Blog | Sam Curry

In June, 2025, Shubs Shah and I discovered a vulnerability in the online poker website ClubWPT Gold which would have allowed an attacker to fully access the core back office application that is used for all administrative site functionality.

On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United States, Canada, and Japan.

On June 11th, 2024, we discovered a set of vulnerabilities in Kia vehicles that allowed remote control over key functions using only a license plate.

Two years ago, something very strange happened to me while working from my home network.

Between March 2023 and May 2023, we identified multiple security vulnerabilities within points.com, the backend provider for a significant portion of airline and hotel rewards programs.

While we were visiting the University of Maryland, we came across a fleet of electric scooters scattered across the campus and couldn't resist poking at the scooter's mobile app.

On August 24th, 2022, we reported a vulnerability to Netlify affecting their Next.js "netlify-ipx" repository which would allow an attacker to achieve persistent cross-site scripting and full-response server side request forgery on any website out of the…

Jackpot, full arbitrary account takeover of any chess.com user!

Between the period of July 6th to October 6th myself, Brett Buerhaus, Ben Sadeghipour, Samuel Erb, and Tanner Barnes worked together and hacked on the Apple bug bounty program.

After a long day of trying and failing to find vulnerabilities on the Verizon Media bug bounty program I decided to call it quits and do some chores.

Nearly every one of the successful bug bounty hunters I've met all seem to have one thing in common, and that is that they absolutely love what they do.

Rocket League gives out in-game "white hats" for your character to wear if you submit, what is deemed by them, to be a "severe security vulnerability".

I was in San Francisco the few days leading up to me finding this bug with some friends.

The CVE-2019-14994 vulnerability allows an attacker, if able to access the customer portal, to traverse to the administrative portal and view issues within all Jira projects contained in the vulnerable instance.

One of the more interesting things I've had the opportunity to hack on is the Tesla Model 3.

One of the more common vulnerabilities on ASP.NET applications is local file disclosure.

The specific application that I've been targeting over the last few weeks is a bitcoin gambling website where a stock will progressively rise over time.

When I'm not doing bug bounty or studying for school I'll often be playing Counter-Strike: Global Offensive or PLAYERUNKNOWN'S BATTLEGROUNDS.

The Yahoo small business platform was storing user information in a set of directories that were protected simply by obscurity.

The following article details the successful exploitation of a server sided request forgery vulnerability in Yahoo's small business platform.

If you decided to go out and spontaneously develop a content management system one of the most crucial and necessary setups would be the authentication of user accounts.

On the night of May 20th I had begun to develop a small headache and neck pains after spending days looking at Yahoo's messenger application.

Thinking back to old forum days I can specifically remember an event where attackers modified their avatars to be invalid pages that responded with "HTTP 401 Unauthorized".

When looking at bug bounty programs that have existed for a long time it’s often beneficial to assume that every public facing page has already been automatedly scanned to death.