corpus.blog
41554 blogs · [ { "id": "01a087da-a9ed-73cd-a0ea-4790a9343783", "title": "Hacking the World Poker Tour: Inside ClubWPT Gold’s Back Office", "url": "https://samcurry.net/hacking-clubwpt-gold", "published_at": "2025-10-12T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790a939be1a", "title": "Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel", "url": "https://samcurry.net/hacking-subaru", "published_at": "2025-01-23T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790a99c797f", "title": "Hacking Kia: Remotely Controlling Cars With Just a License Plate", "url": "https://samcurry.net/hacking-kia", "published_at": "2024-09-20T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790aa068e29", "title": "Hacking Millions of Modems (and Investigating Who Hacked My Modem)", "url": "https://samcurry.net/hacking-millions-of-modems", "published_at": "2024-06-03T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790aaa04bc3", "title": "Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platform", "url": "https://samcurry.net/points-com", "published_at": "2023-08-03T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790ab68c0aa", "title": "Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More", "url": "https://samcurry.net/web-hackers-vs-the-auto-industry", "published_at": "2023-01-03T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790ab831294", "title": "Exploiting Web3's Hidden Attack Surface: Universal XSS on Netlify's Next.js Library", "url": "https://samcurry.net/universal-xss-on-netlifys-next-js-library", "published_at": "2022-09-21T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790abe818ea", "title": "Hacking Chess.com and Accessing 50 Million Customer Records", "url": "https://samcurry.net/hacking-chesscom", "published_at": "2020-12-16T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790ac4956e0", "title": "We Hacked Apple for 3 Months: Here’s What We Found", "url": "https://samcurry.net/hacking-apple", "published_at": "2020-10-07T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790acad76d5", "title": "Hacking Starbucks and Accessing Nearly 100 Million Customer Records", "url": "https://samcurry.net/hacking-starbucks", "published_at": "2020-06-20T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790ad73ec79", "title": "Don't Force Yourself to Become a Bug Bounty Hunter", "url": "https://samcurry.net/dont-force-yourself-to-become-a-bug-bounty-hunter", "published_at": "2020-05-11T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790ae0361fc", "title": "Abusing HTTP Path Normalization and Cache Poisoning to steal Rocket League accounts", "url": "https://samcurry.net/abusing-http-path-normalization-and-cache-poisoning-to-steal-rocket-league-accounts", "published_at": "2020-04-19T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790aea3c8f0", "title": "Filling in the Blanks: Exploiting Null Byte Buffer Overflow for a $40,000 Bounty", "url": "https://samcurry.net/filling-in-the-blanks-exploiting-null-byte-buffer-overflow-for-a-40000-bounty", "published_at": "2019-11-01T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790af0b9a85", "title": "Analysis of CVE-2019-14994 - Jira Service Desk Path Traversal leads to Massive Information Disclosure", "url": "https://samcurry.net/analysis-of-cve-2019-14994", "published_at": "2019-09-26T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790afa1a619", "title": "Cracking my windshield and earning $10,000 on the Tesla Bug Bounty Program", "url": "https://samcurry.net/cracking-my-windshield-and-earning-10000-on-the-tesla-bug-bounty-program", "published_at": "2019-07-14T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790afff84c4", "title": "Reading ASP secrets for $17,000", "url": "https://samcurry.net/reading-asp-secrets-for-17000", "published_at": "2018-12-17T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790b0ce8456", "title": "The $12,000 Intersection between Clickjacking, XSS, and Denial of Service", "url": "https://samcurry.net/the-12000-intersection-between-clickjacking-xss-and-denial-of-service", "published_at": "2018-07-04T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790b13e6d36", "title": "Hacking a Massive Steam Scamming and Phishing Operation for Fun and Profit", "url": "https://samcurry.net/hacking-a-massive-steam-scamming-and-phishing-operation-for-fun-and-profit", "published_at": "2018-05-09T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790b233e818", "title": "Exploiting Directory Traversal to View Customer Credit Card Information on Yahoo's Small Business Platform", "url": "https://samcurry.net/exploiting-directory-traversal-on-a-yahoo-acquisition", "published_at": "2017-11-10T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790b31ed9f1", "title": "How I gained access to chef, docker, AWS, and MongoDB instances in a single request", "url": "https://samcurry.net/how-i-gained-access-to-chef-docker-aws-and-mongodb-instances-in-a-single-request", "published_at": "2017-08-03T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790b3a8a6ec", "title": "Permanent account takeover on Yahoo's Small Business platform", "url": "https://samcurry.net/permanent-account-takeover-on-yahoo-small-business", "published_at": "2017-06-25T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790b46ca8ad", "title": "How I could've taken over the production server of a Yahoo acquisition through command injection", "url": "https://samcurry.net/how-i-couldve-taken-over-the-production-server-of-a-yahoo-acquisition-through-command-injection", "published_at": "2017-06-04T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790b4aa06ca", "title": "Eradicating image authentication injection from the entire internet", "url": "https://samcurry.net/eradicating-image-authentication-injection-from-the-entire-internet", "published_at": "2017-05-10T00:00:00+00:00" }, { "id": "01a087da-a9ed-73cd-a0ea-4790b5a8f5ec", "title": "How I stole the identity of every Yahoo user", "url": "https://samcurry.net/how-i-stole-the-identity-of-every-yahoo-user", "published_at": "2017-05-09T00:00:00+00:00" } ] posts Claim your blog
Back to samcurry.net
Blog · corpus.blog/blogs/samcurry.net/posts

samcurry.net

samcurry.net

2025

Hacking the World Poker Tour: Inside ClubWPT Gold’s Back Officeoriginal ↗
12 Oct 2025
Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Paneloriginal ↗
23 Jan 2025

2024

Hacking Kia: Remotely Controlling Cars With Just a License Plateoriginal ↗
20 Sept 2024
Hacking Millions of Modems (and Investigating Who Hacked My Modem)original ↗
3 Jun 2024

2023

Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platformoriginal ↗
3 Aug 2023
Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and Moreoriginal ↗
3 Jan 2023

2022

Exploiting Web3's Hidden Attack Surface: Universal XSS on Netlify's Next.js Libraryoriginal ↗
21 Sept 2022

2020

Hacking Chess.com and Accessing 50 Million Customer Recordsoriginal ↗
16 Dec 2020
We Hacked Apple for 3 Months: Here’s What We Foundoriginal ↗
7 Oct 2020
Hacking Starbucks and Accessing Nearly 100 Million Customer Recordsoriginal ↗
20 Jun 2020
Don't Force Yourself to Become a Bug Bounty Hunteroriginal ↗
11 May 2020
Abusing HTTP Path Normalization and Cache Poisoning to steal Rocket League accountsoriginal ↗
19 Apr 2020

2019

Filling in the Blanks: Exploiting Null Byte Buffer Overflow for a $40,000 Bountyoriginal ↗
1 Nov 2019
Analysis of CVE-2019-14994 - Jira Service Desk Path Traversal leads to Massive Information Disclosureoriginal ↗
26 Sept 2019
Cracking my windshield and earning $10,000 on the Tesla Bug Bounty Programoriginal ↗
14 Jul 2019

2018

Reading ASP secrets for $17,000original ↗
17 Dec 2018
The $12,000 Intersection between Clickjacking, XSS, and Denial of Serviceoriginal ↗
4 Jul 2018
Hacking a Massive Steam Scamming and Phishing Operation for Fun and Profitoriginal ↗
9 May 2018

2017

Exploiting Directory Traversal to View Customer Credit Card Information on Yahoo's Small Business Platformoriginal ↗
10 Nov 2017
How I gained access to chef, docker, AWS, and MongoDB instances in a single requestoriginal ↗
3 Aug 2017
Permanent account takeover on Yahoo's Small Business platformoriginal ↗
25 Jun 2017
How I could've taken over the production server of a Yahoo acquisition through command injectionoriginal ↗
4 Jun 2017
Eradicating image authentication injection from the entire internetoriginal ↗
10 May 2017
How I stole the identity of every Yahoo useroriginal ↗
9 May 2017