BugBountyCTF-Reports

This repository contains fully disclosed accepted reports of the null Ahmedabad's Bug Bounty CTF.

Reports

1. Database Sensitive Information Disclosure in "/docker-compose.yml"
2. Stored XSS in bio + CSRF leads to full account takeover
3. Stored XSS + CSRF leads to full account takeover ( In Bio URL )
4. xmlrpc.php FILE IS enable it can be used for Bruteforce attack
5. CSRF in "Join Group" Button leads to send request to join Arbitrary group from victim's account
6. All Group user account takover via Stored XSS
7. xss
8. SQLI at : https://social.barracks.army/group.php?group_id=
9. CSRF while leave group leads to force victim to leave any group