phlmox·Jul 18Authentication Bypass on Taboola API’sThis blog post is about the authentication bypass vulnerability I found in Taboola APIs. Firstly, what is Taboola?
phlmox·Mar 11Insecure Message Listeners -> Dom XSSIn this writeup, I will write about a recent finding in my bug bounty session. I have been hunting on this target for more than a year and…
phlmox·Nov 24, 2025Intigriti’s XSS Challenge 1125 WriteupHere is my solution for the November challenge of Intigriti.
phlmox·Aug 26, 2025Third Party Account Linking Account TakeoverThis story is about how third party account linking could lead to Account takeover.
phlmox·Apr 7, 2025How I Found an Authentication Bypass in a Dev EnvironmentThis writeup is about how I found an authentication bypass during one of my bug bounty sessions.
phlmox·Mar 11, 2025Account Takeover via postMessageThis write-up is about how I found that one line of JavaScript code was leading to an account takeover. The target has its own bug bounty…A response icon1A response icon1
![[TR] Reflected XSS CloudFlare Bypass](https://miro.medium.com/v2/resize:fill:160:106/1*tRXE1H8SmHmvt2a4aJjxGA.png)
![[TR] Reflected XSS CloudFlare Bypass](https://miro.medium.com/v2/resize:fill:320:214/1*tRXE1H8SmHmvt2a4aJjxGA.png)
