Skip to content
>luq0x

luq0x

$ whoami

luq0x — penetration tester · bug hunter

$ cat README.md

Pentester by day, bug hunter by night. This is where I document the bugs I find, the chains I build and what I learn along the way.

$ lswriteups/about.md

latest bounties17

  • 2026.09.21€700
    ▪Account TakeoverPrivate
  • 2026.07.15€300
    ▪Account TakeoverPrivate
  • 2026.07.15€300
    ▪Path TraversalPrivate
  • 2026.05.29€300
    ▪Path TraversalPrivate
  • 2026.05.27€1,400
    ▪MFA BypassPrivate
  • 2026.05.22€187.50
    ▪Reflected XSSPrivate
  • 2026.05.22€187.50
    ▪Reflected XSSPrivate
  • 2026.05.22€150
    ▪HTML InjectionPrivate
  • 2026.05.04€800
    ▪AVS BypassPrivate
  • 2026.04.15€1,125
    ▪ATO via Chained IDORPrivate
  • 2026.04.02€975
    ▪Account TakeoverPrivate
  • 2026.02.27$150
    ▪RCECoveo
  • 2026.02.11€975
    ▪Reflected XSSPrivate
  • 2026.01.16€1,400
    ▪Cache DeceptionPrivate
  • 2026.01.07€400
    ▪Code InjectionSBB
  • 2025.11.07€1,875
    ▪Chained IDORPrivate
  • 2025.10.27€975
    ▪IDORPrivate

latest writeupssee all writeups →

IDOR chain diagram

2 min readIntigriti

From a Simple Random ID to a Mass PII Leak

A chain of IDORs that resulted in a massive PII leak, from names to GPS coordinates of a major e-commerce platform's customers

  • high
  • €1,875
  • bug bounty
  • web
  • idor