1. vulnerability

15/06/2022 – While exploring the web, I discovered a subdomain that shouldn’t have existed. What I found there was shocking: it was leaking the complete source code of an application, along with passwords to mail servers and remote access credentials. This wasn’t just a small oversight—anyone stumbling upon it could have full control and insight into the system.

17/06/2022 – I reported the issue immediately. The response was swift, acknowledging the critical nature of the leak.

13/07/2022 – After careful remediation, the problem was fixed. For my efforts, I was rewarded with a t-shirt and a heartfelt letter of appreciation—a small token for preventing a potentially massive breach.

Each discovery like this is a stark reminder: even a forgotten subdomain can become the gateway to serious security risks.

2. vulnerability

After i got lucky the first time i was on the hunt again..

this time i found a web site that was vulnerable to html injektion.

its was i simpel search box that i teste with “html” “<i>” and the search word displayed in “italic” when it was shown on the page “SEARCHWORD“.

so i startet testing different things i could do, and i manage to inject a meta tag that will redirect the site to where ever i wish.. så crafted a url codelink and click the link i and i was show the vulnerable site and a sec efter i was redirected, to the destination i injected in the meta tag.
so i reported my finding to the “ncsc”
again, boom.

• Report 8/11 – 22
• First response 9/11 – 22
• Problem fix 22/12 – 22

And was rewarded with a t-shirt again.

3. vulnerability

26/11/23 – While poking around the system, I discovered something that immediately set off alarms: a root certificate was exposed. This wasn’t just a small leak; a root certificate is the cornerstone of trust in digital security, and if it fell into the wrong hands, the consequences could be serious. I traced the exposure, documented the paths, and prepared my report.

27/11/23 – I sent the findings. The response was quick, and by the end of the day, the issue was fixed. A potentially critical vulnerability neutralized before it could cause harm. And as always, a little reward followed—another t-shirt on its way.

The hunt continues, and each discovery reminds me that even the smallest oversight can carry huge risks.