How I Found and Reported a Critical Credential Stuffing Bug Worth $2000

Fuzzing
Next, I used tools like Burp Suite to perform fuzzing, testing for vulnerabilities like input validation issues or hidden endpoints. While I didn’t find an immediate vulnerability, it helped refine my approach.

Leaked Data Search
When fuzzing didn’t yield results, I turned to leak sites like Dehased.com and LeakPeak ,pentster.com to check if there were any exposed credentials linked to the target domain.

5. Credential Testing
I used the leaked credentials to attempt a login. To my surprise, I successfully accessed an account, confirming the security weakness.

I reported the finding through a bug bounty program, ensuring the issue was addressed and resolved by the website’s security team.