broken Object Access
IDOR testing for APIs, done as an authorisation check on every object reference. Two-account setup, every operation, and how to make it repeatable per release.
blog · bugbunny.ai
Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight
Insecure direct object reference: the app exposes an object ID but never checks ownership, tenant or role—one user reads another's data; fix with centralized object authorization and negative tests.
Medium · vulnerability · github.com
CVE-2026-84636: Apple iOS/macOS SCDynamicStore Wi-Fi SSID Info Disclosure PoC
Wi-Fi SSID data is strictly guarded as sensitive location telemetry on iOS. This PoC shows that third-party applications could bypass sandbox entitlement checks via SCDynamicStore to silently track user network environments and physical locations.
blog · blog.viettelcybersecurity.com
Tìm hiểu lỗi ứng dụng Android qua Mobisec
A walkthrough of Mobisec Android challenges covering app development, reversing and exploitation, including a Fortnite-style update hijack that abuses writable external storage for code execution.
blog · blog.viettelcybersecurity.com
Với một vài dòng code đơn giản, tôi đã tìm CVE của Joomla như thế nào?
A researcher details finding three Joomla CVEs, including CVE-2019-19845 path disclosure and CVE-2019-18650 CSRF, by scripting scans for files lacking JEXEC checks and token validation.
blog · bishopfox.com
Otto Support - Testing MCP Servers
Closing the otto-support series, the team uses nmap, a Nuclei template, and MCP Inspector to expose an authorization gap that lets any unprivileged user delete other users' tickets.
Back