The ledger

Bounty writeups.

Real disclosed-bounty writeups — every entry states a real bounty, verified live against the article before it's listed. Dead links are dropped automatically.

44 writeups · $585.5k in bounties · checked today

All XSS4 IDOR5 SSRF3 SQL Injection1 RCE4 Access Control7 Account Takeover12 Info Disclosure11 CSRF1 Race Condition1 GraphQL1 Business Logic4 2FA3

SortHighest bounty Newest

How this team accidentally found a SSRF in Slack exposing AWS credentials — $4000

SSRFInfo DisclosureSlack$4k4y ago

SSRF in a complex library exposing AWS keys — impact framing done right.

Roberto · InfoSec Write-ups ↗

Bug bounty write-up: From SSRF to $4000

SSRFprogram unnamed$4k6y ago

Methodical SSRF chain — one of the best-structured learning writeups.

thehackerish · thehackerish.com ↗

Story of a 2.5k Bounty — SSRF on Zimbra Led to Dump All Credentials in Clear Text

SSRFInfo DisclosureCafebazaar$2.5k6y ago

SSRF into a Zimbra mail instance → full credential dump.

Yasho · InfoSec Write-ups ↗

Every bounty amount, date and link was verified against the original article before listing; articles are re-checked every 24 hours and dropped if they go offline. Content belongs to the original authors.