Posts

All the articles I've posted.

• The Sandbox That Wasn't: Reversing CVE-2026-12537 in Gemini CLI

  24 Jul, 2026

  A CVE dropped against Gemini CLI with a 10.0 score and a two-line advisory that explained nothing. So I cloned the repo, read the patch backwards, and reconstructed how a .env file in a pull request turns into code execution on your CI runner — before the sandbox ever starts.

• Crashing Node.js with 40 Lines of JavaScript — A Memory Corruption Story

  24 May, 2026

  How I found a TOCTOU race condition in Node.js's native UTF-8 decoder that causes heap corruption via SharedArrayBuffer, built a working crash PoC, reported it to HackerOne — and watched it get closed as Informative.

• Solving YesWeHack Dojo #49 — How Two Dashes and a Dash-R Broke a Secret Manager

  23 Mar, 2026

  A detailed walkthrough of how I solved YesWeHack's Dojo #49 Secret Manager challenge by chaining two glob injection tricks — a recursive copy flag and a grep option terminator — to exfiltrate secrets from a protected directory in a single HTTP request

• How I Fixed False Positives in Dalfox XSS Scanner (Issue #884)

  14 Mar, 2026

  A deep dive into contributing to Dalfox — fixing false positive XSS alerts on JSON API endpoints, the mistakes I made, and the proper fix.

• Access secrets via s3 bucket versioning

  5 Mar, 2025

  In this lab, we will be solving an lab with an attack vector through a s3 bucket versioning feature and through that we can able to exfil the secrets and elevating further more

• Loot Public EBS Snapshots

  5 Mar, 2025

  In this lab, we will be solving an lab on understanding what ebs snapshots are and there misconfigurations....

• Leverage leaked credentials for pwnage

  2 Mar, 2025

  Finding leaked AWS access keys in a GitHub .env file, using them to enumerate the account, and pivoting into Amazon RDS to escalate and capture the flag

• Plunder Public RDS Snapshots

  2 Mar, 2025

  Enumerating publicly exposed Amazon RDS snapshots from just an AWS account ID, restoring one into my own account, and dumping the database to recover the flag

• Identify the AWS Account ID from a Public S3 Bucket

  24 Feb, 2025

  Getting to know about how we can able to fecth a AWS account ID from a publicly available s3 bucket

• Uncover Secrets in CodeCommit and Docker

  31 Jan, 2025

  In this lab, we will see how the leaked credentials through dockerhub can be leveraged atmost and more further