Self-XSS in Facebook payments flow leads to Instagram and Facebook account takeovers
XSSAccount TakeoverFacebook$62.5k9mo ago
Self-XSS chained through the payments flow into full Instagram/Facebook ATO.
Youssef Sammouda · ysamm.com ↗The ledger
Bounty writeups.
Real disclosed-bounty writeups — every entry states a real bounty, verified live against the article before it's listed. Dead links are dropped automatically.
44 writeups · $585.5k in bounties · checked today
How I hacked Facebook: Part Two
Account TakeoverFacebook$54.8k5y ago
Second part of the legendary series — chaining bugs into account takeover.
Alaa Abdulridha · Medium ↗How I Could Have Hacked Any Instagram Account
Account TakeoverInstagram$30k7y ago
The classic: brute-forcing the password-reset rate limit to take over any account.
Laxman Muthiyah · thezerohack.com ↗Two‑Click account takeover via FXAuth token abuse
Account TakeoverInstagram$30k9mo ago
FXAuth token abuse turns two clicks into a full Instagram account takeover.
Youssef Sammouda · ysamm.com ↗Bypass Two-Factor Authentication of Facebook Accounts ($25,300)
2FAAccount TakeoverFacebook$25.3k3y ago
Full 2FA bypass on Facebook accounts — discovery through exploitation.
Bassem M Bazzoun · Medium ↗Datr cookie theft and AI leads to Facebook account takeover via trusted device recovery
Account TakeoverFacebook$24k9mo ago
A stolen Datr cookie plus an AI chatbot escalates to full account takeover.
Youssef Sammouda · ysamm.com ↗Instagram and Meta 2FA Bypass by Unprotected Backup Code Retrieval in Accounts Center
2FAAccount TakeoverInstagram$10k1y ago
Unprotected backup-code retrieval quietly defeats 2FA on Instagram and Meta accounts.
scriptshuva · Medium ↗Bypassing 2FA in a Public Bug Bounty Program: A $6000 Journey
2FAAccount Takeoverprogram unnamed$6k1y ago
2FA bypass on a public program without ever passing the second factor.
mokhansec · Medium ↗Account takeover vulnerability that resulted in $2500 bounty!
Account Takeoverprogram unnamed$2.5k2y ago
Full ATO walkthrough with the author's complete thought process.
Imad Husanovic · Medium ↗$1000 Bounty: Account Takeover via Host Header Injection in Password Reset Flow
Account Takeoverprogram unnamed$1k1y ago
Host-header injection in password reset — cheap to test, found everywhere.
Ehtesham Ul Haq · InfoSec Write-ups ↗Account takeover worth $1000
Account TakeoverInfo Disclosureprogram unnamed$1k4y ago
Email-verification flow abuse leading to full account takeover.
Faique · InfoSec Write-ups ↗$500 OAuth Account Fusion Pre-Takeover Attack
Account Takeoverprogram unnamed$5006mo ago
OAuth account-fusion pre-takeover — a pattern worth checking on every program.
tinopreter · Medium ↗Every bounty amount, date and link was verified against the original article before listing; articles are re-checked every 24 hours and dropped if they go offline. Content belongs to the original authors.