> For the complete documentation index, see [llms.txt](https://gowsundar.gitbook.io/book-of-bugbounty-tips/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gowsundar.gitbook.io/book-of-bugbounty-tips/account-takeover.md).

# Account Takeover

* [Account takeover worth $$$$ 1. Created account on website using test mail id 2. Upload private document like resume and photos 3. Same site having android app > Created account using same mail id but different password 4. Boom account created and able to see private documents](https://twitter.com/ADITYASHENDE17/status/1243268557917442048?s=20)
* [#bugbounty I Was able to bypass the Filter on OAUTH through FUZZ With URL-Encode Chars , Found that Website Add / before %5b when redirect the token Example : target/oauth?redirect\_uri=http://attacker.com%https://t.co/QSv7Vm2STd Redirect Token to : http://Attacker.com/%5b.target.comrget.com?token=…...](https://twitter.com/ElMrhassel/status/1282661956676182017?s=20)
* [I was testing for ATO via reset function . Tried all method but no success. My friend@Tabnexa gave me tip to add double Host in request while requesting password Host: http://site.com Host: http://evilsite.com Boom it worked](https://twitter.com/ADITYASHENDE17/status/1274690489468383232?s=20)

![https://twitter.com/chiraggupta8769/status/1297102892135063552?s=20](/files/-MTAHe5VFwFE2LgAp5gM)

*

![](/files/-MTeAy7MaliX-1yvm32G)