How I Hacked Thousands of Subdomains
A subdomain-takeover workflow everyone considered closed, one missing server-side validation, and the curiosity that turned a single strange response into thousands of historical findings.
Thousands of exposed subdomains
One-Click ATO: The Reset That Trusted the Client
An unauthenticated recovery call let me choose where a genuine reset email sent its recipient. One click carried the recovery token to the wrong host.
Open case study
A Report With 50 Comments Took Down HackerOne (2,500$ Bounty)
An uncapped PDF export let a single low-volume attacker degrade HackerOne's global response times — and nearly didn't get rewarded for finding it.
Read brief
Doubling Throughput: Bypassing Endpoint Rate-Limiting via Path Traversal Slashing
The rate limiter counted `/login` and `/login/` separately while the application routed both to one handler—doubling permitted authentication traffic from a single IP.
Read brief
Unintended Exposure: How Slack Connect Quietly Defaulted to Open Signups ($1,750 Bounty)
A Slack Connect provisioning path silently enabled approved-domain signup on new workspaces, exposing supposedly isolated collaboration spaces to unintended insiders.
Read brief
From Tool Testing to Data Rescue: Exposing a 4GB Cloud Backup Leak
A routine Skybrute test uncovered a public 4GB enterprise Slack backup spanning ten years—and the affected team closed the exposure within 30 minutes.
Read brief
Chaining Low-Severity Flaws into Critical Privilege Escalation, Hijacking Invites
An unverified identity and an invitation token that was not bound to its recipient combined into vertical privilege escalation and workspace takeover.
Read brief
Mastering Race Conditions: Two Methods for Bypassing Email Verification
Two different concurrency bugs broke the same identity guarantee: one raced an invitation against an email change, while the other applied a valid token to the wrong active address.
Open case study
Infiltrating Enterprise Slack Workspaces via Expired Domain Signups
An expired domain can outlive its ownership inside an enterprise signup allowlist, turning an abandoned DNS asset into a trusted workspace identity.
Read brief
Bypassing Slack’s Invite Acceptance via Role Modification ($1,500 Bounty)
Two role changes pushed a pending Slack invitation into an active-member state—joining a user to a workspace without acceptance or consent.
Read brief
How Stripping a Header Bypassed an OAuth Proxy
What began as HTTP request-smuggling research exposed a far simpler fail-open proxy rule: omit one header and the protected administrative login appeared.
Read brief
Welcome to the codéjà Vu Blog
The home of codéjà Vu vulnerability research, field notes, and practical security guidance—designed for English, Arabic, and Kurdish publishing.
Read announcement
CRLF to Account Takeover: Chaining Three Bugs
A rejected response-splitting report became a High-severity account-takeover chain when a shared-domain cookie, a cookie-based XSS, and browser autocomplete were connected.
Open case study