How I found two api vulnerabilities by analyzing JS source code | by Mohammed Waleed | Medium

Hello everybody, my name is Mohammed Waleed, I’m a beginner bug hunter and web developer and today I will share with you how I found two api bugs on a private bug bounty program by analyzing website source code and how you can also use source code and JS files to find vulnerabilities, let’s get started! since the target is a private program on hackerone and I can’t disclose any information about it, I will call it target.com. the scope of the target wasn’t very big and consisted of only one wildcard domain(*.target.com), after doing some recon I decided to start hunting on the main application, I found that the website is using react framework. I wanted to see if the source code was available so I opened the sources tab in chrome DevTools and I found a folder called web-app that contained the frontend source code of the website! I immediately downloaded it to start reviewing the code and find some vulnerabilities. I downloaded the code using a chrome extension called resources saver, y

Hello everybody, my name is Mohammed Waleed, I’m a beginner bug hunter and web developer and today I will share with you how I found two api bugs on a private bug bounty program by analyzing website source code and how you can also use source code and JS files to find vulnerabilities, let’s get started! since the target is a private program on hackerone and I can’t disclose any information about it, I will call it target.com. the scope of the target wasn’t very big and consisted of only one wildcard domain(*.target.com), after doing some recon I decided to start hunting on the main application