Client-side Authentication Bypass
A blog about bypassing authentication that is enforced only in client-side JavaScript, with four real-world case studies from bug bounty and Synack Red Team engagements.
Cache Deception Without Path Confusion
A weird case of Web Cache Deception vulnerability that didn’t utilize path confusion for exploit.
Defeating Length Filters to Dump the Database - SQLi
A blog about how I managed to bypass length filter on an SQLi to dump the database
Escalating Privileges With SSRF
This post is regarding my findings on Synack Red Team. The findings included a total of 4 SSRFs. One of them being a fully unauthenticated SSRF leading to high privileged account takeover.
Full Disclosure - DOM-based XSS And Failures In Bug Bounty Hunting
A writeup about my failures while doing bug bounty
Holiday Hunting With Aquatone
This blog is about my findings while on a workcation to Goa with my hacker friends.
Second Order XXE Exploitation
A writeup about my finding on Synack that was an XXE that allowed me to read local files stored on the web server.
NoSQL Injection in Plain Sight
A writeup about a recent NoSQL injection I found in Synack Red Team