HackerOne Triage Range

6 mini-cases based on real triage calls. Tool: Burp Suite (Repeater). Your job for each case: reproduce it in Burp, then decide the verdict (Informative / N/A / Triaged) and the severity, and explain WHY. Severity here is decided by the right questions and checks, not by first impressions.

Your accounts for the API cases (Site Audit / Semrush-lite):

bob (you):  X-Api-Key: sk_bob_9d2e5f41a0c84b17
alice:      (no key is issued - you are the attacker, you do not have her key)

Auth header: X-Api-Key: <key>

Cases

case 1Site Audit — read another user's data by stamp

Reporter: "Any authenticated user can read another user's Site Audit by stamp — BOLA, High".

endpoints /siteaudit/api/validation/check, /siteaudit/api/validation/logs, /siteaudit/api/me

case 2Site Audit crawler — SSRF into the internal network

Reporter: "The crawler reaches internal addresses (CGNAT 100.64/10, any port) — SSRF, Medium/High".

endpoint POST /siteaudit/api/crawl (body: customSitemapStartUrl=…)

case 3Backlinko — API key in public GraphQL/ACF

Hackbot: looks like a duplicate of informative #2877712 "Information Disclosure via Public API" — archived key, Wayback class.

endpoints GET /backlinko/wp-json/acf/themeOptionsGeneral, GET /api/v4/projects

case 4Brand24 — stored XSS in the internal CMS

Reporter: "Blind/stored XSS, JS execution in app.brand24.com context — CVSS High". Asset: Other Semrush Related Asset (Brand24, acquisition).

views /brand24/ (public), /brand24/cms33/ (internal panel)

case 5OAuth Device Grant — "1-click ATO"

Reporter: "Mint a device_code with my own client_id with no auth → victim approves → 7-day token to their account. One-click ATO, Critical".

endpoints POST /oauth/dag/device/code, /oauth/dag/auth/verify_code, POST /oauth/dag/device/token

case 6OAuth authorize — "code theft to attacker.com"

Reporter: "redirect_uri is not validated, the code leaks to attacker.com → ATO".

endpoint GET /oauth/authorize?client_id=…&redirect_uri=…&response_type=code

H1 Triage Range - training mock. All data, keys and emails are fictional. Fetch and external APIs are simulated. ← home