Chris Dehghanpoor (@chrisd9r) 's Twitter Profile
Chris Dehghanpoor

@chrisd9r

Investigative Reporter, @washingtonpost • past: infosec @ Google, AWS, Twitch • Tips? @chrisd9r.01 on Signal

ID: 1250277219672313862

linkhttps://ckd.sh calendar_today15-04-2020 04:18:48

15,15K Tweet

9,9K Takipçi

2,2K Takip Edilen

Chris Dehghanpoor (@chrisd9r) 's Twitter Profile Photo
Chris Dehghanpoor
@chrisd9r

17 days ago

My first/only Bugcrowd P1 was for an app made by a well known network and IoT/camera vendor. Their password reset flow validated the password client side, then sent a request with the new pw and acct email address. You could change the pw for any acct if you knew the email.

My first/only Bugcrowd P1 was for an app made by a well known network and IoT/camera vendor. Their password reset flow validated the password client side, then sent a request with the new pw and acct email address. You could change the pw for any acct if you knew the email.