Breaking things to defend them better. RSS Feed
Bug bounty writeups, cloud security research, SOC notes & more — by Nithissh .
Featured
-
The Sandbox That Wasn't: Reversing CVE-2026-12537 in Gemini CLI
A CVE dropped against Gemini CLI with a 10.0 score and a two-line advisory that explained nothing. So I cloned the repo, read the patch backwards, and reconstructed how a .env file in a pull request turns into code execution on your CI runner — before the sandbox ever starts.
-
Crashing Node.js with 40 Lines of JavaScript — A Memory Corruption Story
How I found a TOCTOU race condition in Node.js's native UTF-8 decoder that causes heap corruption via SharedArrayBuffer, built a working crash PoC, reported it to HackerOne — and watched it get closed as Informative.
Recent Posts
-
Solving YesWeHack Dojo #49 — How Two Dashes and a Dash-R Broke a Secret Manager
A detailed walkthrough of how I solved YesWeHack's Dojo #49 Secret Manager challenge by chaining two glob injection tricks — a recursive copy flag and a grep option terminator — to exfiltrate secrets from a protected directory in a single HTTP request
-
How I Fixed False Positives in Dalfox XSS Scanner (Issue #884)
A deep dive into contributing to Dalfox — fixing false positive XSS alerts on JSON API endpoints, the mistakes I made, and the proper fix.
-
Access secrets via s3 bucket versioning
In this lab, we will be solving an lab with an attack vector through a s3 bucket versioning feature and through that we can able to exfil the secrets and elevating further more
-
Loot Public EBS Snapshots
In this lab, we will be solving an lab on understanding what ebs snapshots are and there misconfigurations....