This article is the 1st part of the “Fintech Bug Bounty” series. Summary How I became a millionaire in 3h | Fintech Bug Bounty — Part 1 GraphQL Exploitation Techniques | Fintech Bug Bounty — Part 2 (REDACTED) | Fintech Bug Bounty — Part 3 | Available on Feb 2023 (REDACTED)…

This article is the 2nd part of the “Fintech Bug Bounty” series. Summary How I became a millionaire in 3h | Fintech Bug Bounty — Part 1 GraphQL Exploitation Techniques | Fintech Bug Bounty — Part 2 (REDACTED) | Fintech Bug Bounty — Part 3 | Available on Feb 2023 (REDACTED)…

I’m a technical guy. However, this post doesn’t contain any technical details (but that’s because this bug doesn’t require any). I need to admit it: finding this bug was pure luck. No skill was involved at all. Some context… A couple of weeks ago, a client for whom I worked last year…

This story begins a couple of years ago. I was navigating through a gambling website (which I cannot disclose) when I decided I would search for vulnerabilities on it. Usually, this is not a good practice since you don’t have permission to do so. Getting suited is always a risk…