Red Team ONLINE CTF & Bug Bounty Bug Hunting & CTF Squad

SERROS404

Web & API Security Researcher

Web and API security testing. Manual exploitation, access control flaws, and coordinated vulnerability disclosure.

Bug Bounty Web Pentest API Security

Bug Bounty

HackerOne Intigriti Bugcrowd

3 Reports

Intelligence Reports

// AUTHORED BY SERROS404

TOTAL: 3

MEDIUM

Web Security

2026-08-28

Dissecting IDOR: When Hidden Resources Are Still Accessible Through the API

A practical breakdown of Insecure Direct Object Reference (IDOR) — theory, a real-world private-album API case study, comparison with other disclosed reports, and detection/mitigation strategies.

Critical 10.0: Full BI Infrastructure Compromise via Default Credentials

A detailed write-up on how factory-default credentials on a MicroStrategy administrative panel led to a complete takeover of corporate Business Intelligence assets.

Abusing WhatsApp Desktop for Initial Access: Python ZipApp Reverse Shell

A technical analysis of how .pyz files can be used to bypass protections and establish a Reverse Shell via WhatsApp Desktop.

SERROS404