Archives

A CVE dropped against Gemini CLI with a 10.0 score and a two-line advisory that explained nothing. So I cloned the repo, read the patch backwards, and reconstructed how a .env file in a pull request turns into code execution on your CI runner — before the sandbox ever starts.

How I found a TOCTOU race condition in Node.js's native UTF-8 decoder that causes heap corruption via SharedArrayBuffer, built a working crash PoC, reported it to HackerOne — and watched it get closed as Informative.

A detailed walkthrough of how I solved YesWeHack's Dojo #49 Secret Manager challenge by chaining two glob injection tricks — a recursive copy flag and a grep option terminator — to exfiltrate secrets from a protected directory in a single HTTP request

A deep dive into contributing to Dalfox — fixing false positive XSS alerts on JSON API endpoints, the mistakes I made, and the proper fix.

In this lab, we will be solving an lab with an attack vector through a s3 bucket versioning feature and through that we can able to exfil the secrets and elevating further more

In this lab, we will be solving an lab on understanding what ebs snapshots are and there misconfigurations....

Finding leaked AWS access keys in a GitHub .env file, using them to enumerate the account, and pivoting into Amazon RDS to escalate and capture the flag

Enumerating publicly exposed Amazon RDS snapshots from just an AWS account ID, restoring one into my own account, and dumping the database to recover the flag

Getting to know about how we can able to fecth a AWS account ID from a publicly available s3 bucket

In this lab, we will see how the leaked credentials through dockerhub can be leveraged atmost and more further

Walkthrough of exploring AWS securityhub and a simulation activity to identify an issue that lead to some interesting findings

A detailed walkthrough of how I solved Intigriti's May 2024 XSS challenge by exploiting a 2nd-order formula injection vulnerability in PhpSpreadsheet's calculateFormula() to achieve Cross-Site Scripting

An Individual research on bugbounty programs that I took an unique approach on choosing porn industry based programs which paid me pretty much..

A walkthrough of how I solved Intigriti's April 2024 monthly XSS challenge — hardcoded creds in the DOM, an iframe sandbox misconfiguration, and a postMessage handler with no origin check that turned into a clean XSS

This is a challenge from pwnedlabs where I've been provided with the cloudtrial logs and from there I've to do log analysis and trying to reproduce the attack from the attacker perspective

Lab from pwnedlabs where we have provided with a webserver and we are gonna look into how we can leverage it to SSRF

IAM Challenge from Wiz where we will be given an IAM rules and need to identify misconfiguration and exploit it to get a flag

My First Bug in my bugbounty journey where I took an approach of guy who solves the CTF... Unfortunately it worked and I found some sensitive files which lead to a bounty