MIZUKI BOUNTY CLAIMS

Lack of rate limiting leaves the API vulnerable to Denial of Service (DoS) attacks, rendering the service inaccessible. Coupled with insecure headers allowing the site to be used as an attack vector.

Lack of rate limiting leaves the API vulnerable to Denial of Service (DoS) attacks, rendering the service inaccessible.

Lack of rate limiting leaves the API vulnerable to Denial of Service (DoS) attacks, rendering the service inaccessible.

Discovered and exploited insecure public API to mine sensitive API keys and manipulate game data through memory modification.

Loophole in API where users can send mail for free as opposed to paying on the website UI.

Unauthenticated API with incorrect token scope allowing users to read and modify other users account data and emails.

Discovered and exploited insecure public API routes to extract user data and manipulate the Palm Island Telegram game functionality.

Exploited insecure public API routes to extract Twitter credentials from the platform.

Identified and exploited insecure public API routes to extract sensitive user data from the platform.

Successfully exploited insecure public API routes to mine user data from the platform.

Leveraged exposed API endpoint to extract user data from the platform's database.

Exploited exposed API endpoint to extract both Stripe payment information and personal user data.

Data mined game files to extract deployment credentials for Android and iOS platforms along with external analytics service credentials.

Exploited server configuration vulnerability to extract AWS server credentials and OpenAI API keys.

Extracted Firebase configuration through hardcoded client-side variables and bypassed token gate through direct API server access.

Exploited exposed leaderboard endpoint to extract extensive user data from the web3 game platform.

Exploited exposed endpoint to extract sensitive user data, affecting over 9,000 user accounts.

Exploited exposed endpoints in NFT marketplace to extract sensitive user data including email addresses, contact information, and passport details.

Leveraged exposed endpoints to extract personal and sensitive data from various game studios on the platform.