https://blog.veysel-xan.com/cyb3rlynxVulnerability research, bug bounty writeups, and CVE disclosures by cyb3rlynx — web application exploitation, recon workflows, and the security tools I build along the way 2026-06-20T18:04:25+00:00 cyb3rlynx https://blog.veysel-xan.com/ Jekyll © 2026 cyb3rlynx /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png That Time a Bank Blocked My Account and Still Handed Me a Token2026-06-20T00:00:00+00:00 2026-06-20T00:00:00+00:00 https://blog.veysel-xan.com/posts/bank-otp-bypass/ cyb3rlynx A four digit OTP, a ten minute lockout, and a backend that never got the memo. The story of the laziest brute force I ever ran turning into an auth bypass. I Came for RFI, I Left with SSRF + XSS2026-06-17T00:00:00+00:00 2026-06-17T00:00:00+00:00 https://blog.veysel-xan.com/posts/i-came-for-rfi-i-left-with-ssrf-xss/ cyb3rlynx A messy little bug where a URL inside a URL made the server phone a stranger, then reflect whatever it said straight into the page.